How e-invoicing mandates move fraud risk into Accounts Payable, and how Docnova AP Automation closes the gap
Mohammed Bouhaba · Melasoft GmbH · November 2026
E-invoicing mandates secure the transport of invoices, not the trust behind them. As every B2B invoice migrates to regulated platforms, fraud does not disappear. It follows the channel that finance teams now trust by default.
The early signals are already visible. Business leaders are reporting fraudulent invoices arriving directly in their e-invoicing applications, delivered through approved platforms and indistinguishable in format from genuine supplier invoices. This is not a platform failure. It is a structural feature of open, interoperable networks, and it redefines where the real control point in the invoice lifecycle sits: in Accounts Payable.
This paper sets out why the risk exists, what a robust control architecture looks like, and how Docnova AP Automation turns that architecture into a working process inside your ERP.
1. The trust boundary: channel integrity is not transaction legitimacy
Regulated e-invoicing architectures are designed to guarantee channel integrity. Approved platforms validate syntax and mandatory data, route invoices through a central directory keyed on company identifiers, exchange lifecycle statuses and transmit tax data to the administration. They are, by design, agnostic to commercial substance.
| Layer | Question it answers | Owned by |
|---|---|---|
| Channel integrity | Is this a valid, correctly routed, traceable invoice? | The approved platform |
| Transaction legitimacy | Do we owe this money, to this entity, on this account? | The buyer’s AP function |
Interoperability means open addressability: any registered entity can reach any other. A fraudster operating a legally registered shell company holds exactly the same network rights as a long-standing supplier. The platform has done its job when the invoice arrives. The question of whether it should be paid was never in its scope.
2. How the threat model shifts: from document fraud to data fraud
Paper and PDF fraud relied on deception the human eye could sometimes catch. Structured e-invoices remove those cues. A fraudulent invoice now carries the same schema, the same validation stamp and the same channel as a legitimate one, which creates a false proxy for trust.
Three dynamics amplify the exposure:
- Removed friction: mandates push organizations toward straight-through processing. Every manual touchpoint removed for efficiency is also a checkpoint removed for fraud.
- Authority bias: invoices delivered via a regulated platform are implicitly perceived as pre-vetted, lowering scrutiny at precisely the moment volume peaks.
- Familiar schemes, new rails: fictitious suppliers, look-alike entities, inflated or duplicated billing, business email compromise and bank detail substitution do not need to be reinvented. They simply ride a more credible channel.
The exposure is not only financial. Recovering input VAT generally requires a genuine underlying supply, so a fictitious invoice that is approved and booked can create tax risk on top of the cash loss. And because the French model formalizes lifecycle statuses, including the buyer’s refusal of an invoice, deciding what to accept is now an explicit, traceable responsibility of the recipient.
3. Accounts Payable as the trust layer
If the platform guarantees the channel, AP must guarantee the transaction. Mature organizations treat this as a layered control architecture rather than a single approval step.
| Control layer | Core question | Representative controls |
|---|---|---|
| Supplier governance (Know Your Supplier) | Is this a legitimate counterparty we chose to work with? | Controlled onboarding, identity and VAT validation, verified bank account ownership, segregation of duties on master data |
| Transactional assurance | Is there a real obligation behind this invoice? | Two- and three-way matching to PO and receipt, tolerance rules, contract and price checks |
| Behavioral analytics | Does this invoice fit the pattern of the relationship? | Fuzzy duplicate detection, first-time-sender quarantine, amount and frequency anomaly scoring |
| Decision governance | Who decided to pay, and on what basis? | Risk-weighted approval routing, segregation of duties, immutable audit trail, formal acceptance or refusal status |
No single layer is sufficient. A known supplier can still overbill; a perfectly matched invoice can still carry altered payment details. Protection comes from the layers operating together, before payment is released.
4. The paradox: the mandate is also the solution
The same structured data that gives fraud a credible disguise also makes industrial-grade control possible. With invoices arriving as machine-readable data rather than scanned documents, controls no longer depend on extraction quality or manual review. They can run on every invoice, in real time, at the point of reception.
This shifts the control model from detect-and-recover after payment to prevent-at-reception. An unknown sender can be quarantined before it enters the workflow. A mismatch can trigger a refusal before anyone approves it. Fraud prevention becomes a property of the process, not the vigilance of an individual.
Organizations that connect e-invoicing reception natively to their ERP and AP controls capture this advantage. Those that stop at compliance get a faster channel and the same blind spots.
5. From principle to process: Docnova AP Automation
Docnova AP Automation was built on exactly this premise: compliance gets the invoice to you, and AP decides whether it deserves to be paid. It takes any incoming document and turns it into a posted, fraud-checked, approved invoice, automatically where the invoice is clean and with human judgment where it is not.
The product runs every document through a five-stage pipeline:
| Stage | What happens | Why it matters |
|---|---|---|
| 1. Document Pool | Every document arrives in one place and one format: invoices, credit notes, despatch advices, orders, catalogues and expense receipts, via Peppol, national platforms, e-mail PDF (OCR with human confirmation) or upload. | One source of truth. Nothing lives in inboxes or on desks. |
| 2. Fraud pre-check | A 204-signal engine runs before anything else. 42 hard-stop controls, such as a changed IBAN, a blocked vendor or a duplicate, end the journey immediately. | Fraud is stopped before a human ever sees the invoice. |
| 3. Dispatcher | Rules decide which workflow starts, or none at all. Reference documents such as despatch advices and catalogues are stored and used for matching. | Nothing is forced into a workflow it does not need. |
| 4. Approval workflow | A decision table decides who approves; a workflow engine executes the chain, with delegation, escalation and separation of duties. | Approval policy becomes configuration, not a software project. |
| 5. ERP posting and payment | The invoice posts with the full coding block (vendor, PO, GL account, cost center, tax code) already matched. Payment status flows back. | The invoice arrives in the ERP finished, not as a to-do. |
6. Fraud stopped before the workflow, not after it
Most AP tools check for fraud at approval time, or rely on the approver to notice. Docnova moves the control to the front of the process, where it is cheapest and most effective.
- 204 live signals, 42 hard stops: severe indicators such as a changed IBAN, a blocked supplier or a duplicate never reach the approval workflow. The invoice goes to a dedicated fraud review queue instead.
- Configurable risk scoring: each check carries a weight. A minor field discrepancy scores low, an IBAN mismatch scores high, and score bands map to actions: continue automatically, route to human review, or stop and investigate. Every score is stamped and reproducible.
- Your own rules: finance teams can add custom fraud logic, such as exact supplier-name matching against the ERP master, on top of the predefined controls.
- Contextual anomaly detection: AI flags invoices that are technically valid but behaviorally unusual, such as a supplier that normally bills small amounts suddenly invoicing a multiple of that, or billing for a category it has never supplied.
- Legitimate change is not fraud: a new supplier IBAN triggers verification, not automatic rejection. AP confirms with the supplier through a known contact, updates master data and reruns the checks.
7. Approvals as data, not code
In many organizations, changing an approval rule means a change request, a consultant and a release cycle. Docnova separates the decision from the execution. A decision table determines who must approve, based on amount, entity, cost center, contract coverage or risk score. The workflow engine then executes that chain.
Roles resolve to real people at run time, with dated delegation when someone is absent, escalation when an invoice waits too long, and separation of duties enforced by the engine itself: a requester can never approve their own invoice. Adding a new approval tier is a row in a table. Finance owns its policy; IT is no longer the bottleneck.
8. AI that assists, humans who decide
Automation in AP has to be explainable, because auditors will ask why an invoice was paid. Docnova matches vendor, PO, GL account, cost center, tax code and terms through an ordered sequence of strategies: exact, fuzzy, compare, lookup and finally AI, protected by a confidence gate.
Above the gate, matching completes automatically. Below it, a person confirms a prefilled suggestion. AI never writes to your books on its own. Clean, low-risk invoices can flow from reception to posting with no human touch, and your AP team spends its time on the exceptions that genuinely require judgment: suspicious invoices, missing information, high values and unusual supplier activity.
9. One invoice, one story
Illustrative scenario
A steel supplier sends a €78,000 invoice through Peppol. It lands in the Document Pool. In under a second, the fraud engine checks its signals: the IBAN is known, there is no duplicate, and the purchase order exists and is open.
The dispatcher starts the standard AP workflow. The decision table routes it to the finance manager, then the CFO. The cost-center owner is on vacation, so the dated delegation applies automatically. Each approver sees the invoice with its fraud evidence. After two approvals it posts to SAP with the PO line, GL account, cost center and tax code already matched.
Now imagine the same invoice arrives with a different IBAN. It never enters the workflow. It stops in the fraud review queue, and the supplier is called back on a known phone number, not via a reply to an e-mail that may come from the attacker.
Every step of both paths, including every engine check, every click and every minute an invoice waited on an approver, is recorded on a single timeline for that document.
10. Built on a compliance backbone
Most AP automation vendors bolt invoice processing onto a workflow tool and leave mandate compliance to a separate provider. Melasoft is a DGFiP-registered Plateforme Agréée and operates the Docnova e-invoicing platform across European mandates, including Germany, France, Peppol, Poland, Romania and Serbia.
That means one vendor, one pipeline and one audit trail from reception to payment. Formats and mandate changes are handled below the AP layer, so a new regulatory requirement is our problem, not your project.
The two products work together but do not depend on each other. Existing Docnova e-invoicing customers add AP Automation as a layer on infrastructure they already use. Companies on another e-invoicing provider can run Docnova AP Automation standalone, with documents arriving from any channel.
11. Native to your ERP, with no middleware
For SAP customers, Docnova AP Automation is available as a native Add-On that installs inside SAP and supports ECC, S/4HANA and Business One. Because it is release-agnostic, it survives an S/4HANA migration rather than being rebuilt after it.
For Oracle, Microsoft Dynamics, NetSuite and other ERPs, Docnova connects through clean REST endpoints. In both cases there is no middleware layer to license, monitor or maintain.
12. Audit-ready by design
When an auditor asks who approved an invoice and why, the answer should take seconds, not days. Every document in Docnova carries its own timeline, merging engine steps, human decisions and ERP responses. Users see what waits on them in their Inbox and what they decided in their Outbox, so nothing disappears after approval.
A separate platform audit log records every configuration change, such as who edited a workflow, changed a decision table or added someone to an approval group. The platform runs on an ISO 27001 certified information security management system, with role-based access, enforced separation of duties and archiving aligned with GoBD and NF Z42-013 requirements.
13. Proof before commitment: Shadow Mode
The hardest part of any AP project is trust. Docnova removes that risk with Shadow Mode: the full pipeline runs on your real invoices, with ERP posting and payment disabled.
Before anything touches production accounting, you see your own numbers:
- How many invoices would pass automatically, and how many become exceptions.
- Which fraud signals fire on your real supplier base.
- How well the approval rules fit your organization.
- How much manual work could be removed from your AP team.
Implementation follows a structured, fixed-scope rollout that includes Shadow Mode, so the decision to go live is based on evidence rather than a vendor promise.
14. The CFO agenda
In France, the reception obligation has applied to all companies since September 2026, with issuance extending to small and micro businesses in September 2027. Germany, Poland and other European markets are moving in the same direction. Most organizations have scoped this as a compliance project. Finance leadership should reframe it around five questions:
| Question for finance leadership | How Docnova AP Automation answers it |
|---|---|
| Who owns the decision to accept or refuse an invoice received through the network? | A defined dispatcher, workflow and fraud review queue, with every decision on the document timeline. |
| Can an invoice from a counterparty outside our governed supplier master reach approval? | Unknown or blocked senders are stopped by hard-stop controls before any workflow starts. |
| Are supplier identity and bank details protected, or editable by a single user? | IBAN changes trigger verification; separation of duties is enforced by the engine; configuration changes are logged. |
| Can we change approval policy without an IT project? | Approval rules live in a decision table that finance can update and publish. |
| Do we measure first-time senders, exception rates and refused invoices alongside touchless rates? | Fraud scores, exceptions and processing paths are recorded per document and visible on one screen. |
Conclusion
Compliance answers whether an invoice is valid. Only Accounts Payable can answer whether it is legitimate. As e-invoicing becomes the universal channel for B2B billing, the competitive line will not be drawn between compliant and non-compliant companies, but between those whose payables process is merely compliant and those whose process is secure by design.
Docnova AP Automation brings both together: a licensed e-invoicing backbone and an AP engine that validates, fraud-checks, approves and posts every invoice before a single euro leaves the account.
Next step
See it on your own invoices. Contact Melasoft to arrange a Docnova AP Automation demo and a Shadow Mode assessment on your real data, with zero impact on production.
mohammed.bouhaba@melasoft.com · +49 69 870 09 5340 · docnova.ai
Explore Docnova AP Automation or the Melasoft SAP e-invoicing Add-On to connect invoice compliance with your finance workflows.