Detecting Revenue Fraud: Forensic Investigation

Revenue fraud doesn’t usually start with someone secretly stealing money. More often, it begins with a simple desire to make the numbers look better. A sales target is missed, investors expect continuous growth, or management faces pressure to deliver strong quarterly results. What starts as a “temporary adjustment” or a “harmless accounting entry” can gradually turn into a deliberate scheme that distorts a company’s true financial performance.

The challenge is that revenue fraud rarely looks suspicious at first glance. Financial statements may show rising sales, improving profits, and a thriving business, while the underlying transactions tell a completely different story. Behind the reported figures could be fake invoices, premature revenue recognition, hidden side agreements, or sales that never actually happened.

Understanding these schemes is essential because revenue is one of the most closely watched numbers in any business. This guide explores the ten most common revenue fraud schemes, explaining what each one is, how it is carried out, why it happens, and the forensic techniques investigators use to detect the warning signs before the fraud comes to light.

1. Channel Stuffing

What it is

Imagine a company nearing the end of a quarter and falling short of its sales target. Instead of generating genuine customer demand, it persuades or sometimes pressures distributors and retailers to accept far more inventory than they actually need. The products leave the company’s warehouse, revenue is recorded, and the financial statements suddenly look stronger.

However, the goods are often left sitting in distributors’ warehouses, unsold to end customers. In reality, the company hasn’t increased demand; it has simply shifted excess inventory further down the supply chain. This practice is known as channel stuffing in revenue fraud, where reported sales grow on paper while the actual market demand remains unchanged.

How it happens

Near the end of a quarter, a sales team under pressure to hit targets offers distributors incentives to accept extra inventory: discounts, extended payment terms (60–120 days instead of 30), liberal return rights, or promises of marketing support. The distributor agrees to take the stock often with an informal understanding that unsold goods can be returned later or that payment isn’t really due on schedule.

The company books the shipment as a completed sale the moment it leaves the warehouse, inflating revenue for that period. The unsold inventory then sits in the channel, and the following quarter starts with less real demand, forcing the same trick again: a treadmill that gets harder to sustain each cycle.

Why it happens

Sales targets tied to bonuses or stock-based compensation create pressure to “make the number” by any means
Management wants to project consistent growth to support the stock price or meet analyst guidance
It’s a way to borrow from future revenue to cover a current shortfall, often done with the intention of “catching up” later, which rarely happens
Distributors may cooperate because they benefit from favorable terms, discounts, or an ongoing relationship with the supplier

How it’s detected

Days Sales Outstanding (DSO) trending upward: If customers aren’t paying faster despite revenue “growing,” receivables pile up, a strong signal of stuffed channels.
End-of-quarter revenue concentration: Comparing daily sales volume across a quarter often reveals a disproportionate spike in the final days.
Sell-through vs. sell-in gap: Comparing what was shipped to distributors (sell-in) against what distributors actually sold to end customers (sell-through, via POS data where available) exposes a widening gap.
Post-quarter return spikes: A jump in returns or credit memos shortly after a strong quarter suggests the goods came back.
Extended or unusual payment terms granted right before quarter-end, uncovered through contract and sales term reviews.

2. Bill-and-Hold Transactions

What it is

Picture a company eager to boost its quarterly sales figures. Instead of waiting until products are actually delivered, it issues an invoice to the customer and records the sale immediately, while the goods continue to sit in its own warehouse. On paper, the transaction appears complete, but in reality, nothing has changed except the accounting records and a revenue fraud.

Although bill-and-hold arrangements can be legitimate in limited situations, such as when a customer specifically requests delayed delivery and certain accounting conditions are met, they are frequently misused to recognize revenue before it has truly been earned. The result is inflated sales, misleading financial statements, and a false impression of the company’s performance.

How it happens

As the reporting period draws to a close, a company realizes it is about to miss its revenue target. Instead of waiting until the goods are actually delivered, it raises an invoice and records the transaction as a completed sale, even though the products are still sitting in its own warehouse. In some cases, the customer may have agreed to delayed delivery, but in more serious cases, the customer may be unaware of the arrangement altogether.

Since the customer has neither taken possession of the goods nor assumed the risks and rewards of ownership, the sale has not truly occurred. Yet the revenue is recorded to make the company’s financial performance appear stronger than it really is. Sometimes the goods are shipped weeks or months later, while in extreme cases, they are never shipped at all.

Why it happens

It lets a company recognize revenue immediately without needing an actual completed delivery, useful when a quarter is close to missing targets
It can be used with a cooperative or unaware customer to create the appearance of demand
Management may believe (or claim) the sale is “essentially” complete and treat the delay as a technicality, rationalizing the shortcut

How it’s detected

Physical inventory observation: Auditors check whether goods reported as “sold” are still sitting in the seller’s warehouse.
Bill-and-hold criteria testing: Verifying whether the arrangement meets required conditions, the buyer requested the delay for a substantive business reason, the goods are complete and separately identified from the seller’s own inventory, and there’s a fixed, reasonable delivery schedule.
Shipping/dispatch log cross-checks: Matching invoice dates against actual dispatch records rather than trusting invoice dates alone.
Customer confirmations: Directly asking the customer whether they requested the deferred delivery and whether they’ve accepted risk of loss on the goods.

3. Fictitious or Round-Trip Revenue

What it is

Fictitious revenue fraud is revenue recorded for a sale that never actually happened! No goods delivered, no service performed, no real customer. Round-tripping is a variant in which two companies agree to “buy” from and “sell” to each other in a circular transaction, so cash (or the appearance of cash) moves in a loop and both companies book revenue, even though nothing of real economic value changes hands.

How it happens

In the simplest version, someone in finance or sales creates a fake invoice for a fictitious customer (sometimes using a shell entity or a cooperative third party) and books it as a sale. No goods ship, no service is delivered, and often no cash ever arrives or the “customer” is paid by the company itself through a roundabout channel to make the transaction look real.

In round-tripping, Company A sends money to Company B to “buy” a service, and Company B sends a similar amount back to Company A to “buy” something in return. Both companies record revenue on their respective sides, inflating both, while no real value was created for either.

Why it happens

Desperation to hit revenue targets when real sales fall short, often to avoid missing earnings guidance or triggering loan covenant violations
To support a fundraising round, IPO, or stock price by showing artificial growth
Executives may be personally incentivized through bonuses or equity that depend on hitting revenue milestones
In round-tripping specifically, it can also be used to inflate the appearance of business activity/scale for two colluding companies simultaneously (each helps the other look bigger)

How it’s detected

Third-party confirmations: Directly contacting customers to confirm the transaction actually exists, and at the stated terms and amount, is one of the most powerful anti-fraud tools available.
Revenue-to-cash tracing: Fabricated sales rarely convert into real, independent cash inflows. Matching recognized revenue against actual bank deposits over a realistic collection window often exposes the gap.
Related-entity mapping: Cross-referencing customer and counterparty records for shared addresses, phone numbers, bank accounts, or officers can reveal round-tripping arrangements.
New customer concentration analysis: Flagging revenue concentrated in a handful of unfamiliar, newly-added counterparties with no credit history.
Delivery/performance vouching: Independently confirming that goods were shipped or services were actually performed, not just invoiced.

4. Premature Revenue Recognition

What it is

Premature revenue recognition in revenue fraud means booking revenue before it has actually been earned under accounting rules, for example, before delivery has occurred, before the customer has accepted the goods, or before all performance obligations under a contract have been satisfied.

How it happens

A company signs a multi-year contract or a large deal with conditions attached (a right of return, a customer acceptance clause, or milestones still to be completed) and records the full contract value as revenue immediately, rather than recognizing it gradually as obligations are actually fulfilled.

This can also happen with routine sales: goods are recorded as “sold” the moment an order is placed rather than when they actually ship or are delivered, or a software company books an entire multi-year subscription upfront instead of spreading it over the service period.

Why it happens

Pressure to show strong current-period results, even if the true economic activity hasn’t happened yet
Sales and finance teams sometimes disagree on when a deal is “done enough” to count, and management resolves the ambiguity in whichever direction benefits reported numbers
Complex, multi-element contracts create genuine judgment calls that are easy to bend without an obvious bright line being crossed

How it’s detected

Cutoff testing: Auditors sample transactions recorded near period-end and trace them to shipping documents, delivery confirmations, or service completion evidence to verify the revenue truly belongs in that period.
Contract review beyond the invoice: Reading the full underlying contract, not just the invoice, for side conditions, contingencies, or performance milestones that should have delayed recognition.
Reversal and credit memo analysis: A high volume of revenue reversals shortly after period-end is a strong sign that revenue was recognized too early and had to be walked back.
Five-step recognition criteria check (ASC 606 / IFRS 15): Verifying that a valid contract existed, performance obligations were identified, the transaction price was properly determined and allocated, and revenue was recognized only as obligations were actually satisfied.

5. Percentage-of-Completion Manipulation

What it is

For long-term contracts (construction, large software implementations, engineering projects), companies are allowed to recognize revenue gradually based on how much of the project is complete, rather than waiting until the whole thing is finished. Revenue fraud happens when management overstates the completion percentage to recognize more revenue than the actual progress justifies.

How it happens

A project manager or executive estimates that a contract is, say, 70% complete based on costs incurred or physical progress, and revenue is recognized in proportion to that estimate. In a revenue fraud case, that estimate is inflated; perhaps the project is really 50% complete, but management reports 70% to book more revenue now.

Because completion percentage relies on subjective judgment (estimated costs to complete, physical progress assessments), it’s relatively easy to shade the number upward quarter after quarter without an obvious lie being told at any single point; the fraud accumulates gradually.

Why it happens

Long-term contracts create earnings volatility that management wants to smooth out by pulling revenue forward
Overstating completion hides cost overruns or project delays that would otherwise show up as lower profitability
It can mask a project that’s actually losing money by making it appear more profitable and further along than it is

How it’s detected

Independent progress verification: Comparing management’s stated completion percentage against physical site inspections, third-party engineering assessments, or formal milestone sign-offs from the customer.
Cost recomputation: Independently recalculating percentage-of-completion using actual costs incurred to date divided by total estimated costs, and comparing that to management’s reported figure.
Historical estimate accuracy review: Checking whether prior-period completion estimates were later revised significantly, a consistent pattern of “always revised upward right before completion” suggests systematic overstatement.
Change order and claims scrutiny: Verifying that revenue tied to unapproved change orders or disputed claims isn’t recognized before collection is reasonably assured.

6. Related-Party Transactions

What it is

This is revenue generated from transactions with parties connected to the company, subsidiaries, entities controlled by executives, family members of management, or other affiliated parties, where the transaction lacks genuine independent economic substance and exists mainly to inflate reported sales.

How it happens

An executive with an ownership stake in another company arranges for that company to “buy” products or services at inflated prices, or arranges sales that wouldn’t happen on genuine arm’s-length terms. Because the companies are connected, the transaction can be structured however is convenient, favorable pricing, no real intention to collect payment, or goods that don’t actually move.

The related party may effectively be receiving something else of value in return (a favor, a personal benefit) that offsets the apparent “loss” on their end of the deal.

Why it happens

Management wants to inflate revenue without needing to find genuine independent customers
Related parties are often willing to cooperate because of the personal or business relationship, unlike arm’s-length third parties who wouldn’t accept manipulated terms
Weak corporate governance or a dominant founder/executive can make it easy to push these transactions through without independent board scrutiny

How it’s detected

Related-party mapping: Cross-checking customer and vendor master files against known officers, directors, major shareholders, subsidiaries, and their known affiliates.
Disclosure review: Comparing related-party transactions disclosed in financial statement footnotes against the general ledger to check for anything omitted or understated.
Arm’s-length pricing test: Comparing the pricing and terms of related-party deals against comparable transactions with independent third parties.
Substance-over-form testing: Assessing whether the transaction has genuine economic substance, real goods or services actually delivered and real, independent cash flow, or whether it exists purely on paper.

7. Cookie Jar Reserves (Reserve Manipulation)

What it is

Companies maintain reserves, allowances for sales returns, bad debts, or rebates that reduce reported revenue when they’re set up. “Cookie jar” reserve fraud happens when a company deliberately over-reserves in good periods (understating revenue slightly) and then releases those excess reserves in weaker periods (boosting revenue fraud), smoothing results to look artificially consistent.

How it happens

In a strong quarter, management sets aside a larger-than-necessary reserve against future returns or bad debts, which slightly dampens that quarter’s reported revenue but keeps a “cushion” in reserve. In a weak quarter, instead of reporting the true, disappointing number, management releases part of that excess reserve back into revenue, making the weak quarter look stronger than it actually was.

Because reserve levels involve estimation and judgment, this can be done through accounting entries without any change to the underlying business no different, fabricated, or accelerated sale is needed at all.

Why it happens

Management wants to present smooth, predictable earnings growth to the market rather than the lumpy reality of an actual business
It reduces the risk of missing analyst expectations in any given quarter
It can also be used opportunistically to manage which period’s bonus targets get hit

How it’s detected

Reserve roll-forward analysis: Tracking the beginning balance, additions, releases, and ending balance of each reserve account across multiple periods to spot unusual or unexplained releases.
Historical loss rate benchmarking: Comparing current reserve percentages against the company’s own multi-year historical loss experience and against industry norms.
Correlating reserve changes with earnings pressure: Looking for a pattern where reserve releases happen precisely in quarters that would otherwise miss targets.
Assumption and methodology review: Scrutinizing the inputs behind reserve calculations for unsupported, inconsistent, or opportunistically-changed judgment calls.

8. Misclassification of Revenue Types

What it is

This involves recording non-operating, one-time items like gains from selling an asset, an insurance payout, or a litigation settlement, as if they were core operating revenue, making the business appear to be growing organically when the “growth” actually came from an unrelated, non-repeatable event in revenue fraud.

How it happens

A company that sells a piece of property, wins a lawsuit, or receives a large insurance settlement records the proceeds within its regular “revenue” or “sales” line instead of listing it separately as a non-operating gain. Investors and analysts, seeing top-line revenue grow, assume the core business is expanding, when in reality the growth has nothing to do with operations and won’t recur next period.

Why it happens

It’s an easy way to hit a revenue growth target in a quarter where core sales were actually flat or declining
It can mask a deteriorating core business by burying the truth inside an inflated total revenue figure
It’s less likely to be immediately challenged than fabricating a sale outright, since the underlying cash and transaction are real, it’s the classification that’s misleading

How it’s detected

Line-item tracing: Tracing top-line revenue components back to source documents to confirm they genuinely represent core operating activity rather than a one-time, non-operating event.
Segment reconciliation: Comparing disclosed revenue by business segment or product line against total reported revenue to check for unexplained gaps or new categories.
Comparative trend analysis: Watching for new or reclassified revenue categories appearing suddenly, without a restated prior period for fair comparison, and without a clear operational explanation.

9. Gross vs. Net Reporting Manipulation

What it is

Some companies act as an “agent” in a transaction, merely facilitating a sale between another seller and a buyer, rather than as the “principal” who actually owns and controls the goods or service. Agents should report only their commission or fee as revenue (net reporting). Still, revenue fraud occurs when a company reports the entire transaction value as its own revenue (gross reporting) despite not bearing the principal’s real risk or control.

How it happens

A marketplace, reseller, or intermediary company records the full value of transactions flowing through its platform as its own revenue, even though it never takes on inventory risk, credit risk, or fulfillment responsibility, and merely earns a small fee for connecting buyer and seller. By reporting gross transaction value instead of just its fee, the company’s headline revenue looks dramatically larger than the real economic activity it performs.

Why it happens

A much larger reported revenue figure is more impressive to investors, especially in growth-stage or newly public companies competing on “scale”
Larger revenue can support a higher valuation multiple, even though actual profit and cash generated are unchanged
It can be used to disguise a low-margin, purely intermediary business model as something bigger and more substantial

How it’s detected

Principal-vs-agent analysis: Assessing who actually controls the good or service before it transfers to the customer, who bears inventory and credit risk, and who has discretion over pricing, these factors determine whether gross or net reporting is appropriate under accounting standards.
Margin benchmarking: Comparing gross margin percentage to industry peers; a large revenue figure paired with an unusually thin margin often signals a business that should be reporting net, fee-based revenue instead.
Contract review: Examining underlying supplier and customer contracts to determine which party genuinely bears the risk in the transaction.

10. Side Letters and Undisclosed Terms

What it is

This scheme in revenue fraud involves recording a sale as final and unconditional in the books, while a secret side agreement not part of the official contract grants the customer rights to return the goods, delay payment indefinitely, or cancel the order altogether. Had these terms been disclosed, the transaction likely wouldn’t have qualified for revenue recognition in the first place.

How it happens

A salesperson eager to close a deal (and hit a quota) offers the customer an informal, undocumented assurance, often verbally, by email, or through a private side letter that they can return the product, cancel the order, or delay payment without real consequence. The official, signed contract shows a clean, unconditional sale, so it gets booked as normal revenue.

The side arrangement stays hidden from finance, accounting, and auditors, only surfacing later when the customer exercises their secret right and the “sale” unwinds.

Why it happens

Individual sales reps face pressure to hit quotas and commissions, and offering hidden flexibility is an easy way to get a reluctant customer to sign
Management may be aware of and even encourage this practice informally to hit company-wide targets, while keeping it off the official books to avoid accounting scrutiny
Customers benefit too, since they get a “safe” purchase with hidden downside protection, making them more willing to cooperate

How it’s detected

Open-ended customer confirmations: Rather than only confirming invoice amounts, directly asking customers whether any side agreements, return rights, or informal understandings exist outside the written contract.
Correspondence review: Forensic review of sales team emails and messages (typically under legal oversight) can uncover undisclosed promises made to close a deal.
Post-period return and cancellation tracking: A pattern of “unexpected” returns or cancellations shortly after quarter-end on specific large deals often traces back to undisclosed side terms.
Commission structure cross-check: Investigating whether sales commissions were paid on deals that were later reversed, a mismatch can suggest the sales team knew at the time of booking that the deal wasn’t truly final.

Cross-Cutting Detection Tools (Apply Across All Schemes)

Benford’s Law analysis: Statistical testing of the distribution of leading digits in transaction amounts can flag unnatural patterns consistent with fabricated numbers.
Journal entry testing: Focusing on manual, non-routine, or period-end adjusting entries to revenue accounts, especially those made by senior personnel with override authority.
Revenue-to-cash-flow correlation: A persistent divergence between reported revenue growth and operating cash flow growth is one of the single strongest indicators of revenue fraud, across nearly every scheme above.
Ratio and trend analysis: Tracking gross margin, DSO, inventory turnover, and revenue growth rate over multiple periods and against industry peers for anomalies.
Whistleblower and internal tip mechanisms: Many major frauds (Enron, WorldCom, Theranos) were ultimately uncovered through internal tips rather than routine audit procedures — a strong internal reporting culture is a powerful detection tool in itself.
Full-population data analytics: Running queries across the entire general ledger (rather than samples) to look for round-number entries, weekend/holiday postings, or entries booked just below approval thresholds.

The Common Thread

Across all ten schemes, three ingredients tend to appear together: pressure (to hit a number, whether from the market, management, or personal compensation), opportunity (weak internal controls, complex judgment-heavy accounting areas, or a dominant executive able to override checks), and rationalization (the belief that the shortfall is temporary and will be “fixed” next quarter).

This is the classic fraud triangle, and it’s why detection works best when it combines hard financial analysis with attention to incentive structures and internal culture, not just checking whether the numbers add up.

Summary Table

Scheme	Primary Detection Method
Channel stuffing	DSO trend, sell-through data, return spikes
Bill-and-hold	Physical inventory observation, criteria compliance check
Fictitious/round-trip revenue	Third-party confirmations, cash tracing
Premature recognition	Cutoff testing, contract review
Percentage-of-completion fraud	Independent progress verification, cost recomputation
Related-party transactions	Related-party mapping, arm’s-length pricing test
Cookie jar reserves	Reserve roll-forward analysis, historical benchmarking
Misclassified revenue	Line-item tracing, segment reconciliation
Gross vs. net manipulation	Principal-vs-agent analysis, margin benchmarking
Side letters	Open-ended customer confirmations, correspondence review

Detection is rarely about spotting one smoking gun, it’s about triangulating multiple signals (financial ratios, third-party confirmation, documentation review, and behavioral red flags) until the pattern becomes clear.

Read about famous Scandals