Guides · 2026-07-24

Duplicate invoice detection: how businesses end up paying twice, and how to stop it

“We paid the same invoice twice” is one of the most common — and most avoidable — losses in accounts payable. It rarely involves a dishonest supplier. It happens because the same invoice arrives twice through different doors, looks slightly different each time, and passes every check both times.

Where duplicates actually come from

• The re-send. Payment runs a week late, the supplier re-sends the invoice “just in case,” and both copies are processed — one by you, one by a colleague.
• Two channels. The same invoice comes in by email and again by post, or once directly and again attached to a monthly statement.
• The re-key. A copy is typed in manually with a slightly different invoice number — “INV-1001” vs “INV 1001” — so the exact-match check in your accounting system never fires.
• The re-scan. A printed copy of a PDF original is scanned back in. Different file, same money.

Note what these have in common: every copy is a legitimate invoice. That is why duplicate payment is mostly a process failure, and why the fix has to look at the document itself, not just at the invoice number field.

Why the built-in check in your accounting system isn't enough

Xero, MYOB, QuickBooks and their peers warn on an exact duplicate invoice number for the same contact. That catches the laziest case and none of the others: the re-keyed number with different punctuation, the scan of a PDF, the copy entered under a slightly different supplier name. The check fires at data-entry time, on the data as entered — after the weakest link (a human re-keying a document) has already introduced the variation that defeats it.

What reliable detection looks like: fingerprints, two levels

The approach DVAP Duplicate Check takes is to fingerprint every document it sees, at two levels:

1. File fingerprint — a hash of the bytes. Catches the re-send: the identical PDF submitted again, whenever, by whomever. Match type: exact_file.
2. Detail fingerprint — a hash of the normalized invoice essentials (supplier, invoice number, amount) after extraction. Catches the re-key and the re-scan: different file, same invoice. Match type: same_invoice_details.

Each check names the rule that fired, so the reviewer knows whether they are looking at the same file again or the same invoice in a new coat. And because only fingerprints are stored — never the document — the check adds no new place where your financial documents live.

Where to put the check

One call per incoming document, at the point of ingestion: the document is checked against everything seen before and remembered for everything that comes after. In practice that is a single POST per invoice before it enters your approval flow — a duplicate caught there costs a deleted row; the same duplicate caught by your supplier's statement three months later costs a recovery conversation. If you run the full DVAP pipeline, the duplicate check runs automatically on every processed invoice, alongside fraud screening and PO matching.

Frequently asked questions

How do duplicate invoice payments happen?

Usually without any fraud: a supplier emails an invoice and then posts it, re-sends it when payment is slow, or it arrives once directly and again on a statement. Each copy enters accounts payable through a different door, gets keyed slightly differently, and passes every check on its own.

Why doesn't my accounting software catch duplicate invoices?

Most systems only block an exact duplicate invoice number for the same supplier. A re-keyed copy with a space in the number, a different date format, or a scanned copy of a PDF original doesn't trip that check — which is exactly how most real duplicates arrive.

What is fingerprint-based duplicate detection?

Each checked document is reduced to cryptographic fingerprints: one of the file bytes, and one of the normalized invoice details (supplier, number, amount). A re-sent file matches the first; a re-keyed or re-scanned copy matches the second. Only fingerprints are stored, never the document.

When should invoices be checked for duplicates?

At ingestion — before the invoice enters your approval flow — and again before the payment run for anything that entered through another channel. Catching a duplicate after payment means recovering money from a supplier; catching it before means deleting a row.

Does DVAP Duplicate Check store my invoices?

No. The check endpoint keeps only the fingerprints needed to recognize the document if it appears again, plus which rule matched. The document itself is never retained.