14 Months of Ghost Invoices: The Procurement Fraud That Survived Two Internal Audits
Quick answer
An employee who fakes or inflates vendor invoices can be guilty of fraud under section 447 of the Companies Act, 2013 (up to ten years’ imprisonment and a fine up to three times the amount). Under section 143(12), an auditor who suspects fraud by officers or employees must report it to the Central Government or, below a prescribed amount, the audit committee or board.
Key takeaways
- Two internal audits missed ₹28 lakh of ghost invoices over 14 months because their samples never reached the shell vendors.
- The warning signs were patterns: new-vendor concentration, odd invoice timing, no relationship history and goods received with no matching stock.
- Generic fraud awareness training did not show staff what procurement fraud actually looks like.
- Monthly reconciliation of invoices, goods-inward notes and inventory, plus new-vendor verification, caught later attempts before any loss.
- A junior accountant who felt safe to escalate is what finally stopped the fraud.
Priya Sharma had been purchasing manager at Arvind Foods for eight years. She was trusted, reliable, and knew the vendor ecosystem inside out. So when invoice approvals started flowing across Rajesh Kumar's desk, they looked routine, as he was the accounts head. Shell companies with names like Aryan Logistics and Prestige Supplies. Small amounts. Nothing that triggered the threshold for deeper review.
For 14 months, Priya inflated invoices by 15-30%. Rubber bands didn't exist. The goods were "delivered" to a warehouse that had no record of them. Her cut was simple: redirect the overcharge to her own account, and the shell vendor operator (a distant cousin) would process it onward. Total loss: ₹28 lakh before discovery.
What makes this case worth studying isn't the fraud itself. Procurement fraud happens. It's that two internal audits happened during those 14 months. Both missed it.
Why were conditions right for procurement fraud?
Low-value invoices were approved with minimal scrutiny, and the shell vendors looked legitimate on paper.
Arvind Foods is a mid-sized FMCG company with ~500 employees across three plants. Their procurement team processes 200-250 invoices monthly across raw materials, packaging, and logistics. Rajesh's accounts team approved everything below ₹5 lakh with minimal scrutiny, standard practice for operational efficiency.
Priya's scheme worked because:
She worked within the system's blind spots, not against them. No system flags ₹8,000 invoices. No alarm bells for a vendor who appears sporadically.
The shell vendor was registered with a GST number (real, but diverted). Invoices had all standard elements: letterhead, invoice numbers, tax breakdown, delivery notes. She even forged goods-inward notes.
How did the ghost-invoice fraud unfold?
Over 14 months, from January 2024 to February 2025, through two shell vendors and two internal audits that sampled around them.
What procurement fraud red flags were missed?
Four patterns: vendor concentration, invoice timing, no relationship history, and goods recorded as received with no matching inventory.
| Red flag | What it looked like at Arvind Foods | Check that would have caught it |
|---|---|---|
| Vendor concentration | Two new vendors suddenly handling 12% of monthly procurement spend | Forensic verification of new vendors: site visits, director verification, reference calls |
| Invoice timing | Invoices clustered mid-month; goods-inward timestamps inconsistent with delivery logistics | Monthly reconciliation of invoices against goods-inward records |
| No relationship history | No vendor meetings, rush orders or payment disputes | Asking procurement and warehouse teams whether they actually deal with the vendor |
| Goods-inward anomaly | Goods recorded as received, with no matching inventory adjustment | Reconciling goods-inward notes with warehouse inventory |
Pattern 1: Vendor Concentration. Two new vendors suddenly handling 12% of monthly procurement spend, unusual for an established company with existing supplier relationships.
Pattern 2: Invoice Timing. Aryan's invoices clustered mid-month, but goods-inward timestamps were inconsistent with delivery logistics in the same region.
Pattern 3: No Relationship History. No vendor meetings, no purchase orders flagged as "rush" or "emergency," no payment disputes, unusual for logistics. Real vendors have contact friction.
Pattern 4: Goods-Inward Anomaly. Goods recorded as received, but warehouse teams had no corresponding inventory adjustments. A warehouse manager, if asked directly, would have said "We never got these items."
Why did fraud awareness training fail to stop it?
Because it covered what fraud is and why people commit it, not what procurement fraud actually looks like in the invoices and the warehouse.
Arvind Foods had conducted a fraud awareness session six months before discovery. Priya attended. The session covered "What is fraud," "Why people commit fraud," and "Report suspicious activity."
What it didn't cover: How fraud actually looks in procurement. Specific vendor red flags. How audits are sometimes limited in scope. That accounts heads can be overwhelmed and not notice patterns.
No one, not Priya, not Rajesh, not the auditors, had been trained to connect the dots: new vendors + invoice clustering + warehouse disconnect = investigate.
How was the fraud discovered and resolved?
A junior accountant matched goods-inward notes against warehouse stock, found no match, and escalated to the CFO.
Vikram escalated to the CFO. Within a week, forensic auditors were called in. They immediately reconstructed the entire transaction chain. Priya confessed within two interviews. She rationalized it as: "My salary didn't match my responsibilities. I saw money flowing through; I thought one small redirect wouldn't hurt."
Outcome: Priya was terminated and handed over to police. The shell vendor operator was arrested on PMLA grounds. ₹18 lakh was recovered; ₹10 lakh remained untraced. The company's public disclosure mentioned "misappropriation" but settled the matter quietly.
The legal backdrop for any Indian company is the Companies Act, 2013. Section 447 punishes fraud. Section 143(12) requires an auditor who has reason to believe that fraud is being or has been committed by officers or employees to report it. Section 177(9) requires listed companies and other prescribed classes to set up a vigil mechanism through which directors and employees can report genuine concerns.
What controls stop ghost-invoice fraud?
Role-specific fraud training, forensic checks on new vendors, monthly three-way reconciliation and a safe route to escalate. Arvind Foods overhauled their approach post-discovery:
- Fraud-specific training for accounts and procurement teams, focused on procurement fraud patterns, not generic "ethics."
- A forensic verification step for new vendors: site visits, director verification, reference calls to existing clients.
- Monthly reconciliation: invoices vs. goods-inward vs. warehouse inventory, with discrepancies flagged automatically.
- Whistleblower protection clearly communicated, so a junior like Vikram felt safe escalating without fear.
Within the next audit cycle, early-detection systems caught two more low-level manipulation attempts, from different departments. Both were handled before any loss occurred.
What is the lesson for audit and compliance teams?
Fraud doesn't always hide in complexity. Often it hides in plain sight, in the space between what audits check and what daily operations see. Generic compliance training doesn't connect those dots. Priya knew fraud was wrong. But she didn't frame her actions as fraud; she framed them as "necessary." Training that teaches employees to recognize rationalization, and managers to spot patterns, is the difference between audits that miss and audits that catch. Our fraud risk training hub covers this by role.
The difference between a fraud lasting 14 months and one lasting 14 days isn't the system. It's whether people in the system are trained to see what's actually happening.
Frequently asked questions
Why do internal audits miss procurement fraud?
Audits are limited in scope. Sample-based checks can skip the vendors involved, and a vendor master check against the GST registry will pass shell companies that are genuinely registered.
What are the most common red flags of ghost-invoice fraud?
New vendors taking a sudden share of spend, invoices that cluster or do not match delivery logistics, vendors with no relationship history, and goods recorded as received with no matching inventory.
Does an auditor have to report employee fraud?
Yes. Under section 143(12) of the Companies Act, 2013, an auditor who has reason to believe fraud is being or has been committed by officers or employees must report it to the Central Government or, below a prescribed amount, to the audit committee or board.
What is the punishment for fraud under the Companies Act?
Section 447 provides for imprisonment of up to ten years and a fine of up to three times the amount involved, with a minimum of three years’ imprisonment where public interest is involved.
Who should receive procurement fraud training?
Accounts, procurement and warehouse teams, and the managers who approve invoices, so they can connect patterns such as new vendors, invoice clustering and stock gaps.
Sources
Your team faces the same blind spots.
Structured fraud awareness training that teaches real patterns, not just policies.
Request Demo