Does E-Invoicing Stop Invoice Fraud? What Peppol Changes

Does e-invoicing stop invoice fraud?

E-invoicing stops some invoice fraud and leaves the most common kind open. Sending invoices over Peppol removes the email attachment, which is the route that fake and altered invoices usually take, and it limits delivery to participants who have registered through a provider. It does not stop a supplier whose own system has been compromised, and it does nothing about a request to change a supplier's bank details. A buyer who switches on receiving still needs the same bank-change checks as before.

The Australian Taxation Office describes reducing fraud among the reasons to adopt e-invoicing. This page is specific about what that can and cannot mean for an accounts payable team.

What does Peppol close off?

Three things change when an invoice arrives through the network instead of your inbox.

1. There is no attachment to forge or swap. An emailed PDF can be intercepted, altered and re-sent, or replaced by a lookalike from an address one letter different. Over Peppol the invoice is delivered as a structured file between two access points, not as a message to a mailbox.
2. The sender has to be registered. To deliver to you, a sender must be a participant, connected through a provider. The provider is the one that vouches for the connection to the network. That is a much higher bar than creating a free email account.
3. Delivery is between providers that have been accepted onto the network. In Australia the ATO is the Peppol Authority and keeps a register of the providers it lists. ATO eInvoicing accreditation explained describes what that listing does and does not cover.

There is a fourth, smaller gain. A structured invoice is checked on arrival against the PINT A-NZ rules, so an invoice with a missing ABN or a broken total is flagged before it reaches an approver. That catches errors more often than fraud, but it removes some of the noise that hides fraud.

What does Peppol leave open?

This is the part sellers of e-invoicing software tend to skip.

• A compromised supplier. If a criminal takes over a real supplier's accounts system or its login, they can issue a real, correctly formatted invoice from a registered sender. The network checks that the sender is registered. It does not check that the person at the keyboard is who they claim.
• Changed bank details. The most common version of invoice fraud is a message that says "our bank account has changed". That message arrives by email or phone. Peppol does not carry it and cannot verify it. A genuine-looking invoice with the new account is delivered exactly as a real one would be.
• A fake supplier, properly registered. A criminal can set up a company, get an ABN and register on the network. Peppol shows that an ABN is registered, not that the company is one you should pay.
• Duplicate and inflated invoices from a real supplier. The network delivers what is sent. Matching to purchase orders and goods received is still the buyer's control.
• Internal fraud. A staff member who creates a supplier or approves a payment is outside what a delivery network sees.

These are controls of the buyer's process. They are the reason the answer to the question in the title is "partly".

Which checks still matter, and which get easier?

Still essential

• Confirm every bank-detail change by a route you already trust. Call a number you hold on file, not one in the message. Do this before the first payment to the new account.
• Separate duties. The person who sets up a supplier or changes bank details is not the person who approves the payment.
• Match to a purchase order and a receipt where you can.

Easier with structured invoices

• Matching. The purchase order number is a named field in the file, so a mismatch can be flagged automatically.
• Spotting a changed account. The supplier's bank details are data, so a system can compare them with the last invoice and raise a flag when they differ. This is a control you add. The format makes it possible; it does not do it for you.
• A record of what arrived. GoRoute's receiving platform records what each document was validated against and when it arrived, which is a useful trail if an invoice is later disputed.

Is a Peppol invoice more trustworthy than a PDF?

It is more trustworthy about where it came from and what shape it has, and no more trustworthy about what it says. Think of it as removing the post office from the list of suspects. The letter can still be written by a thief.

For the practical decision, an invoice arriving on Peppol from a supplier you already deal with, with the same bank details as last time, is lower risk than the same invoice by email. An invoice from a new supplier, or with new bank details, is the same risk on either route, and gets the same checks.

What can you honestly say about loss figures?

This page does not quote a figure for how much Australian businesses lose to invoice fraud. Current figures are published by Scamwatch and the Australian Signals Directorate's Australian Cyber Security Centre, and they change every year, so read them at the source. Nothing on those pages says that e-invoicing would have prevented a given share of losses, and this page does not claim it either.

How does this connect to receiving e-invoices?

If you are considering registering your ABN, fraud is a good reason to look at the controls around the invoice at the same time as the format. How an Australian business starts receiving e-invoices covers the setup. Checking an ABN on Peppol shows how to confirm that a business you are about to pay is on the network, which is a fact worth having, not proof that it is honest. And Can you claim GST credits on an e-invoice? covers the tax side of what you receive.

What to do next

1. Write down how a bank-detail change is approved in your business today. If the answer is "someone emails us", fix that first.
2. Check whether your system flags a bank-account change between invoices from the same supplier.
3. Ask any provider you consider what it records about each received document.

GoRoute delivers and records invoices on the network and does not prevent fraud. If you would like to see what a received document and its record look like, book a demo, or see e-invoice receiving, the tutorials and the documentation.

Related guides

• How an Australian business starts receiving e-invoices
• Can this business receive e-invoices? Checking an ABN on Peppol
• Can you claim GST credits on an e-invoice?
• ATO eInvoicing accreditation explained
• E-invoicing in Australia

Sources: the ATO eInvoicing page for the ATO's role and its stated aims; OpenPeppol for how the network delivers between access points; Scamwatch and the Australian Cyber Security Centre for current loss figures, none of which are quoted here. This page describes how e-invoicing and fraud relate and is not security or legal advice. GoRoute operates certified Peppol Access Point and SMP POP000991.