Australian Accounting Fraud Casebook
Sixteen real Australian accounting fraud cases, each backed by a court judgment, regulator media release or named news article that was individually checked against the facts stated. For every case, this report sets out what happened, which Sentinel checks respond to that pattern, exactly what each check looks for, and where the honest limits of a ledger-based tool lie.
Executive Summary
For CFOs and business owners, fraud loss is rarely the biggest cost. The bigger cost is discovering it years late, through an auditor, a bank, or a resignation, after the damage has compounded. The sixteen cases below ran for between several months and four years before anyone noticed. Eleven were committed by trusted insiders (bookkeepers, payroll officers, treasurers, one solicitor). Five were induced by external attackers through business email compromise and invoice redirection.
Every case has been run against Sentinel's rule catalogue: more than 110 distinct detection rules applied as 150+ per-document-type checks across journal entries, invoices, bills, payments, bank transactions, credit notes, contacts, attachments, employees, payslips and timesheets synced from Xero, QuickBooks Online and MYOB, plus two platform capabilities that sit alongside the rules: a universal per-field change ledger and nightly reconciliation alerts.
Four families of checks do most of the work in these cases. Vendor identity verification against public business registries is the direct countermeasure to invoice redirection. Forensic digit tests expose fabricated numbers across months of entries. Payroll integrity checks catch duplicate bank accounts, terminated employees still being paid, and payslips that do not reconcile to the ledger. Payee-versus-employee matching catches the most common insider pattern of all: paying yourself through accounts payable.
Verification standard applied to every case:
- The cited URL was opened and its content checked against the amount, names, dates and mechanism stated here. Homepage or section links were not accepted; only the specific article or document.
- Preferred sources, in order: court judgments, regulator media releases (ASIC, AFP, ATO), then a specific article from a named outlet. Cases whose source could not be confirmed were excluded, even where the underlying fraud is very likely real.
- Every rule named here was checked against the detection engine: it exists, it is enabled by default unless stated otherwise, and the threshold quoted is the default. Where a rule only works on data a particular accounting provider exposes, that is stated.
How to read the rule mappings: the checks listed on each case describe what Sentinel's engine is designed to detect, based on the transaction pattern in the cited source. They are not a guarantee that any specific transaction would have been flagged. Detection depends on data completeness, the thresholds configured for a given tenant, whether a rule is switched on, and whether the connected accounting system exposes the field a rule needs. Sentinel is a detection aid, not a substitute for segregation of duties, independent reconciliation, or other internal controls.
How Sentinel Scores a Document
- Every document is scored against the rules for its type. Each rule returns a score from 0 (no concern) to 1 (certain match). The document's composite risk is the weighted average of every enabled rule's score, so several corroborating signals raise the risk more than one.
- Risk levels: a composite of 0.75 or more is CRITICAL, 0.50 or more is HIGH, 0.25 or more is MEDIUM, below that is LOW.
- One overwhelming signal is never averaged away. If any single rule scores 0.8 or higher, the document is shown as at least MEDIUM regardless of the average. If four or more independent rules reach that trigger, the document is shown as at least HIGH.
- Sentinel remembers your reviewers' decisions. Once a reviewer confirms a flagged document as genuine, future documents involving the same account, vendor, bank account or user receive an automatic score boost for 180 days.
- Noise control never hides a rule score. Admins can mute alerts or cap the displayed risk for a specific account or below a chosen amount; this is applied after scoring and the underlying rule scores remain visible.
Where the Data Comes From
Sentinel connects to Xero, QuickBooks Online and MYOB. Several checks depend on data only some providers expose. Being precise about this matters more than a longer list of rules:
- Journal entries are the providers' hand-keyed double-entry records (Xero manual journals, QuickBooks journal entries, MYOB general journals), not the full general ledger. Journal-entry rules evaluate manual-journal activity specifically. System-generated postings from invoices, bills and payments are scored as those document types instead.
- Payroll rules (employees, payslips, timesheets) need a payroll feed: Xero Payroll or MYOB. QuickBooks has no payslip feed, and QuickBooks employee records carry no tax file number or bank details, so the ghost-employee and missing-field checks are skipped for QuickBooks-sourced employees rather than firing on every one.
- Vendor registry verification is automated for Australian (ABR), UK (Companies House) and New Zealand (NZBN) entities. Vendors in countries without a free unified registry, such as the US, are marked for manual review rather than scored as a mismatch. The bank-account-holder name check reads a field only Xero and MYOB expose (on MYOB, for suppliers only); it is not available for QuickBooks Online.
- Forensic digit tests (Benford first and second digit, last-digit frequency) need at least 50 amounts per account, vendor or customer before they form an opinion. Fewer samples means no score, not a guess.
- Back-dated entry detection needs a real creation timestamp, which QuickBooks provides and Xero does not.
- Attachment forensics apply only when the supporting document (invoice PDF, receipt photo) is attached to the transaction in the accounting system.
- Public-holiday posting rules stay silent until a tenant sets its country and region.
- Three rules ship disabled by default and are not relied on anywhere in this report: cross-account amount clustering, unapproved-vendor list checks, and anachronistic PDF producer detection.
Table of Cases
| Case | Amount | Fraud Type | Primary Sentinel signals | Verified Source |
|---|---|---|---|---|
| 1. TZ Limited – bookkeeper self-payments | $130,000 | Manual-journal self-payment | Payment to employee outside payroll; vendor matches employee; unusual user/account pairing | SmartCompany |
| 2. Comunicom Group – contractor bookkeeper | $891,000 | Misappropriation over four years | Digit tests; account trend variance; unlinked spend; reconciliation alerts | SmartCompany |
| 3. Hairhouse Warehouse – falsified cheques | $957,000 | Cheque fraud, falsified payee records | Duplicate and near-duplicate payments; payee changed; vendor identity checks; change ledger | SmartCompany |
| 4. Clive Peeters – payroll officer fraud | $19,365,768 | Payroll-account embezzlement | Duplicate bank accounts; stale clearing-account items; manual recon adjustments; payroll-vs-ledger alert | ABC News |
| 5. Sydney law firm – trust account fraud | $6,000,000+ | Solicitor trust-fund misappropriation | Rare account combination; restricted accounts; attachment forensics on forged receipts | ABC News |
| 6. Carbine Club of Tasmania – treasurer fraud | $127,359 | Club treasurer misappropriation | Unlinked spend; manual recon adjustments; prior-period edits; digit tests; revenue-vs-cash alert | Northern Daily Leader |
| 7. Banjo's Bakehouse – till skimming & tax fraud Gap | $100,000+ skimmed (~$335,000 total) | Cash skimming, falsified tax records | Coverage gap; weak signals only | Franchise Business |
| 8. Mount Garnet Transport – bookkeeper EFT diversion | $190,000 | Unauthorised EFT transfers | Payment to employee outside payroll; vendor matches employee; duplicate address; digit tests | ABC News |
| 9. Payroll manager – fraud across two employers | $859,000 | Payroll fraud, funded gambling | Duplicate employee bank accounts; bank change before payslip; off-cycle payslips; payroll-vs-ledger alert | iKeep |
| 10. Hassell Services – redirected ex-employee payroll | ~$737,000 | Payroll fraud (ghost-employee pattern) | Terminated employee still paid; duplicate bank accounts; timesheet outside employment | Matthews Folbigg Lawyers |
| 11. Barnes Marketing Services – false invoices Caveat | $2,478,624 | False invoices sold to a financier | Registry verification; duplicate address; Benford on invoices; receivables-vs-cash alerts | ASIC media release |
| 12. Melbourne building business – BEC External | $51,000 | Invoice redirection (hacked subcontractor email) | Vendor bank details changed; payment after bank change; bank-holder name vs registry | ABC News |
| 13. Mobius Group v Inoteq [2024] WADC 114 External | $191,859 | Invoice redirection (civil judgment) | Vendor bank details changed; payment after bank change; high-value amount; change ledger | ABC News |
| 14. Gold Coast couple – settlement BEC External | $252,000 | Conveyancer email interception | Illustrative only (personal transaction) | ABC News |
| 15. Upwey-Tecoma Bowls Club – BEC External | $120,000 | Contractor invoice redirection | Vendor bank details changed; payment after bank change; lookalike vendor; vendor amount creep | Bowls Australia |
| 16. AFP construction-sector BEC alerts (2025) External | Multiple ($41.8k–$1m+ per incident) | BEC / invoice redirection, aggregate trend | The full vendor-identity and bank-change family | AFP media release |
Insider Fraud Cases
blue = primary signal for this case · amber = supporting signal · teal = platform capability rather than a scored rule.
1. TZ Limited – Bookkeeper Self-Payments via Manual Journals ($130,000)
What happened: a bookkeeper recorded payments to himself over 15 months. There was no approval workflow, and nobody else looked at what he posted.
What Sentinel checks
- Payment to employee outside payroll. Any payment made through accounts payable or spend-money to a currently active employee is flagged. This is the single most direct signature of the case: the payee is on the staff list.
- Vendor matches employee details. A vendor or contact record whose bank account or address matches an employee's is flagged as a shell-vendor indicator, so a "supplier" set up to receive the money is caught at the contact level before any payment.
- Duplicate contact address. Two contacts sharing one address, matched on a privacy-preserving hash, so a vendor record at the bookkeeper's home address surfaces even if the bank account differs.
- Unusual user/account pairing. A user posting to a GL account they have posted to three times or fewer before. A bookkeeper routing money through an account they never normally touch is flagged on the first few postings.
- Rare account combination. A debit/credit pairing used three times or fewer in the tenant's history.
- Restricted account usage. Any posting to an account the tenant has marked off-limits for normal posting, such as a director's loan or drawings account.
- Account trend variance. An entry more than two standard deviations above the account's trailing average of its last 12 manual journals, which catches the amount creeping up over 15 months.
- Missing description and high-risk keywords. Entries with no narration, or with narration matching a list of fraud-language phrases, add a hygiene signal.
2. Comunicom Group – Contractor Bookkeeper ($891,000 over four years)
What happened: a contractor bookkeeper moved nearly $900,000 out of the business over four years to fund gambling and luxury purchases. No single transaction looked remarkable.
What Sentinel checks
- Forensic digit tests. Benford's Law on first and second digits, and last-digit frequency, test whether an account's amounts are distributed the way genuine amounts are. Each needs 50 or more amounts per account; four years of postings clears that bar many times over. Fabricated amounts chosen to look plausible are the classic thing these tests expose.
- Account trend variance. An entry more than two standard deviations above the account's trailing 12-entry average, one-sided, so a slow ratchet upward is caught while a cheaper-than-usual entry is not.
- Amount z-score. An amount more than three standard deviations from the account's 90-day history.
- Unlinked spend. Money leaving a bank account with no bill matched within three days, which is how a payment that bypassed the bill and approval workflow appears in the bank feed.
- High-value amount. Any amount over a flat tenant threshold, default $10,000, regardless of history.
- Unusual user/account pairing. The contractor posting to accounts they had rarely posted to before.
- Reconciliation alerts. Nightly tenant-level checks compare each month's expense ratios against prior months and reconcile accounts payable against the ledger, which is where a four-year drain shows up as a drift no single entry reveals.
- Feedback boost. Once a reviewer confirms one of these as genuine, every later document involving the same account or user is boosted for 180 days, so the second and third instances rank higher than the first.
3. Hairhouse Warehouse – Falsified Cheques ($957,000)
What happened: falsified cheques and payee records over roughly two years at head office and two franchisees. The article attributes it to a lack of segregation of duties: no dual sign-off, and no independent matching of cheques to invoices.
What Sentinel checks
- Duplicate payment. Another payment to the same contact for the same amount within five days, scored higher when it also shares a reference or linked document.
- Fuzzy duplicate payment and bill. Near-duplicates across reference, payee, amount and date, tuned so that a reference altered by a character is caught while consecutive recurring invoices are not.
- No linked document. A payment that references no known invoice or bill, and money leaving the bank account with no bill matched within three days. Unmatched payments are the footprint of the missing cheque-to-invoice control.
- Payment payee changed. The payee on a payment silently changed on a later sync within 14 days of the payment being recorded.
- Vendor identity checks. Two vendor records with near-identical names; the vendor's name checked against the Australian Business Register; and for Xero vendors and MYOB suppliers, the bank-account holder's name checked against the registered legal name. A falsified payee fails at least one of these.
- Forensic digit tests on bills. Two years of cheques gives more than 50 samples per vendor.
- Universal change ledger. Every change to a payee record is recorded with old value, new value, the user who made it and the time, so a falsified payee is visible as an edit, not only as a name.
4. Clive Peeters – Payroll Officer Fraud ($19,365,768)
What happened: a payroll accountant with sole, unsupervised control of the payroll account made 90 withdrawals and 125 payments to just 8 bank accounts over two years. It was caught by a routine audit, and the loss contributed to the company's collapse. A larger business than the others here, included deliberately: the control failure is identical, only the scale differs.
What Sentinel checks
- Duplicate bank account (employee and contact). Two or more active employee records, or two contact records, sharing one bank account. 215 payments routed to 8 accounts is a concentrated repeat-payee pattern.
- Payment to employee outside payroll. Any accounts-payable or spend-money payment to a currently active employee, including the payroll officer.
- Stale clearing-account item. An item sitting in a clearing-type account (Undeposited Funds, Payroll Clearing) for 60 days or more, which is where money in limbo hides.
- Manual reconciliation adjustment. A manual journal posted directly against an account that matches a synced bank account. Neither Xero nor QuickBooks has a "manual reconciliation adjustment" transaction; a bypassed reconciliation appears as exactly this.
- Payroll-versus-ledger reconciliation alert. A nightly check comparing the month's payslip gross pay against manual journals posted to the payroll accounts. Cover-up journals that do not match the payslips surface as a period-level gap.
- Pay-component ratio. Tax-to-gross or superannuation-to-gross ratio deviating more than 1.5 standard deviations from an employee's own 12-period average, which catches withholding being manipulated even when gross and net look routine.
- Large unreconciled transaction. A bank transaction over $10,000 still unreconciled after 30 days.
- High-value amount. Any payment over the flat tenant threshold.
5. Sydney Law Firm – Trust Account Fraud ($6,000,000+)
What happened: a solicitor moved more than $6 million of deceased-estate bequest money out of trust and forged charity donation receipts to disguise where it went.
What Sentinel checks
- Rare account combination. A transfer from a client trust ledger into an account that has paired with it three times or fewer before.
- Restricted account usage. A trust ledger marked as a restricted account means every posting against it is flagged outright.
- Attachment forensics on the forged receipts. If the receipts are attached to the transactions: a PDF whose modification date is more than a day after its creation date or that carries an editing-tool signature; a PDF whose two internal metadata stores disagree; a PDF that has been re-saved after generation (multiple incremental revisions); and a document whose embedded creation date is more than 30 days from the transaction date.
- High-value amount on each transfer, and large unreconciled transaction once a transfer over $10,000 sits unreconciled for 30 days.
- Unlinked spend. Money leaving the bank account with no bill matched within three days.
- Universal change ledger. Any later edit to the transaction, and who made it, is recorded.
6. Carbine Club of Tasmania – Treasurer Fraud ($127,359)
What happened: a treasurer of more than 20 years made 126 transfers over roughly 18 months and presented falsified financial reports to the committee. There was no independent bank reconciliation. It was caught when a successor compared the real bank records with what had been reported.
What Sentinel checks
- Unlinked spend. Each transfer out with no bill matched within three days.
- Manual reconciliation adjustment. A manual journal posted directly against a bank account, which is how the books are made to match a false report.
- Prior-period breach. An entry edited after its accounting period was locked, proved by the change ledger rather than inferred. Xero period lock dates are synced today.
- Forensic digit tests. 126 transfers exceeds the 50-sample minimum, so Benford and last-digit tests apply to the amounts.
- Unusual user/account pairing. The treasurer posting to accounts they had rarely used.
- Revenue-versus-cash reconciliation alert. A nightly comparison of the month's invoiced revenue against payments actually linked to those invoices, which measures the gap between the books and the bank that this fraud survived on.
- Amount z-score on transfers outside the account's 90-day history, and large unreconciled transaction for anything over $10,000 left unreconciled for 30 days.
7. Banjo's Bakehouse – Till Skimming & Falsified Tax Records Coverage Gap
What happened: the franchise owner took cash from tills on weekends and public holidays, had daily sales sheets altered to conceal it, and falsified tax records. More than $100,000 was skimmed; the total defrauded was around $335,000.
What Sentinel checks
- This is a coverage gap. Sentinel has no point-of-sale connector. Cash taken before a sales sheet is written never reaches the ledger, and no ledger-based rule can see it.
- Weak signals only. Last-digit frequency could pick up habitually rounded daily sales figures. Round-number and z-score checks could flag sales postings that look unusual for the revenue account. The revenue-versus-cash reconciliation alert would notice invoiced sales and bank deposits diverging. None of these is strong here, because falsified sales sheets understate both sides consistently.
8. Mount Garnet Transport – Bookkeeper EFT Diversion ($190,000)
What happened: a bookkeeper made 185 separate unauthorised electronic transfers to her own account over about two years. Individually small, collectively $190,000.
What Sentinel checks
- Payment to employee outside payroll. Each transfer to a currently active employee through spend-money or accounts payable.
- Vendor matches employee details and duplicate contact address. A payee record whose bank account or address matches the bookkeeper's employee record, or shares an address with any other contact.
- Unlinked spend. Each transfer out with no bill matched within three days.
- Forensic digit tests. 185 transfers is well past the 50-sample minimum, so Benford and last-digit tests can tell whether the amounts were invented.
- Unusual user/account pairing and rare account combination on the posting pattern.
- Registry name mismatch. A "vendor" with no Australian Business Register record.
- High-value amount on any transfer over the flat threshold, and feedback boost on every later transfer once the first is confirmed.
9. Payroll Manager – Fraud Across Two Employers ($859,000)
What happened: the same payroll manager ran the same scheme at two separate employers, using false payment records across 99 fraudulent transfers, to fund gambling.
What Sentinel checks
- Duplicate bank account (employee). Two or more active employees sharing one bank account, flagged inside each employer's own data.
- Bank change before payslip. A payslip issued within 48 hours of the employee's bank details changing.
- Payslip duplicate for the same employee and pay period, and off-cycle payslip velocity when an employee is paid more than twice in seven days.
- Payslip amount z-score. Net pay more than three standard deviations from the employee's own 12-period average.
- Pay-component ratio. Tax or superannuation withholding dropping or spiking against the employee's own pattern even when gross and net look routine.
- Payroll-versus-ledger reconciliation alert. Payslip gross pay for the month compared with manual journals posted to the payroll accounts.
- Universal change ledger. Every edit to an employee's bank details and to each payslip: who, when, from what, to what.
10. Hassell Services – Redirected Ex-Employee Payroll (~$737,000)
What happened: a payroll manager kept departed employees' payroll records alive and redirected their pay into accounts she controlled, across 241 transactions and two separate stints of employment. The closest verified Australian example of a "ghost employee" pattern.
What Sentinel checks
- Terminated employee still paid. Any payslip dated after the employee's recorded termination date is flagged outright. This is the single most direct match for the case.
- Duplicate bank account (employee). Several ex-employees' pay landing in one account she controlled.
- Bank change before payslip. A payslip within 48 hours of the bank details on the ex-employee's record being changed.
- Dormant employee reactivation. A payslip for an employee not paid in 90 or more days.
- Timesheet outside employment and timesheet unknown employee. Hours logged for a period entirely after termination, or for someone with no payroll record. Timesheets are read from Xero Payroll and MYOB.
- Ghost employee. An active employee paid with no tax file number on record, or with no superannuation ever recorded. This check is deliberately narrow: it does not yet use leave history or timesheets.
- Universal change ledger records the bank-account change on the ex-employee's record (that it changed, by whom and when, without exposing the account number), and the payroll-versus-ledger alert catches the aggregate.
11. Barnes Marketing Services – False Invoices ($2,478,624) Limited Applicability
What happened: a company director sold false invoices for work never performed to an invoice financier, which advanced funds against them. The victim was the financier, not a supplier relationship inside one business's own ledger, so this case maps onto Sentinel's tenant-side rules less cleanly than the others.
What Sentinel checks
- Registry name mismatch and duplicate contact address. Fictitious customers with no Australian Business Register record, or several "customers" sharing one address.
- Benford's Law on invoices. A customer's invoice amounts tested for fabrication once 50 or more exist.
- Duplicate and fuzzy duplicate invoice. The same invoice number reused, or near-identical invoices resubmitted.
- Receivables and revenue reconciliation alerts. From inside the issuer's own ledger, a book of fictitious invoices looks like invoiced revenue with no customer cash ever arriving. The monthly accounts-receivable and revenue-versus-cash checks show exactly that gap.
- Unknown vendor and sequential vendor numbering if a tenant were on the receiving end of such invoices: a vendor not in the contact master, or a vendor whose bill numbers run consecutively, implying the tenant is its only customer.
External-Source Fraud Cases (Non-Employee)
The cases below involve external attackers who never held an employee login, yet still induced a real, fraudulent transaction inside the victim's own ledger. All five are business email compromise (BEC) or invoice-redirection cases, the best-documented category of external accounting fraud in Australia.
Every one of them ends in the same event: a vendor's bank details change, and a payment follows. Sentinel flags the change itself on the contact record (within 14 days), flags any bill dated or payment made within 7 days of it, and then asks whether the new details are plausible at all: does the bank-account holder's name match the vendor's registered legal name, does the vendor exist on the public business registry, and is this a lookalike vendor record rather than the real one. The change ledger records who changed the details and when.
12. Melbourne Building Business – BEC ($51,000) External
What happened: a subcontractor's email was hacked. The attacker altered the bank details on a genuine invoice and resent it. The business paid $51,000 to the attacker and found out only when the real subcontractor called chasing payment.
What Sentinel checks
- Vendor bank details changed. The contact record is flagged for 14 days after its bank details change.
- Payment after vendor bank change and bill after vendor bank change. A payment made, or a bill dated, within 7 days of the change. The payment rule is among the highest-weighted in the catalogue.
- Bank holder name mismatch. For a Xero vendor or MYOB supplier, the account holder's name on the new bank details compared with the vendor's registry-verified legal name. The attacker's account is not in the subcontractor's name.
- Registry name mismatch. The subcontractor's name confirmed against the Australian Business Register.
- Universal change ledger. Which user changed the bank account and when, which is the first question an investigator asks.
13. Mobius Group Pty Ltd v Inoteq Pty Ltd [2024] WADC 114 ($191,859) External
What happened: after the payee's email was compromised, "corrected" bank details were sent to the customer. The customer's bank tried to verify by phone; the call dropped and was not followed up. The customer paid $191,859 to the wrong account. The WA District Court held the customer liable to pay again, a landmark ruling on who bears the loss.
What Sentinel checks
- Vendor bank details changed on the contact record, and payment after vendor bank change for the payment made inside the 7-day window.
- Bank holder name mismatch (Xero vendors, MYOB suppliers) and registry name mismatch test whether the corrected account plausibly belongs to Mobius at all: the question the phone call was meant to answer.
- High-value amount. A payment of this size clears the flat threshold on its own.
- Universal change ledger. The detail change with user and timestamp, which in a civil dispute like this one becomes evidence of what the payer knew and when.
14. Gold Coast Couple – Settlement BEC ($252,000) External
What happened: a spear-phishing email, missing the ".au" domain suffix, redirected a house deposit to an attacker's account. It was discovered the day before settlement. A personal transaction rather than a business ledger, included to show the mechanism is not confined to businesses with an accounts-payable function.
What Sentinel checks
- On the conveyancer's side, if their trust ledger were in a connected accounting system, the same checks as cases 12 and 13 apply: a changed payee bank account, a large payment inside the change window, and the identity checks on the new account.
15. Upwey-Tecoma Bowls Club – BEC ($120,000) External
What happened: a hacker monitored the club's email for weeks, then intercepted and altered a genuine flood-repair invoice. The club paid the final $120,000 instalment to the attacker.
What Sentinel checks
- Vendor bank details changed and payment after vendor bank change, as in cases 12 and 13.
- Duplicate vendor name. Attackers who watch email for weeks sometimes induce staff to create a second, lookalike vendor record rather than edit the real one. Two vendor records with near-identical names in the same tenant are flagged.
- Bank holder name mismatch (Xero, MYOB suppliers) and registry name mismatch on the new account against the contractor's registered identity.
- Vendor amount creep and vendor peer-group amount. A bill more than two standard deviations above the contractor's own trailing 12-bill average, or above what other vendors bill to the same account.
- Universal change ledger records who made the change and when.
16. AFP Construction-Sector BEC Alerts (2025) External · Trend Data
What happened: the Australian Federal Police reported $152.6 million in business email compromise losses in 2024, up 66% year on year, and named four incidents: $41,800 (NSW, recovered), $338,000 (SA conveyancing firm, recovered), $120,000 (Tasmanian homeowner, unrecovered), and more than $1 million (Queensland organisation, partial recovery). The mechanisms described are fake invoices, spoofed emails and hidden inbox rules intercepting "invoice" and "payment" keywords.
What Sentinel checks
- Every mechanism the AFP describes ends in a bank-detail change on a vendor record followed by a payment. The same rule set as cases 12 to 15 applies: the change flagged on the contact, the payment flagged inside the 7-day window, the new details tested against the registry and (for Xero and MYOB suppliers) the account holder's name, lookalike vendor records flagged, and the change recorded with user and time.
Detection Patterns Across All Sixteen Cases
| Fraud pattern | Sentinel checks | What they look for | Cases |
|---|---|---|---|
| Paying yourself through the ledger | Payment to employee outside payroll · Vendor matches employee details · Duplicate contact address | A payee who is on the staff list; a vendor whose bank account or address matches an employee's; two contacts at one address. | 1, 4, 8 |
| Redirected payee / business email compromise | Vendor bank details changed · Payment / bill after vendor bank change · Payment payee changed | A bank-detail change on a contact (14 days) and any payment or bill within 7 days of it; a payee silently changed after recording. | 3, 12, 13, 14, 15, 16 |
| Is this vendor real? | Registry name mismatch · Bank holder name mismatch · Duplicate vendor name | Vendor name checked against ABR, Companies House or NZBN; bank-account holder checked against the registered name (Xero, MYOB suppliers); near-identical vendor records. | 3, 8, 11, 12, 13, 15, 16 |
| Fabricated numbers over months | Benford's Law (first and second digit) · Last-digit frequency | Whether an account's, vendor's or customer's amounts are distributed the way real amounts are. 50 or more samples required. | 2, 3, 6, 8, 11 |
| Money out with no paperwork | Unlinked spend · No linked document · Duplicate and fuzzy duplicate payment | Bank spend with no bill within 3 days; payments referencing no invoice or bill; repeat payments to the same contact for the same amount. | 2, 3, 5, 6, 8 |
| Unusual poster or slow ratchet | Unusual user/account pairing · Rare account combination · Account trend variance · Amount z-score · High-value amount | A user or account pairing seen three times or fewer; an entry two standard deviations above its trailing average; three standard deviations from 90-day history; any amount over a flat threshold. | 1, 2, 5, 6, 8, 13 |
| Books made to match a lie | Manual reconciliation adjustment · Prior-period breach · Stale clearing-account item · Restricted account usage · Large unreconciled transaction | A manual journal against a bank account; an entry edited after period lock (Xero); an item in a clearing account for 60+ days; a posting to an off-limits account; over $10,000 unreconciled for 30 days. | 1, 4, 5, 6 |
| Payroll diversion | Terminated employee still paid · Duplicate bank account (employee) · Bank change before payslip · Off-cycle velocity · Pay-component ratio · Timesheet outside employment | Payslips after termination; employees sharing a bank account; a payslip within 48 hours of a bank change; more than two payslips in a week; withholding drifting from the employee's own pattern; hours logged after termination. | 4, 9, 10 |
| Forged supporting documents | Attachment forensics | PDFs edited after creation, disagreeing metadata stores, multiple incremental saves, dates far from the transaction, an unfamiliar producing tool or camera for the vendor, an invalid digital signature. | 5 |
| Whole-ledger drift | Reconciliation alerts (platform capability) | Nightly monthly checks: expense-ratio anomalies, cross-account correlation, AP and AR versus ledger, payroll versus ledger, revenue versus cash receipts. | 2, 4, 6, 7, 9, 10, 11 |
| Who changed what | Universal change ledger (platform capability) | Every tracked-field change on every document type, with old value, new value, actor and time. Encrypted fields are recorded as changed without being exposed. | 3, 5, 6, 9, 10, 12, 13, 15, 16 |
Conclusion
Every case in this report, whether committed by a trusted insider or induced by an external attacker, shows up as an anomalous record inside a ledger: a payee who is an employee, a changed bank account, a vendor with no registry record, an amount distribution that looks invented, a payslip after a termination date, or a manual journal against a bank account. Sentinel's rules are built to surface those records and to rank them higher the more of these signals coincide. The exceptions are stated plainly: till skimming (case 7) marks the edge of what a ledger-based tool can see, and the ghost-employee check is deliberately narrow.
This report does not guarantee detection. It shows how Sentinel's rule logic is designed to respond to the transaction patterns described in the verified sources cited throughout. Whether any individual rule fires on a real transaction depends on the completeness of the underlying data, the thresholds configured for that tenant, whether the relevant rule is enabled, and whether the connected accounting system exposes the field the rule needs. Sentinel is a detection aid, not a substitute for segregation of duties, independent reconciliation, or other internal controls.
References
- SmartCompany (2011) — TZ Limited & Comunicom Group — smartcompany.com.au/finance/tz-limited-bookkeeper-sentenced…
- SmartCompany (2011) — Hairhouse Warehouse — smartcompany.com.au/business-advice/…hairhouse-warehouse…
- ABC News (2010) — Clive Peeters — abc.net.au/news/2010-08-19/rogue-accountant-jailed…
- ABC News (2021) — Sydney law firm trust fraud — abc.net.au/news/2021-03-16/nsw-mark-leo-o-brien…
- Northern Daily Leader (2021) — Carbine Club of Tasmania — northerndailyleader.com.au/story/8176213/…
- Inside Franchise Business (2015) — Banjo's Bakehouse — franchisebusiness.com.au/bakery-founder-jailed…
- ABC News (2013) — Mount Garnet Transport — abc.net.au/news/2013-10-03/bookkeeper-jailed…
- iKeep — Payroll manager, two employers — ikeep.com.au/blog/payroll-manager-jailed…
- Matthews Folbigg Lawyers — Hassell Services — matthewsfolbigg.com.au/news/workplace-solutions/…
- ASIC media release 26-089MR — Barnes Marketing Services — asic.gov.au/…26-089mr-former-nsw-director-mark-barnes…
- ABC News (2020) — Melbourne building business BEC — abc.net.au/news/2020-11-24/business-email-scam…
- ABC News (2025) — Mobius Group v Inoteq [2024] WADC 114 — abc.net.au/news/2025-01-16/court-orders-inoteq…
- ABC News (2024) — Gold Coast couple, settlement BEC — abc.net.au/news/2024-12-28/couple-loses…
- Bowls Australia — Upwey-Tecoma Bowls Club — bowls.com.au/flood-affected-bowls-club…
- AFP media release (2025) — Construction-sector BEC — afp.gov.au/news-centre/media-release/criminals-target-construction…
See what Sentinel would flag in your books
Start with a free health check on your own Xero, QuickBooks, or MYOB ledger — No credit card required · read-only connection, nothing in your ledger is changed.