In June 2026, expense software company Emburse published a survey of 2,000 workers in the US and UK. Four in ten US employees admitted using AI to generate a fake receipt for a business expense. Of those who did: - 19% used AI to fabricate a purchase entirely - 15% used it to inflate the value of a real one - 40% used AI tools their employer was paying for It is a vendor survey, so treat the exact numbers with care. But the direction is hard to argue with. A convincing receipt now takes seconds, and the old tells, such as odd fonts or a blurry photocopy, are disappearing. I trained in audit at PwC and KPMG. One principle from that world matters more than ever now: evidence from an independent source is more reliable than evidence produced by the person making the claim. A receipt is evidence from the claimant. A card transaction comes from the bank. That difference is now your best control. Five changes any business can make this month, no new software required: 1. Move to company cards where you can. The transaction record is created by the card provider, not the employee. 2. Match receipts to bank or card data, not to how real they look. If you cannot trace it to a transaction, treat it as unverified. 3. Update your policy wording. If it only mentions "altered" receipts, add "AI-generated or digitally fabricated". 4. Never change a supplier's bank details from an email. Call a number you already had on file, not one in the request. 5. Split the jobs. The person who adds a supplier should not be the person who approves the payment. Notice that none of these try to spot the fake by eye. That fight is already lost. The answer is to stop relying on the document and start relying on the source. AI makes forgery cheap. Good controls make it pointless. Which of these five does your business not have yet?