AI-generated receipts and invoices: what small businesses should keep, and what they should check

This is general information, not tax, legal or accounting advice. The statistics below come from vendors and surveys, which we flag, and from the FBI’s annual report. Check record-keeping rules with your accountant for your country.

What the numbers say, and how far to trust them

Expense platforms. AppZen audits expenses for large companies. Its data, as reported by Forbes and Accounting Today, show AI-generated receipts making up 0% of the fake receipts it flagged in March 2025 and 70.8% by mid-May 2026. Between March 2025 and mid-May 2026 it flagged 1,471 AI-generated receipts, submitted by 745 employees at 174 companies, claiming $148,143 in total. Forbes adds the average (about $101) and the median (about $32). The figures cover only what AppZen caught, and AppZen is a vendor selling detection. Accounting Today stresses that the 70.8% is a share of flagged fakes, not growth in total expense fraud, and Forbes notes the figures are detected submissions and amounts claimed rather than money paid out.

Surveys. Emburse, a travel-and-expense vendor, surveyed 2,000 business professionals in the US and UK. It reports that 34% admit using AI to generate a fake receipt for a business expense (40% in the US, 29% in the UK), and, in Emburse’s wording, 19% used AI-generated receipts to obtain a larger reimbursement than the original purchase amount. These are self-reported answers to a vendor’s survey, so treat them as a signal, not a measurement of fraud.

The wider fraud picture. The FBI’s Internet Crime Complaint Center (IC3) 2025 report records $3,046,598,558 in reported losses from business email compromise (BEC) across 24,768 complaints, and says more than 22,000 complaints in 2025 referenced AI, with adjusted losses above $893 million. Of that, the report says businesses reported over $30 million in losses to BEC scams involving AI. Those AI figures count complaints that mention AI; they do not show that AI caused the loss.

One more caution: nothing here says most receipts or invoices are fake. It says the cost of making a convincing one has collapsed, and that is enough to change how you check them.

Why “does it look real?” stopped working

Forbes quotes AppZen’s chief technology officer saying “the does it look real test is pretty much finished”. The same article describes fake restaurant receipts with a forged scanner watermark and a handwritten signature, and fabricated phone and internet bills. A Techfinitive report quotes an SAP Concur executive telling customers “do not trust your eyes”.

Provenance metadata is not a cure either. Forbes notes that some AI tools embed metadata saying how an image was made, and in some AppZen cases that gave investigators clear evidence, but the information can vanish when a file is edited, compressed or re-saved. So the absence of a label shows nothing, and the presence of one only helps if it survived. See our comparison of Content Credentials and a timestamp.

The same article reports that the strongest clues are often in the numbers rather than the pixels: mismatched fields, bad totals or incorrect taxes.

Checks that work, from the sources

Across Forbes, AppZen, Emburse and the FBI report, the advice is about the transaction, not the picture:

• Match the claim to an independent record. Compare the receipt with the card or bank feed, the merchant, the date and the amount. Where the business issues cards, a real-time card record makes the receipt secondary evidence.
• Sample the small claims. Forbes points out that automatic approval thresholds tell would-be fraudsters what amounts to aim for, so keep spot checks even below the threshold.
• Verify payment changes with a known number. For a supplier who “changed bank details”, call the number you already hold, not the one on the new invoice. Use a second approver for changes. The FBI report’s own examples include wire instructions sent from a compromised email account.
• Act fast on a bad transfer. The IC3 report says to contact your bank immediately to request a recall and to file a complaint at ic3.gov with full transaction details, because time matters for freezing funds.
• Combine signals. Forbes recommends not relying on any single sign of authenticity.

Those checks are the main defence. They do not need TimeBinder, and nothing a dated record can do replaces them.

Where a dated record helps, and where it does not

Dated records answer a different question: is the document I am holding the one I received, and has it changed since? That matters in disputes such as “that invoice said a different amount”, “we never approved that version” or “the PDF on file is not the one you sent”. Practical uses for a small business:

1. Inbound invoices. Save the native file or original email (not a screenshot) when it arrives, and make a TimeBind of it. If the amount or bank details are later disputed, you can show the file you hold matches the fingerprint made at receipt. See how to prove a PDF existed before a date.
2. Approved versions. When an invoice or purchase order is approved, fingerprint the approved file. If someone later swaps in a different PDF, the mismatch is checkable. Our guide to telling if a file has been changed and the free file comparison checker show how.
3. Invoices you issue. Fingerprint the invoice you actually sent. If a customer produces an altered copy, you can compare it with yours. The free SHA-256 checker shows a file’s fingerprint.
4. Refund and damage evidence. If your business takes photos or documents for claims, keep the originals and date them. See insurance fraud prevention.

Limits, plainly. A TimeBind does not show that a receipt is real, that a purchase happened, or that an invoice’s sender is who they claim to be. If someone submits an AI-made receipt and you fingerprint it on arrival, you now hold a dated copy of a fake, which is useful for an investigation but is not a test of authenticity. TimeBinder does not detect fakes.

How long to keep records

Keep-for-how-long rules depend on your country and your tax situation. In the United States, the IRS page How long should I keep records? says you must generally keep records that support an item of income, deduction or credit until the period of limitations for that return runs out, and gives 3 years as the default, 6 years if you under-report income by more than 25% of gross income shown, and longer in some cases. It also notes that insurers or creditors may require longer. Rules elsewhere differ, so ask your accountant. Whatever period applies, keep the original receipt file together with the fingerprint record, not just a scan of a scan.

For the wider small-business picture, see timestamping business documents and how to show a contract was not edited after signing. The scenario a revised wire instruction almost sends millions to fraud is an illustration, not a case report.

A short checklist for a small business

1. Write a rule: any change to bank details is confirmed by phone on a number you already hold, with a second person approving.
2. Check claims against card or bank data, not against how the receipt looks.
3. Keep native files and original emails for invoices and receipts, with the date you received them.
4. Fingerprint the invoices that matter, both received and issued, at the time they arrive or leave.
5. Sample low-value claims, even when automatic approval is on.
6. Keep an incident note: who reported what, when, which bank was called and which complaint number was issued.

Sources checked

• James Broughel, “AI-Generated Fake Receipts Are Changing Expense Fraud”, Forbes, 28 June 2026: forbes.com (Forbes blocked automated fetching, so the quotes were cross-checked against the interview below)
\n
• Small Business Currents, “When AI Makes Fraud Look Real”, 3 August 2026 (interview with AppZen’s co-founder and CTO)
• Chris Gaetano, “Use of AI receipts in expense fraud soars”, Accounting Today, 23 June 2026: accountingtoday.com
• Emburse, “AI-Generated Receipts Are Here. Expense Controls Need to Catch Up.”: emburse.com
• AppZen, agentic AI expense report audit (March 2025 to May 2026 data): appzen.com
• Techfinitive, “Real vs fake receipts: How your employees are using the AI you pay for to defraud you”: techfinitive.com
• FBI Internet Crime Complaint Center, 2025 Internet Crime Report: ic3.gov
• IRS, “How long should I keep records?”: irs.gov

Start a dated record of the invoices and receipts you rely on

Your first Pooled TimeBind is free, with no credit card required. After that, TimeBinds start from US$5, and an ASAP TimeBind is US$15. Click here to start, or see plans and pricing.