AI for accounts payable: invoice coding, duplicate checks and vendor fraud

Where AI helps in accounts payable

• Reading invoices into a table, including scanned ones. The PDF to Excel guide covers the rules and the tie-out.
• Suggesting GL codes and departments from the description and how the vendor has been coded before.
• Flagging possible duplicates that a simple formula misses.
• Reconciling vendor statements to your payables, as in the two-list reconciliation guide.
• Drafting vendor emails about missing purchase orders, short shipments or statement queries.

Coding invoices with AI

Give the AI what a new AP clerk would need: the accounts it may use, your coding rules, and how each vendor has been coded before. Tell it to mark anything unclear for review rather than guess.

Attached: this week's invoices (vendor, invoice number, date, description, amount), our list of GL accounts and departments, and last quarter's codes by vendor.

Suggest a GL account and department for each invoice. Rules:
- Use only accounts on the list.
- If a vendor has been coded consistently before, use that code and say so.
- If an invoice is for equipment or software over [your capitalization threshold], mark it "Review: possible capital item".
- If you can't tell what was bought, mark it "Needs review" and say what's missing.

Return a table: invoice number, suggested account, department, reason.

What to check: every "Needs review" line, every new vendor, the largest invoices, and anything near your capitalization threshold. Then sample the rest. Keep a count of how many suggested codes your reviewers change: it tells you, over a few weeks, how much checking the AI's coding still needs.

Duplicate invoices: formulas first, then AI

Exact duplicates are a formula's job. With the vendor in column A, the invoice number in B, the date in C and the amount in D:

Real duplicates are often not exact. The same invoice comes in by email and by post with a slightly different number, or gets keyed twice with a typo. This formula flags the same vendor and amount within 30 days:

AI is useful for the near misses formulas can't see: "INV-0042" and "42", a vendor name spelled two ways, a credit note and a re-issued invoice. Ask it to list possible duplicate pairs with the reason for each, then open both invoices before you hold or void anything. Some regular charges, such as monthly fees, really are the same amount twice.

The three-way match stays

Before an invoice is paid, the purchase order, the receiving record and the invoice should agree on what was ordered, what arrived and what's being charged. AI can compare the three documents and list the differences in quantity or price. Whether to pay despite a difference is a decision for your tolerance rules and your approvers, not the AI.

Vendor bank detail changes: check every one

This is where AP loses the most money. In the FBI's 2025 Internet Crime Report, business email compromise caused the second-largest losses after investment fraud, out of more than $20 billion in reported losses. The report also notes that chat generators can quickly create official-sounding emails mimicking a company's executives, and that businesses reported losses of over $30 million in 2025 to business email compromise involving AI (FBI IC3).

In practice: a well-written email, apparently from a real vendor, says their bank details have changed. A fluent email is no longer a sign that it's genuine.

• Verify every change to bank details through a second channel, as the FBI advises (IC3). Call the vendor on a number from your own records or the contract, never one given in the email asking for the change.
• Have a second person approve any change to vendor master data.
• Watch for pressure: urgency, secrecy, or a request to skip the usual process.
• Check the sender's address, including domains that differ from the real one by a single character.
• Don't ask an AI whether an email is genuine and rely on the answer. It can't call the vendor for you.

If a payment does go to the wrong account, contact your bank straight away to ask for a recall, and report it to ic3.gov. The FBI's advice is that time is of the essence.

New vendors: where many problems start

A fake or mistyped vendor is easier to stop at setup than at payment. Before a new vendor is added:

• collect a Form W-9 from US vendors, which gives you the taxpayer identification number you'll need for 1099 reporting;
• check the name, address and bank details against an independent source, such as the contract or the vendor's own website, not just the documents they sent;
• have someone other than the requester approve the setup.

AI can compare a new vendor's details with your existing vendor list and flag near-matches, such as a name or address that closely resembles a current vendor. That's a useful prompt for a closer look, not a verification.

Approvals still belong to people

An AI's suggested code is not an approval, and an AI flagging no duplicates is not a clearance. Keep your approval limits and your separation of duties as they are: the person who sets up or changes a vendor shouldn't be the person who approves that vendor's payments. Record in your AI policy which AP steps use AI and who checks them.