Corporate Fraud in South Africa: Early Warning Signs Every Business Should Know

Procurement fraud, ghost employees, and invoice manipulation are among the most common forms of corporate fraud in South African organisations. Yet despite being prevalent, these forms of misconduct are often only detected after significant financial damage has already occurred.

The reason is rarely a lack of controls — it is a failure to recognise the early warning signs that precede formal fraud. Recognising these signs allows organisations to investigate early, before evidence disappears and losses compound.

Procurement fraud warning signs: Unusual patterns in supplier awards — particularly where a single supplier wins disproportionately often, or where contract values consistently fall just below approval thresholds. Relationships between employees and suppliers that are undisclosed. Invoices for services that are vaguely described or difficult to verify. Pressure from a specific employee to use a particular supplier without adequate justification.

Ghost employee indicators: Payroll entries for employees with no corresponding HR file, or no verifiable employment history within the organisation. Bank account details that match those of existing employees, directors, or connected persons. Sudden increases in headcount in a department without corresponding operational explanation. Addresses, ID numbers, or contact details that appear duplicated across multiple payroll records.

Invoice manipulation red flags: Sequential invoice numbers from a supplier, particularly where that supplier appears to be small or informal. Invoices dated on weekends or public holidays. Payments made to bank accounts that differ from the supplier's registered details. Invoice amounts that are round numbers or that consistently match budget line items exactly.

Expense fraud patterns: Expense claims without supporting documentation, or where documentation is generic rather than specific. Patterns of claims submitted just before or just after approval thresholds. Duplicate submissions across different expense periods. Travel claims for trips that do not align with any verifiable business activity.

What should you do if you notice these signs? Do not alert the suspect. Do not conduct an informal internal investigation without proper controls — this can contaminate evidence. Secure relevant records as discreetly as possible. And engage a professional investigator to conduct a structured, legally defensible investigation.

Early engagement matters. Forensic investigations are significantly more productive when records are intact, digital trails are undisturbed, and the subject has not been alerted. Every day of delay is a day where evidence can disappear.