Large and small businesses and even the Australian Taxation Office (ATO) may be hit with fraudulent reimbursement claims, which are almost impossible to distinguish from legitimate receipts and invoices.

Individuals also need to be wary.

Look at the photos of the receipts shown below. One documents a genuine transaction. The other was created using ChatGPT. Can you spot the fake?

Now have a look at this one.

You possibly couldn’t – and that’s exactly the point. Systems which can reproduce near perfect counterfeits of legitimate financial documents are increasingly prevalent and sophisticated.

Last week, OpenAI released an improved image generation model which can create images with photorealistic outputs including text.

Why should we care?

Fraud involving fake financial documents is a massive global issue. The international Association of Certified Fraud Examiners estimate organisations lose approximately 5 per cent of revenue to fraud each year.

In its 2024 report, the association documents losses exceeding US$3.1 billion across 1,921 cases. Billing and expense fraud constitute 35 per cent of asset misappropriation cases, with firms reporting median losses of US$150,000 per incident.

Most concerning, fraudsters primarily conceal these crimes by creating fake documents or altering files, exactly what AI now simplifies.

Fake documents enable fraud in various ways. An employee might create a fictitious receipt for a business lunch that never happened, or a contractor might fabricate receipts for expenses never incurred. In each case, the fraudster uses counterfeit documentation to extract money they’re not entitled to.

This problem is likely more widespread than recognised. A 2024 survey revealed 24 per cent of employees admitted to expense fraud, with another 15 per cent considering it.

Even more concerning, 42 per cent of UK public sector decision makers confessed to submitting fraudulent claims.

AI removes barriers to deception

Understanding how AI technology may lead to a surge in potential fraud requires examining the classic “fraud triangle”. This explains that fraud requires three elements: incentives, rationalisation and opportunity.

Historically, technical barriers limited the ability to create fake documentation even when motivation existed.

AI eliminates these barriers by making fake documentation easy to create. Research confirms when opportunity expands, fraud increases.

When fake claims become everyone’s problem

When fake receipts support tax deductions, we all pay.

Consider a marketing consultant earning $120,000, who uses an AI image generator to create several convincing receipts for non-existent expenses totalling $4,000. At their marginal tax rate of 30 per cent, this fraud saves them about $1,200 in taxes – if they are not caught.

The Australian Taxation Office estimates a $2.7 billion annual annual gap from incorrectly over-claimed deductions by small businesses. With digital forgery becoming more accessible, this gap could widen significantly.

Fake receipts and invoices

Consumers are also becoming increasingly vulnerable to scammers using AI-generated receipts and invoices.

Imagine receiving what looks like an official invoice from your energy provider. The only difference? The payment details direct funds to a scammer’s account.

This is already occurring. The Australian Competition and Consumer Commission reported more than $3.1 billion lost to scams in 2023, with payment redirection fraud growing rapidly.

As AI tools make creating and editing convincing business documentation easier, these scam numbers have the potential to increase.

The growing threat

This vulnerability for both businesses and consumers is amplified by our increasing reliance on digital documentation.

Today, many businesses issue receipts in digital formats. Expense management systems typically require employees to submit photos or scans of receipts. Tax authorities also accept electronically stored documentation.

With paper receipts becoming increasingly rare and paper’s physical security features gone, digital forgeries become nearly impossible to spot through visual inspection alone.

Is digital authentication the answer?

One potential countermeasure is the Content Provenance and Authenticity (C2PA) standard. The C2PA standard embeds AI generated images with verifiable information about file origin.

However, a major weakness remains, as users can remove metadata by taking a screenshot of an image. For businesses and tax authorities, digital authentication standards are just part of the answer to sophisticated digital forgery. Yet reverting to paper documentation isn’t feasible in our digital era.

Seeing is no longer believing

AI’s ability to create realistic fake financial documents fundamentally changes our approach to expense verification and financial security.

The traditional visual inspection of receipts and invoices is rapidly becoming obsolete.

Businesses, tax authorities and individuals need to adapt quickly by implementing verification systems that go beyond simply looking at documentation.

This might include transaction matching with bank records, and automated anomaly detection systems that flag unusual spending patterns. Perhaps the use of blockchain technology will expand to help verify transactions.

The gap between what AI can create and what our systems can reliably verify continues to widen. So how do we maintain trust in financial transactions in a world where seeing is no longer believing?

This article is republished from The Conversation under a Creative Commons license. Read the original article.

The post Can you spot a financial fake? How AI is raising our risks of billing fraud appeared first on Inside Small Business.

Shaun Both was the former owner of Metro Express Cafe. Between 3 March 2014 and 11 January 2016, the business operated on the campus of the University of South Australia. Both submitted nine quarterly business activity statements as the sole owner of Metro Express Cafe, knowingly claiming $1,001,004 in GST refunds that he was not entitled to. In late 2016, Both was forced into bankruptcy and had his assets liquidated to repay ATO debts.

Both pleaded guilty to nine counts of obtaining a financial advantage by deception contrary to section 134.2 and one count of knowingly dealing with money that is proceeds of crime contrary to section 400.4 of the Criminal Code (Cth).

“Not only did this offender gain an unfair advantage over other businesses, he stole money that is used for essential community services such as schools, hospitals and transport,” said ATO Assistant Commissioner Jade Hawkins.

In 2019, Both fled to remote Western Australia to avoid facing court on refund fraud charges in South Australia. However, the ATO tracked him down and he was arrested by the Federal Police.

“This matter proves it doesn’t matter where you try to hide, the ATO will find you and make sure you are held accountable for your actions,” said Hawkins. “We know most people do the right thing, but those who deliberately cheat the system will be held to account.”

The post SME owner jailed over $1m GST fraud appeared first on Inside Small Business.

Banjo’s Head of Credit, Portfolio Management Christopher Cam, warned that SMEs need to keep a sharp eye on doctored financial information, fake invoices, phishing emails, and other online scams as they continue to grow in scope and complexity.

“Creating fake invoices to skim money out to different accounts and payroll fraud is increasing. And businesses need to ask themselves, where you have people dealing with customer data – are there enough internal controls to ensure that customer data is not leaked to the dark web?” he said.

Compromised executive emails a cause for concern

Cam also pointed out the prevalence of compromised business email addresses from executive teams, which should be a cause for concern for businesses.

“They usually have a flavour of urgency to them, saying something like the CEO saying they’re stuck at a conference so they can’t talk, but asking for gift cards to be bought for an upcoming function. The messages will often say the purchaser will be reimbursed for the expense, but it never happens,” he explained. “They feel silly going to another colleague or HR to check that it’s legitimate. They just think, ‘Oh, well, it’s just buying gift cards, and the email itself seems very plausible’.”

Tips for avoiding fraud

Cam shared strategies for SMEs to quickly detect fraud and minimise their risk. First and foremost, he recommends using the services of a reputable external auditor.

“Appoint external fraud detection and prevention experts to conduct an audit of your business, including regular penetration testing. Not only will an external auditor be able to see if fraud is already happening, but they can also identify where it may be at risk of it occurring,” he said.

Cam also suggested that companies introduce and implement an anti-fraud/ethical conduct policy, especially on handling financial transactions. In addition, business owners should implement strong internal controls such as assigning different duties to different employees, especially in financial transactions, to improve oversight and lessen the likelihood of irregular or illegal activities.

“Knowing what to do when you spot fraud is critical. It clarifies a ‘chain of command’ for reporting a suspicion of fraudulent activity and it provides a strategy for minimising further losses,” Cam said. “If related to a cybercrime attack, an action plan should outline the steps to follow to protect other sensitive data and ensure business continuity. For directors, it should also clarify who to speak to in terms of legal and professional advice.”

The post SMEs urged to remain vigilant amid rising financial fraud appeared first on Inside Small Business.

“There are real opportunities for small business in engaging with eInvoicing,” Billson shared. “It’s a great way of sending invoices in a secure way, with improved cyber protection, simplicity and efficiency. Cashflow is the oxygen of enterprise, and this is a more secure and efficient way of dealing with what is a vital part of getting paid, replacing what can be a tendinous, mundane and error-prone activity.”

Billson explained that eInvoicing allows a business to exchange invoices through a secure network using existing business software, making it easier and safer to send and receive invoices digitally with other businesses, such as suppliers, contractors or government.

“The process is entirely digital and eInvoices are not PDF invoices that need to be printed, posted or emailed,” he said.

The Ombudsman pointed out that small businesses have long been particularly vulnerable to invoice substitution scams, also called payment redirection scams or business email compromises, wherein cybercriminals can intercept emails to customers and insert different bank account details for payments. The details sent out to the unknowing small business look legitimate enough and reflects a bill they were expecting for the small business unknowingly pays it. The money then goes to the criminal’s bank account and is quickly shifted, usually to cryptocurrency, where the chances of recovering the lost money become slim, if not none at all.

“Scamwatch data shows small businesses lost millions of dollars in such scams last year. Using eInvoicing can reduce this risk,” Billson said, adding that eInvoicing can also help streamline business operations.

“No one wants to spend all their life sending out Invoices. Imagine if that system was connected with your customers and your suppliers, he said. “You can send the information off, you validate that it’s the right people with all the critical information to execute the payment.”

The Federal government has already taken steps in pushing eInvoicing, as it has committed to spending $23 million of the Federal Budget for its adoption among small businesses, alongside efforts to incentivise its use with faster payment times by its suppliers, both of which have been acknowledged and commended by the Ombudsman.

In addition, Billson also commended the efforts of finance software providers in offering eInvoicing in their platforms,

Billson concluded with reiterating the call towards a shift to eInvoicing, saying, “For small and family businesses, I urge taking up the eInvoicing option to really streamline their dealings with other business and government customers, expand the use of eInvoicing across a growing network of users and increase the benefits to individual businesses and the economy that the technology offers.”

The post Small businesses urged to adopt eInvoicing appeared first on Inside Small Business.

Billson issued his reminder to mark Scam Awareness Week, urging small-business owners to take a few extra moments to check they have appropriate safeguards in place to avoid being victimised by these scams.

“Some recent cases have left small-business owners with tax debts after they gave their myGov details to scammers who they thought were friends or people helping them,” Billson said. “Scams come in all shapes and sizes. Some are from very sophisticated hackers but others are credit card scams or fraudsters who claim to be trying to help you with your small business as they rip you off.

“I urge small and family businesses not to give anyone access to important information such as your myGov password and login, and always check agreements you sign up to and make sure you get what is promised in return,” Billson added. “Only use registered tax agents and accountants and do not give your myGov details to anyone.

“Scamwatch says three in every four scam reports involve criminals pretending to be people we should trust. If an offer looks too good to be true then it probably is. Trust your Spidey-senses,” the Ombdudsman warned. added.

“Sadly, if a criminal impersonates your business, it not only costs you and your customers money but can damage your brand and lead to a loss of consumer trust and confidence and the ability to operate. Too often, a cyber attack can be an enterprise-ending event for a small business,” Billson continued.

The Ombudsman also expressed concern about a scam involving website design or search engine optimisation.

“Scammers may sign you up for a single or monthly payment which they take from your credit card but they continue to do so even after the agreement for their service has expired,” Billson said. “In some cases they take the money but the website promised is never delivered. And businesses can face an enormous effort trying to exit these arrangements after realising they have been duped.”

“My rule of thumb is to spend one hour for every $1000 you are likely to spend checking out that it is legit, that the business you intended dealing with is real and to make sure it can deliver what is being promised. These businesses either don’t have business addresses or impersonate legitimate other businesses for cover, and if they use an ABN it often belongs to a similarly named legitimate business.”

Billson reminded small businesses to check the credentials of these types of suppliers such as their ABN and business name and if they don’t match or something doesn’t appear right, investigate further.

Small businesses who are concerned they might be the victim of a scam should contact the new National Anti-Scam Centre’s ‘Report a Scam’ page on their website www.scamwatch.gov.au/report-a-scam or report to the ASBFEO at www.asbfeo.gov.au.

The post ASBFEO warns small-business owners about rise in scams appeared first on Inside Small Business.

The research pointed out that this figure is the greatest concern for CFOs at 98 per cent. Additionally, 60 per cent stated that they’re concerned about fraud going undetected in their business, while 10 per cent said they’re aware of one or more fraud events occurring in their organisation within the past three years.

Despite these concerns, a significant portion of businesses are foregoing control processes that mitigate scam risks, especially so for small (2-19 employees) and medium-sized (20-199) businesses, with 17 per cent of small businesses not using any anti-fraud controls at all.

When asked about security controls, 58 per cent of small businesses admitted that they’re not using segregation of duties policies, while 42 per cent of medium businesses say the same. Only 37 per cent of small businesses and half of medium-sized businesses are using verbal verifications during payment processes while larger organisations (more than 200 employees) tend to use a broader variety of controls, while approval authority processes were the most popular control among organisations of all sizes.

The report however noted that many approval processes can be circumvented by BEC attacks and have already cost Australian businesses $224 million in 2022 according to the Australian Competition and Consumer Commission (ACCC). The Australian Institute of Criminology (AIC) has estimated that small- to medium-business owners and officers are more than twice as likely to be victims of cyber scams than employees at larger organisations.

Eftsure’s research also found that smaller organisations are less likely to work with technology professionals to perform staff security training or develop anti-cybercrime strategies. They’re also less likely to say they’re planning to upgrade or invest in anti-fraud controls.

“There certainly are some immediate steps that small business leaders can take to improve their cybercrime defences right now, including strengthening their anti-fraud controls,” Mark Chazan, Chief Executive Officer at Eftsure, said. “However, smaller organisations are working with fewer resources and smaller headcounts. It’s not realistic to expect the exact same security posture as large international corporations.

“It’s one of several reasons why all organisations should be looking toward collaborative cybersecurity approaches and strategies,” Chazan added. “There’s no limit to malicious actors worldwide, and they don’t need a high success rate to benefit. However, collaborative approaches improve our collective defences and make Australia’s entire business community safer.”

According to Chazan, ‘collaborative cybersecurity’ includes diffusing responsibilities across many different functions within a single organisation, as well as greater information-sharing and community-building between multiple organisations and sectors.

Chazan has urged SME leaders to reassess their people, processes and technology. This means keeping staff informed about scam tactics, updating control procedures and automating certain processes for stronger security.

“Finance leaders can take a page from cybersecurity specialists’ playbook and proactively test your security controls,” he said. “For example, send your AP team a duplicate invoice or have a senior executive ask for an urgent payment via email. This can clarify how closely teams are following anti-fraud procedures and whether there are any gaps that might expose your business to scams.”

The post Small businesses at greater risk of fraud appeared first on Inside Small Business.

The capital raise was led by AirTree and included experienced techpreneur Daniel Petre AO, venture capital firm Black Nova and early-stage fundraisers Flying Fox.

As of 2022, an estimated $6 billion of allocated NDIS funds were lost to criminal activities, with providers charging for false services, overcharging participants, and billing additional commissions, among others. A further $7.5 billion of NDIS funds were left unused by participants due to a lack of visibility into how funds can be allocated.

To deal with this issue, Kismet has developed an end-to-end ecosystem to support plan and fund management, and connect patients with legitimate providers, to address the disability and healthcare sector’s biggest challenges including fraud and non-compliance. This ecosystem includes the Kismet Free Online Marketplace, which connects Australians with over 27,000 legitimate healthcare providers; Kismet Wallet, which provides a complete view of a participant’s plan to help securely track funds and improve collaboration with family members, caregivers and patients; and the Kismet Digital Check-In System, which legitimises customer attendance and reduces the risk of fraud.

“Improving access to healthcare is one of the most important challenges of our generation,” Mark Woodland, Co-Founder and CEO of Kismet, said. “Industry and government need to work hand-in-hand to simplify access and stamp out bad actors to ensure everyone has access to one of our most basic needs.

“We see huge potential to address challenges across healthcare, and while we have our eyes set on the NDIS first, we will be able to scale our tech globally to help millions worldwide access the care they need,” Woodland added.

Prior to Kismet, Woodland and his team founded Xplor, an edtech company that helped transform the childcare system which has been suffering from similar problems to the healthcare system, including fraud, inefficiencies and complicated systems. Xplor has become the leading provider of childcare software and helped save the government from $3.1 billion worth of fraud in 2020 through the use of their software combined with government investigations.

“Mark is a visionary leader who revolutionised the way families, educators and children engage with education when he founded Xplor, by bringing community and brand to an industry in which neither existed before,” Elicia McDonald, Partner at Airtree Ventures, said. “We understand how difficult it is to build something like this and we love seeing repeat-founders build on past successes from lessons learned. For Mark, the successes and lessons are plenty and we are excited to go on this journey with him and his team building the future of health.”

And co-investor Daniel Petre welcomed Mark and his founding team returning to the theme of connecting communities of people by reducing administrative burdens allowing them to focus on their families’ health.

“As we face an increasingly ageing population, this change is well overdue,” Petre averred.

The post Tech start-up Kismet raises $4 million to combat NDIS fraud appeared first on Inside Small Business.

The most common scam targeting farmers involved the sale of tractors and heavy machinery, with losses to this scam topped $1 million so far this year. These scammers have employed more sophisticated methods to trick victims, such as providing a contract of sale, answering questions about the potential sale of machinery by phone or email, or offering a free trial period once money is deposited into an escrow account.

“Scammers are ruthlessly luring farmers and rural businesses with seemingly good online deals on tractors and other farm machinery through fake websites or bogus classifieds on legitimate platforms and publications,” ACCC Deputy Chair Mick Keogh said. “Unfortunately, we have seen a concerning rise in agricultural scams in recent years, as farm businesses increasingly purchase machinery online. These scams are causing substantial financial losses and emotional devastation.

“Scammers are highly sophisticated in the ways they impersonate a business – some fake websites have ABNs for instance – which is why we are urging farmers and business owners to be alert to the scam risks and do extra checks to avoid getting caught out,” Keogh added.

Farmers and small-business owners are reminded to first verify the existence of a business by searching the address of the business and calling a nearby business so they can be sure that the seller is who they say they are.

“Many scams can be revealed by doing an internet search of the exact wording in the ad. Never click on a link provided to you by the seller or pay upfront, even if you are promised the money is refundable,” Keogh cautioned. “Ask to pay at the time of delivery or pickup. If possible, inspect the machinery in person or via live video first. Scammers will often have an excuse as to why machinery can’t be inspected in person and that is a red flag for any buyer.

“Scammers may advertise machinery at lower prices than the typical market rate,” Keogh added. “As always, if it looks too good to be true or if you feel pressured in any way, chances are it’s a scam.”

Farmers and small-business owners are also highly advised to not give too much personal information as scammers are targeting more than just money.

“Legitimate sellers will only ever ask for enough information to deliver what you’ve ordered, so it is important not to give too much personal information over the phone or online as you may fall victim to identity theft,” Keogh said.

Those who have provided personal information and are concerned that they may have been scammed are urged to contact IDCARE immediately at idcare.org.

Businesses, regardless of whether they have lost money, are also encouraged to report scams and learn more about how to get help on the Scamwatch website at scamwatch.gov.au.

The post Rural businesses warned against rising incidences of scams appeared first on Inside Small Business.

The ATO, through Operation Protego, is investigating around $850 million in potentially fraudulent payments made to around 40,000 individuals, with the average amount fraudulently claimed at $20,000.

The ATO has called on the public not to get involved in such activities and has asked those involved in GST fraud to cooperate with the authorities or face tough actions from the agency.

The ATO is also coordinating with financial institutions that have frozen suspected fraudulent amounts in bank accounts. It is working closely with law enforcement agencies to prioritise criminal action against those who have established and induced participation in the fraud.

Already, the ATO has halted a number of attempted frauds with the help of intelligence received from banks including through the AUSTRAC-led Fintel Alliance and the Reserve Bank of Australia, which identified a recent spike in suspicious refunds.

“We are working with social media platforms to help remove content promoting this fraud, but if you see something that sounds too good to be true, it probably is,” ATO Deputy Commissioner and Chief of the Serious Financial Crime Taskforce, Will Day, said.

The ATO is stressing that the people who have participated in this fraud cannot remain anonymous and that it will take action against these people.

“We are urging anyone involved to face the music and come forward now rather than face even tougher consequences later, including penalties and criminal charges,” Day said. “Unfortunately, as we take action to protect revenue some legitimate taxpayers may find they have to take extra steps to receive their legitimate refunds as we have put extra controls in place as a result of this fraud. But we must emphasise that the fraudsters are not real or legitimate small businesses.”

“People who have participated in this fraud may have unwittingly followed advice they have read online, claiming to help access a loan from the ATO, or receive other financial government support such as a disaster payment,” Day added. “However, for others there was nothing accidental or unintentional about setting up a fake business in their own name and seeking an unearned refund. Circumstances where there were deliberate attempts to defraud the ATO or a refusal to organise repayments will lead to tougher actions including criminal action.”

The post ATO targeting GST fraud appeared first on Inside Small Business.

The size of a business is irrelevant when it comes to fraud, which can impact any organisation at any time. The only way to truly protect a business from fraudulent activity and build business resilience in the digital economy is via automation.

SMEs already face challenges with adapting to a digital economy and constantly changing service needs in the wake of COVID-19. However, those that continue to rely on manual processes are now also likely to find themselves at greater risk of fraud. This is because the shift to remote work and changed interactions with customers and suppliers is opening up new opportunities for fraudulent activity involving paper-based and email processes.

A recent global study of more than 1,500 anti-fraud professionals found that 71 per cent believed the level of fraud at their organisations would increase in the next 12 months. Fifty-one per cent said their organisation had uncovered more fraud than usual since the start of the pandemic. A Report to the Nations global study on occupational fraud and abuse found the median loss of fraud for businesses in Asia-Pacific was US$195,000.

Non-compliant employee expenses are one of the most common forms of occupational fraud and can be very difficult to identify through manual processes. Fraud can also easily occur when supplier invoices are duplicated, which is also hard to track with manual tools. Fraud not only costs SMEs lost revenue but can cause issues that put the business at risk when it comes to regulatory compliance.

One of the most secure and cost-effective ways to ensure compliance and reduce the risk of fraudulent activity is through an integrated and automated cloud-based travel, expense, and invoice management system.

Travel and expense automation significantly reduces the risk of fraud because the system rejects non-compliant expenses and automatically detects the duplication of supplier invoices and employee expenses. By comparison, spreadsheet-based processes make it much easier for non-compliant expenses and duplicate invoices to slip through the accounting process, which may not be detected until an audit, if at all.

SMEs may not even realise how much money they are losing to non-compliant expenses, which could be further increasing the financial pressure that the business faces in the current volatile economic environment.

In addition to the revenue impact, fraud directly affects business resilience because fraudulent activity skews business data. This means that strategic decisions end up being based on misinformation as a result of corrupted data.

No business can afford to lose revenue or make decisions based on the wrong data insights. Automation is the only way that SMEs can protect themselves from fraud and ensure clean expense and invoice data that delivers real-time insights to achieve better business resilience.

The post How fraud is killing small and medium business appeared first on Inside Small Business.