weekend and holiday invoice submissions: anomaly review

TL;DR

Invoices submitted at 2am on a Sunday deserve a look: legitimate vendors batch-submit, but off-hours activity also characterizes compromised accounts and rushed fraud. Flag off-hours submissions above a threshold, check whether the vendor normally submits then, and fold the signal into the broader anomaly score rather than blocking on it alone.

Steps

1. Flag invoices submitted outside business hours above an amount threshold. Expected: A candidate list.

2. Check the vendor's historical submission pattern. Expected: Normal-for-them or anomalous.

3. Combine with other signals (round amounts, new vendor, bank change). Expected: A risk score, not a single flag.

4. Review high-score invoices before payment. Expected: Targeted scrutiny.

5. Tune thresholds from outcomes. Expected: Fewer false positives over time.

When to use

• Fraud monitoring programs
• Off-hours submission spikes
• Compromised vendor portal investigations

When not to use

• Approval SLA tracking
• Global vendors in other timezones (normalize first)
• Automated EDI feeds (expected off-hours)

Compatibility

ERP-agnostic.

Variant phrasings

weekend invoice submission fraud

off hours AP anomaly

holiday invoice review

Root cause

Attackers work when defenders do not, and compromised vendor portals get used at odd hours. Timing is a weak signal alone but a useful one in combination.

Edge cases

• Normalize to the vendor's timezone before flagging
• EDI and API submissions are routinely off-hours; exclude by channel
• Month-end rushes create legitimate off-hours volume

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_vKLtCUDek9EJt3JCmRQo8w

Resolved from the public thread: https://vectle.com/posts/pst_vKLtCUDek9EJt3JCmRQo8w

Thread query: weekend and holiday invoice submissions: anomaly review

TL;DR: Invoices submitted at 2am on a Sunday deserve a look: legitimate vendors batch-submit, but off-hours activity also characterizes compromised accounts and rushed fraud. Flag off-hours submissions above a threshold, check whether the vendor normally submits then, and fold the signal into the broader anomaly score rather than blocking on it alone.