AI is making expense fraud smarter: Why companies need smarter HRMS controls

By Sameer Nagpal, Co-Founder of OneBanc Technologies

Rohit is a regional sales manager in Pune. He did not take a client to dinner on Tuesday. On Friday night, he opens an AI image tool on his phone and types one line: a Koregaon Park restaurant bill, ₹2,840, two covers, CGST and SGST at 2.5% each, a valid-looking GSTIN, a thermal-paper crease down the middle.

Forty seconds and a few free tokens later, he has a receipt more convincing than the real ones in his wallet. It is faded in the right places. The table number is handwritten.

He files it under client entertainment. His manager approves the report on his phone between two meetings. Finance samples 1 in 25 claims — 4% of the claims. Nine working days later, ₹2,840 lands in his bank account.

Two weeks later he does it again. Then it becomes a habit: two “client dinners” a month, a few cab fares, is about ₹7,000 a month. ₹84,000 a year, tax-free — that’s close to what his last appraisal added to his take-home pay.

₹11,500 Cr lost on business travel leakages alone

Indian companies are likely losing ₹11,500 Cr a year to fraudulent and non-compliant expense claims in business travel alone.

The base is large and growing. GBTA’s Business Travel Index ranks India sixth in the world for business travel spend, projected at $48.3 billion in 2026, up 12.5% on the year. That is roughly ₹4.6 lakh Cr.

Three independent lenses, applied to that base, land in the same band:

Lens	Benchmark	Source	Applied to India’s ₹4.6 lakh Cr
Floor: what a forensic audit recovers	1–1.5% of annual T&E recovered after a 100% analytics audit	Genpact client case	₹4,600–6,900 Cr
Ceiling: what AI audit flags	~2.5% of expenses non-compliant, accidental and intentional	AppZen platform data	~₹11,500 Cr
Cross-check: what one company bleeds	Expense schemes in 13% of fraud cases; median loss $50,000 (~₹48L)	ACFE, Occupational Fraud 2024	See below

Interpolating between the floor — only what was caught and clawed back — and the ceiling — everything flagged, including honest errors — gives a central estimate of approximately 1.75%, or about ₹8,000 Cr a year.

The ACFE lens checks that number from the other end. A company spending ₹100 Cr a year on travel would, at 1.75%, leak approximately ₹1.75 Cr — roughly four ACFE-median expense schemes running at once. That is not an outlier scenario; it is an average one.

Two things make this estimate conservative.

First, 30% of Indian organisations use no corporate payment method at all for domestic travel (GBTA–Visa, 2025), so a large share of spend flows through receipt-based claims — exactly where fakes live.

Second, the base grows double digits every year, and the leak grows with it.

How reimbursements still work

In most Indian companies, a reimbursement is a document-trust process: the employee pays, a bill is photographed, and everyone downstream trusts the photograph.

1. The employee pays personally — card, UPI or cash. Only 11% of Indian organisations use corporate cards for travel. An overwhelming majority use no corporate payment method at all (GBTA–Visa, 2025).

2. The employee uploads a photo or PDF of the bill to the HRMS or expense tool, with a category and a purpose.

3. The line manager approves — usually on a phone, usually in a batch, judging plausibility rather than proof.

4. Finance checks a sample: GSTIN format, bill date, policy cap, duplicate bill numbers. Companies auditing manually see only 2–3% of spend (AppZen).

5. Payroll pays, often bundled with the monthly salary run.

6. Internal or statutory audit looks again — months later, again on a sample.

Every step assumes one thing: that the bill is evidence. It is the only link between the claim and reality.

The gaps AI is walking through

Each control in that chain has a known blind spot, and generative AI now exploits all of them at once, at zero cost.

• The document is treated as proof. AI now manufactures the proof — correct tax split, plausible GSTIN (format, check-sum, sometimes accurate), creases, fading. A GSTIN check may even confirm a restaurant exists.
• Auto-approval thresholds publish the price of fraud. AI-generated fakes in AppZen’s data have a median value below ₹1,000 — sized to sit under the line.
• Sampling sees a tenth of the picture at best. If finance reviews less than 5% of claims, a sub-₹1,000 fake has a greater than 95%+ chance of never being reviewed.
• Approvers approve. In AppZen’s audit data, reviewers approved 79% of expenses that were above policy limits with a seemingly plausible explanation.
• Nobody checks the money. No step asks whether this amount actually left this employee’s account, to this merchant, on this date.
• Nothing checks the person. The HRMS knows the employee was on leave, in another city, or working from home that day. The expense workflow never asks it.
• Checks run one report at a time. The same bill reused next quarter, or one dinner claimed by two colleagues, passes because no one looks across employees and months.
• Detection is slow. Expense reimbursement schemes typically run about several years before being reviewed (ACFE). And when reviewed, they are usually a knee-jerk reaction under cost pressures.

Why the old process cannot survive AI

The economics have flipped: a convincing fake now costs nothing to make, while proving it fake costs more every month.

The shift took 14 months. On AppZen’s platform, AI-generated receipts were 0% of flagged fake receipts in March 2025 and 70.8% by mid-May 2026. Template fakes, which made up 95–100% of catches a year earlier, fell to 29%. The crossover came in June 2026.

India is not a bystander. In AppZen’s dataset, India submitted the highest number of AI-generated receipts of any country — 300 receipt lines, small in value, large in count (Forbes, June 2026). About a third of the employees caught did it more than once.

The behaviour is mainstream, not fringe. In Emburse’s 2026 survey of 2,000 professionals in the US and UK, 34% admitted using AI to generate a fake receipt — and 36% of them did it on AI tools their employer pays for.

The vendors who sell detection now say the same thing. SAP Concur tells its customers: “Do not trust your eyes.”

A caveat worth stating: the 70.8% is a share of caught fakes, not of all claims. Many employees are honest. But that is precisely why the old model breaks.

You cannot train a reviewer to spot what is pixel-perfect, and every new image model erases the tells the last one left. Reviewers scale linearly with cost; fakes scale at zero.

The checker in maker-checker becomes the choker!

From maker-checker to maker-choker

The instinctive fix — add another checker — chokes the honest majority and barely touches the fakes.

Maker-checker works when the checker can see something the maker cannot. When the document is perfect, the checker sees nothing extra.

So companies stack layers: a second approver, originals couriered to head office, lower thresholds, wider sampling. Each layer adds days to reimbursement and hours to month-end close. Companies auditing manually already take about two weeks to reimburse (AppZen).

The cost lands on the wrong people. Oversight Systems found that 5% of employees account for 82% of T&E fraud. Every extra layer taxes the other 95% — with slower money, more paperwork and the quiet message that they are suspects.

There is a compliance cost too. Statutory auditors report on internal financial controls under Section 143(3)(i) of the Companies Act, 2013, and CARO 2020 asks them to report fraud they notice. A control that depends on spotting a fake by eye is getting harder to defend in front of an audit committee.

The shift: validate the transaction, not the document

The answer is ecosystem validation — checking every claim against independent systems that a fraudster cannot fake at the same time as the bill:

• The payment: the card, UPI or bank debit — amount, merchant, timestamp. If no money moved, there was no dinner.
• The merchant: category and location from the payment rail; for B2B bills, the e-invoice reference on the GST system.
• The trip: booking data from the travel desk — was there a flight to that city, a hotel stay that night?
• The HRMS: attendance, leave, location and grade entitlement — was the employee working, and where?
• The organisation’s memory: the same bill, amount or merchant across every employee and every month, not one report at a time.

Run those checks on 100% of claims, before payment, and send only the exceptions to people.

Honest claims clear in days instead of weeks. Flagged ones arrive with the evidence already attached — which also protects the employee whose genuine bill was simply lost.

This is what smarter HRMS controls actually means. The HRMS is the one system that knows who the employee is, where they were and what they are entitled to.

It has to stop being a filing cabinet for bills and start being a witness.

2:10 am, day six of the close

Anjali is the CFO of a 12,000-employee company. It is day six after the quarter closed and the books still don’t tally up. Travel and conveyance are up 14% on last year; headcount is up 4%.

Her team of nine processed 41,000+ claims this quarter and looked closely at fewer than 3,500.

Internal audit has flagged a suspect-looking hotel receipt. Her senior manager has spent two days in validations: ringing hotels, checking GSTINs on the portal and matching bank statements line by line.

They have found four allegedly fraud bills in the process. She has no idea how many they have not found.

The sales head has written again: his team waits 36 days to be reimbursed, and two good people mentioned it in their exit interviews.

If she tightens controls, that number gets worse. If she does not, the leak does.

The audit committee meets on Thursday. The first question will be about internal controls.

She already knows the honest answer: we check what we can see, and we can no longer trust what we see.

She closes the laptop and sits with the question every finance leader in India will soon have to answer.

Can we do better? Can this problem actually be solved?