MosoFin · duplicate invoice detection, in plain words

Did I pay the same bill twice?

A supplier chases a bill you already paid. Someone enters it again, and the money goes out a second time. This skill reads your bills, your payments, your supplier records and your open credits. It finds the bill that went out twice, before or after the money left.

The 20-second version

You give it a period. It reads every bill and every payment in a wider window, and runs ten tests on them. Each match gets a confidence level and a reason. It lists the unpaid duplicates first, because you can void those at no cost. One test, the bank-account test, cannot run here. The skill says so on every result. It never voids a bill, never merges a supplier and never asks a supplier for money.

What a scan finds

One scan of Northbrook Trading: four months of bills

Northbrook reviews September. The skill scans 1 July to 31 October, a wider window, because a duplicate often sits on each side of a month end. It reads 1,284 bills from 212 suppliers, including 9 inactive supplier records, 1,197 payments and 14 open credits. It finds six groups of records that look like the same bill. The skill calls each group a cluster.

Example figures for a made-up company. Under Standard sensitivity the skill flags clusters A, B and C: 1,250.00 + 4,860.00 + 3,200.00 = 9,310.00. Clusters A and B were paid twice: 1,250.00 + 4,860.00 = 6,110.00. Under Strict sensitivity it also flags D and E: 980.00 + 950.00 = 1,930.00 more, 11,240.00 in total. The $410.00 credit is not a duplicate. The skill reports it on its own, as money that Harbor owes Northbrook.

The mistakes it catches

"We check each bill when it arrives, so nothing goes out twice"

The usual control is a person who looks at each bill as it comes in. That person sees one bill at a time. A duplicate looks like any other bill, because it is a copy of a real one. The skill compares every bill with every other bill in the window. In this example it finds three things the one-at-a-time check missed.

What the skill does

Every bill against every other bill, and every payment against every bill

Harbor INV-0442, entered on 3 Sep and again on 19 Sep$1,250.00

Crestline INV-7731, paid by cheque on 22 Aug and by ACH on 4 Sep$4,860.00

Pinnacle INV-2210, under two supplier records, one open$3,200.00

Credit note CN-0011, never used$410.00

The skill lists the open Pinnacle bill first. A person voids it before payment, and the $3,200.00 never leaves. For Harbor and Crestline it proposes a recovery: a credit on the next invoice, or a refund.

The common shortcut

Pay each bill as it comes in

Harbor's second copy of INV-0442 looks like a new billpaid

Crestline's reminder gets a second payment by ACHpaid

Pinnacle's open bill waits for its turndue

The $410.00 credit stays with Harborunused

$6,110.00 left twice. $3,200.00 more is about to. Harbor still holds $410.00 of your money.

The same number, twice

Harbor INV-0442, $1,250.00

The same supplier and the same invoice number is the strongest signal the skill has. It flags this match at Very High confidence, even when the dates or the amounts differ a little. Both copies were paid, so $1,250.00 went out twice. The skill proposes a credit on Harbor's next invoice as the first option, and a refund as the second.

Two channels, one bill

Crestline INV-7731, $4,860.00

The bill list shows INV-7731 once. The payment list shows it paid twice: a cheque on 22 August and an ACH transfer on 4 September. A search of the bills alone cannot find this. The skill reads the payments as well, with the method of each one. The paper trail, the cancelled cheque and the ACH record, shows both payments. The IRS tells a business to keep such documents in an orderly way, by year and by type⁴.

One supplier, two records

Pinnacle INV-2210, $3,200.00

Pinnacle Design exists twice in your vendor master, your list of supplier records. INV-2210 sits under each record. One copy was paid and one is still open. The skill reports two findings from one match: a supplier record to merge and a duplicate bill. A person voids the open copy, and the $3,200.00 never leaves. The skill proposes the merge and never does it. In QuickBooks a merge moves the duplicate's history to the record you keep and makes the duplicate inactive. To bring a merged supplier back, you must create its profile again by hand².

A credit nobody used

Harbor CN-0011, $410.00

Harbor gave Northbrook a credit note on 12 September. Since then Northbrook paid three later Harbor invoices in full. Nobody used the credit. This is not a duplicate. It is $410.00 that Harbor owes Northbrook. The skill reports it on its own, at the top, so it does not hide among the duplicates.

Why the scan runs every month

A false bill can run for a year and a half before anyone sees it

Most duplicates are honest errors. Some are not. A fraud study of 1,921 cases found a billing scheme, false or inflated invoices, in 424 of them, which is 22%¹. The skill does not know which kind it found. It reports the cluster, the rule and the confidence, and a person decides.

Median loss$100,000The median loss in a billing scheme, in the same study¹

Time to detection18 monthsHow long a billing scheme typically ran before detection, against 12 months for all frauds¹

Caught early$30,000Median loss when a fraud was caught within six months. Frauds that ran two to three years had a median loss of $250,000¹

The study counts frauds of every kind. It does not say how often a duplicate scan finds one. The skill's own files say to save each cleared cluster between runs. Without that list, the same false alarms return every month and nobody reads the report.

The ten tests

Ten rules, from the surest to the weakest

The skill runs each rule in this order. The confidence level says how strong the evidence for a match is. Your sensitivity setting decides which levels count as flagged: Standard flags High and Very High, Strict adds Medium, and Permissive flags Very High only. The skill prints the setting on every result, because a clean result under Permissive means something very different from one under Strict.

Rule	What it looks for	Confidence	Runs here?
1	Same supplier, same invoice number	Very High	Yes
2	Same supplier, same amount, same date, different invoice numbers	High	Yes
3	Same supplier, same amount, dates within 7 days (you can change the window)	Medium	Yes
4	Same amount, supplier names that look alike, such as "Acme Corp" and "Acme Corporation"	Medium	Yes
5	An invoice number out of sequence, such as one lower than numbers already paid	Medium-Low	Yes
6	Same invoice number under two supplier records	High	Yes
7	Two supplier records that share one bank account. The fraud test.	High	No. Reported as not run, with an owner.
8	Round amounts that repeat in a short window	Low	Yes
9	One bill paid through two channels, such as a cheque and a wire	High	Yes, when the payment list has the method
10	A credit note never used while later bills were paid in full	Low	Yes. Reported as money owed to you

Rule 4 scores how alike two names are, from 0 to 1. The score gives extra weight to names that start the same way³. The skill flags a pair at 0.85 or above and shows the score, so a person can judge it. Acme Corp and Acme Corporation scored 0.91. Rule 3 found Summit Cleaning's $950.00 on 1 September and 6 September, five days apart. It did not flag the 1 October invoice: a bill 30 days later is a monthly pattern, not a duplicate.

One honest limit

A clean scan never means the fraud test passed

Rule 7 looks for two supplier records that pay into one bank account. That is either one supplier entered twice or a fraud set up on purpose. It is the one rule aimed at fraud, and it is the one rule this skill cannot run. MosoFin does not expose supplier bank details, on purpose, because bank details are the main target in payment fraud. So the skill reports Rule 7 as not run. It names the person or team who runs the test in your banking or payables system. Northbrook's result says: Rule 7 not run, owner the bank's payments team. The rules-run sheet shows 9 rules ran and 1 did not.

Two outside facts show why the skill will not stay quiet about it. In 2024 businesses reported $2,770,151,146 lost to business email compromise, a fraud by email, in 21,442 complaints. A supplier's compromised email account is one way the fraud worked⁵. The standard control is to keep approving, paying and recording with different people, which helps prevent fraud, waste and abuse⁶. The skill does not replace either. It tells you, every time, that the bank-account test is still yours to run.

How a run starts

It asks six questions before it reads anything

Use MosoFin for this run, or upload the data yourself?
MosoFin is the connection to your books and the other platforms you link. With it, the skill reads your bills and payments from there. Without it, you upload the files and the ten rules stay the same. The skill asks only if your account has a MosoFin connection.
Which period should the scan cover?
The skill never picks a period for you. It proposes a window wider than the month you review, and says that it proposed it. A duplicate often sits on each side of a month end, and a pair across a year end is a known fraud pattern.
Which suppliers bill the same amount on purpose every month: rent, subscriptions, retainers?
Those are the main source of false alarms. Without your list the skill runs Rule 8 anyway, and says that it may flag bills that are fine.
Strict, Standard or Permissive? And a window for Rule 3, if not 7 days?
The setting decides which confidence levels count as flagged. Without an answer the skill uses Standard and 7 days, and prints both on the result.
Who runs the bank-account test, Rule 7, in your payables or banking system, and how often?
The one rule aimed at fraud, and the one this skill cannot run. Without a name the skill leaves the owner column open, and says so before it reports anything.
Do you have results from an earlier scan: clusters you already reviewed and cleared?
Without them the same false alarms come back every month. The skill scans without them and offers to save the cleared clusters at the end.

Then it reads your answers back and waits for your yes:

"Scanning Northbrook Trading's bills and payments from 1 July to 31 October. That is a wider window than September, the month under review. I read them from your Mosofin connection, with inactive vendor records included. Sensitivity Standard, Rule 3 window 7 days. The landlord, the insurer and three software suppliers are on the recurring list. Rule 7 is not run here. Your bank runs it. Shall I go ahead?"

What you need

Connect once, or upload two files and two lists

Connected with MosoFin

Say yes to the read-back

It reads every bill in the window, page by page to the end, and states the count
It reads every payment with its method, for Rule 9
It reads your supplier records, inactive ones included
It reads your open credit notes, for Rule 10
If you run several companies, it asks whether to scan across them. One bill paid by two companies is invisible to each company's own scan

Uploading instead

Bring the bills and the payments

Bill list (CSV or XLSX): every bill in the window, with supplier, invoice number, date, amount, order reference and status. Required
Payment list (CSV or XLSX): what was paid, when, and how. Required for Rule 9 and for paid status
Supplier records, inactive ones included, with payment addresses. Recommended, the look-alike rules need it
Open credit notes. Recommended, Rule 10 needs it
Your recurring-supplier list, sensitivity, Rule 3 window and cleared clusters, typed in the chat

What you get back

Seven sheets: the clusters, the money, and what ran

The summaryThe period, and how many records it scanned against how many exist. The total flagged and the exposure by confidence, paid against open, and the sensitivity used.

Every cluster, side by sideEach group of records with its rule, its confidence, the amount per record, the cluster total and the paid status. The records sit next to each other, so a person can agree or dismiss in seconds.

The detailEvery field the skill used to match: the raw and cleaned supplier name and invoice number, the date, the amount, the payment method and date.

Suppliers to mergeEach pair of supplier records that look like one supplier, with the record to keep and the reason. Proposals only.

The recovery planPer cluster, the action and the contact. Unpaid duplicates first, because voiding one costs nothing.

Rules runWhich of the ten rules ran, over how many records, and what each found. Rule 7 appears as not run, with its owner. This sheet is what makes "no duplicates found" a statement you can defend.

CoverageFor each task, which tool read the data, how many records it read, and any gap.

It asks whether you want the sheets as an Excel file before it makes one. If you say no, you get the same sheets as tables in the chat.

What it never does

Never reads your books without asking. A connected account is not permission.
Never reads anything before you answer the six questions and say yes to the read-back.
Never voids a record, merges a supplier, or asks a supplier for money. Every action is a proposal for a person.
Never picks the period or the company for you. The scan window is wider than the month you review, and the result says how many records it scanned against how many exist.
Never reports a rule that did not run as finding nothing. Rule 7 appears in every result as not run, with its owner. The sensitivity setting is on every result.
Never saves bank details, bill-level data, or a suspicion attached to a named person. A duplicate is usually an error. It saves cleared clusters and supplier settings, and only when you say yes.

Words you'll hear

Eight terms, in plain English

AP register: The list of supplier bills and what you paid against them. AP is short for accounts payable, what you owe suppliers.
Vendor master: Your list of supplier records. A vendor alias is one supplier that exists under more than one record.
Duplicate payment: The same bill paid twice. The copies can carry the same invoice number, or a changed one, or sit under two supplier records.
Cluster: A group of records that the skill suspects are the same bill. Each cluster carries one rule and one confidence level.
Confidence level: How strong the evidence for a match is, from Very High to Low. Each of the ten rules has a fixed level.
Sensitivity: How eagerly the scan flags. Strict flags more, Permissive flags less, and Standard sits between. The result always says which one ran.
Similarity score: A number from 0 to 1 that says how alike two names are, with extra weight when the first characters agree. The US Census Bureau developed it to match names and addresses between records³. The skill's threshold is 0.85.
Credit note: A document from a supplier that reduces what you owe. One left unused while you pay later bills in full is money the supplier owes you.

Sources

Where the facts on this page come from

The sources are a fraud study, the accounting software's own help and a US statistical method paper. The others are an IRS publication, an FBI report and a US control standard. We checked each one on 27 October 2026 official source pages. We reviewed each linked source on 27 October 2026; follow the link for the latest wording. What the skill does comes from the skill's own files.

ACFE: Occupational Fraud 2024: A Report to the NationsBilling schemes, invoices for false or inflated goods or services, appeared in 424 of the 1,921 cases, 22%. The median loss was $100,000. A billing scheme typically ran 18 months before detection, against 12 months for all frauds. Frauds caught within six months had a median loss of $30,000. Those that ran two to three years had a median loss of $250,000.
Intuit: Merge duplicate vendors in QuickBooks OnlineA merge moves the duplicate's past transactions to the vendor you keep and makes the duplicate inactive. To bring a merged vendor back you must create the profile again by hand. Vendors merge in pairs.
US Census Bureau: Overview of Record Linkage and Current Research Directions (Winkler, 2006)The Jaro-Winkler comparator scores how alike two strings are, from 0 to 1, with extra weight when the first characters agree. The Census Bureau developed it to match names and addresses between records.
IRS: Publication 583, Starting a Business and Keeping RecordsPurchases and other transactions create supporting documents such as paid bills, invoices, receipts and cancelled cheques. Keep them in an orderly way, by year and by type. Keep a record that supports an item on a return until the period of limitations for that return ends.
FBI IC3: 2024 Internet Crime ReportVictims reported $2,770,151,146 lost to business email compromise in 2024, across 21,442 complaints. A compromised vendor email account is one of the ways the scheme worked.
GAO: Standards for Internal Control in the Federal Government (Green Book), GAO-25-107721When different people hold the authority to approve, the custody of the asset and the accounting, the split helps prevent fraud, waste and abuse.

No outside authority backs the ten rules, their order or their confidence levels. The same is true of the 0.85 threshold, the 7-day window, the three sensitivity settings and the seven sheets. They are the skill's own rules.

About this skill

This page explains duplicate-invoice-detection, from the MosoFin finance skills library, MosoFin/mosofin-finance-skills on GitHub. Read the skill on GitHub → Want the worked examples? Learn it step by step →