Tests | Employee Payroll Fraud Detection Analytics

Benford’s law (single and double digits)

First Digit Law : Percentage of time digits 1 through 9 are expected to occur in the first position in a genuine data set of numbers.
First Two Digits Law : Percentage of time digits 10 through 99 are expected to occur in the first two positions in a genuine data set of numbers.

How to use it ?

If an employee is committing fraud by producing fraudulent invoices, the amounts are not generated radomly, employee has to create a ficticious amount. These amounts can become outliers in Benford's law affecting expected frequencies for each first/first-Two digit(s) of the invoice amount

Duplicate Payments


  • Vendor payments same vendor same amount
  • Vendor payments same amount same day

Employee with control over accounts payable and the checks can submit an invoice for payment twice. Then they alter the actual check to reflect a different payee. The system may show two checks went to Globex, but only one really did. The other check was written for "cash" and cashed by the employee.

How to use it ?

System searches for payments made on the same day for the same amount with different vendors names. Employee may cut the same check twice and alter the payee in the system to hide the fraud.

Amounts Exactly Twice as much as the other

When an amount is paid to a vendor and it’s exactly double a previous amount paid there is a chance the employee is expensing the double amount, voiding the check, then issuing the correct amount to the vendor and writing a check to themselves for the other half. Example would be an invoice to OzCorp for 1,500 and one month the check is for 3,000. The expense is recorded at 3,000, voided and reissued at 1,500 for OzCorp and 1,500 to a fictitious vendor name where the employee ends up with money. This works well because timing of payment and recording of invoices can always be off and not much attention is paid when its double a payment. However, when this happens when there is no fraud, it means AP is paying off of statements or not getting invoices recorded on time.

How to use it ?

System searches for payments which are exactly twice as much as the other and automatically generates a report containing all identified transactions.

Amounts 5% +/-   the other

Some employee’s that commit fraud get accustom to the same about every month that the steal. If they do for six months stealing 10K a month, they will either become more bold and increase the amount, to hold steady at our around the same amount. We provide a list of all amounts that are 5% or less in any data set. This will give us a quick look to see if it’s the same vendor or many vendors. If it’s the same vendor around, but not exactly the same amount, it’s something that required further investigation.

How to use it ?

System searches for payments which are 5% +/- the other and automatically generates a report containing all identified transactions.

Amounts Start with the Same
First Four Digits

Amounts starting with same first four digits, i.e. $117.53 and $1,175.38, This could well be an error or a legit transaction but there is a chance the employee is expensing the double amount, voiding the check, then issuing the correct amount to the vendor and writing a check to themselves for the rest.

How to use it ?

System searches for payments which start with the Same first four digits and automatically generates a report containing all identified transactions.

Same First Four Digits,business fraud, employee fraud, embezzlement reports

Fictitious vendor search

Fictitious vendors will sometimes have PO box addresses or contain certain words like “consulting” or “marketing.” A fraudster may even use the same address for various fictitious vendors.

How to use it ?

Using the vendor list StrayDot searches for a defined set of keywords. The user sets the words or addresses prior to running the search. A list is generated for further investigation.

Similar vendors

This test can be performed to review master vendor lists for discrepancies. Fictitious invoices from fictitious vendors will sometimes have similar names and address to actual or real vendors. Wayne enterprises may be a real vendor then spelled differently to create a fictitious vendor.

How to use it ?

StrayDot searches the vendor list data and identifies similar data points. The system allows you to adjust the similarity % to generate a list for investigation.

Vendor/Employee address cross-check

Employees that use fictitious invoices will sometimes use their own address. Employees may also alter a certain paycheck amount for only one pay period then return their paycheck amount back to normal amount.

How to use it ?

The system searches both the vendor list and employee list at the same time to find similarities. The user of the application can set the similarity %, then create a shortlist for further investigation.

Payroll overpayment analysis

Year to date payroll is divided by pay periods then multiplied by total pay periods in a year. The annualized year to date amount is compared to the annual salary or annualized hourly rate to find outliers. Employees who have access to payroll and commit fraud will have amounts in excess of expected annualized amounts.

How to use it ?

Once Payroll data is uploaded, Specify "Total Pay Periods" and "Current Pay Period" to get the results.

Payroll overtime analysis

When year to date actual amounts are annualized and compared to expected annual wage costs, the overtime wages are also annualized showing the impact of overtime in a full year.

How to use it ?

Once Payroll data is uploaded, Specify "Total Pay Periods" and "Current Pay Period" to get the results.

Non-business day transaction

Employees with access to checks and can access the offices on days the business is closed may commit the fraud while they have an opportunity to be alone.

How to use it ?

We load weekends and holidays into the application where we know the office was closed. The application compares check dates from the check register to those days.

Under Approval cut-off amounts



  • At / Under Approval cut-off amounts
  • Just Under Approval cut-off amounts

Some employees have check signing authority below a certain level. They may abuse this authority knowing those amounts are not monitored.They might decide to skim off some extra dollars by creating an invoice just below the approval level.

How to use it ?

Application produces a list of checks under a predetermined amount for further investigation.

Z-Scores and Modified Z-Scores

Z-score is a statistical measurement of a number in relationship to the mean of the group of numbers. It refers to points along the base of the standardized normal curve. The center point of the curve has a z-value of 0. The distance from the mean is measured by standard deviations. StrayDot generates a report with a list of all vendors and highlights the outliers.

How to use it ?

StrayDot flags all transactions with a z-score above 2.5 and 3.0 or higher indicating the payment is more than 2.5 standard deviations above the mean. Results from a modified version of Z Score test are also shown to help spot the outliers more effectively.

Relative size factor

Relative size factor is a test for reasonableness, identifies anomalies where the largest amount for groups of data sets based on the Vendors Name/ Paid To /Received From) is outside the norm for those groups or subsets. It compares the top two amounts for each group and calculates the RSF for each.It is a powerful test for detecting errors and potential fraudulent activities.

How to use it ?

StrayDot flags transactions categorizing them based on severity of relative size value.

Tukey's Method for Outliers Detection

Tukey's method uses the interquartile range to filter out outliers. It is less sensitive to extreme values since it makes no distributional assumptions and it does not depend on a mean or standard deviation.

How to use it ?

StrayDot generates an automatic report with outliers based on Tukey's method.


Join or Explore Free Trial Options Now !



Contact Us