It seems there is barely a month that goes by without another story appearing in the news about an employee who has stolen thousands, sometimes hundreds of thousands, of dollars from their employer.

The reality is that most fraud does not happen because business owners, trustees or managers are careless. It happens because they are busy. In many small businesses and charities, resources are limited. Owners and board members are often focused on serving customers, supporting communities, managing staff and keeping the organisation running.

Financial administration may not be an area they feel particularly confident in, so they employ someone they trust to take care of it. That person knows how to use Xero, understands the banking system, can process payments, raise invoices and reconcile accounts. They may have been with the organisation for years. They are often considered part of the family.

Unfortunately, trust can sometimes create opportunity.

When trusted people make poor decisions

Fraud is rarely committed by a stranger walking through the front door. More often, it is committed by someone who has earned the trust of the organisation over many years. Financial pressure, gambling problems, personal circumstances or simply the belief that they will pay the money back later can lead people down a path they never expected to take.

A recent New Zealand example involved a former employee of Te Roopu Awhina Ki Porirua Trust, a charitable organisation providing social services to families and children. The employee gradually became the primary person responsible for the trust’s financial systems and was later found to have diverted more than $1 million into accounts she controlled. The transactions were disguised within the accounting records as legitimate expenses, allowing the fraud to continue for an extended period before being discovered.

The lesson is not that organisations should trust people less. Rather, it is that trust should always be supported by appropriate controls.

The growing threat of invoice and payment fraud

Internal fraud is only one risk. Businesses and charities are also increasingly being targeted by external fraudsters sending fake invoices, changing supplier bank account details or impersonating trusted suppliers via email.

The scale of the problem is growing. The National Cyber Security Centre reported $7.8 million in financial losses during the first three months of 2025 alone, with more than half of those losses suffered by businesses. Many incidents involved business email compromise and unauthorised money transfers.

These scams can be surprisingly sophisticated. A fraudulent invoice may look identical to a legitimate one, especially if a criminal has gained access to email systems and monitored communications beforehand. Without robust review processes, it is easy for these payments to slip through unnoticed.

Why fraud often goes undetected

One of the most concerning aspects of fraud is how often it remains hidden for long periods. In many cases, fraud is only discovered accidentally when:

• A supplier follows up an unpaid invoice.
• A board member asks an unexpected question.
• Annual accounts are prepared.
• An audit identifies unusual transactions.
• An employee goes on leave and someone else performs their duties.

By the time the issue is uncovered, the losses can be substantial. The cost extends well beyond the money stolen. There is often significant stress, police involvement, insurance claims, legal costs, damaged relationships and loss of trust within the organisation.

Practical fraud prevention measures

Fortunately, there are several practical steps that small businesses and charities can take to reduce their risk.

1. Separate financial duties

Where possible, no single person should control the entire payment process. For example:

• One person enters supplier invoices.
• A different person approves them.
• A separate person authorises payment.

Removing payment authority from the person entering bills significantly reduces opportunities for fraud.

2. Review budgets regularly

A budget is not just a planning tool. It is also a valuable fraud detection tool. Using prior year results as a starting point, organisations can create a budget and then use Xero’s Budget Variance Report to compare actual results against expectations. Unexpected increases in expenses, unusual supplier payments or unexplained variances should always be investigated.

3. Require annual leave

Mandatory annual leave is one of the simplest and most effective fraud controls available. When another person temporarily takes over a role, irregularities that have been hidden through routine processes are often uncovered.

4. Review bank statements

Even when bookkeeping is outsourced or delegated, owners, trustees and managers should regularly review bank statements and payment activity. A fresh set of eyes can often spot unusual transactions that may otherwise be overlooked.

5. Reconcile supplier statements

Supplier statement reconciliations help identify:

• Duplicate payments
• Missing invoices
• Unauthorised payments
• Changes to supplier banking details.

This simple process often uncovers issues before they become significant.

6. Strengthen cyber security

Strong cyber security controls are increasingly important. At a minimum, organisations should implement multi-factor authentication (MFA) on:

• Xero
• Microsoft 365
• Banking platforms
• Other cloud-based business systems.

These measures significantly reduce the risk of unauthorised access and payment fraud.

How we help reduce fraud risk

One advantage of using an outsourced finance team is the ability to separate responsibilities without increasing headcount.

At The Accounting Hub, our processes are designed to provide multiple levels of oversight. One team member may be responsible for entering bills and reconciling transactions, while another reviews financial performance and budget variances to identify unusual activity.

We can also work within approval workflows in Xero to ensure invoices are reviewed by the appropriate people before payment. Clients retain visibility and control over payments, while benefiting from independent oversight and reporting.

No fraud prevention system is perfect, but having the right controls in place can dramatically reduce risk and increase the likelihood that issues are identified early. In business and in charities, trust remains important. However, trust works best when it is supported by good processes.