## TL;DR

Invoices submitted at 2am on a Sunday deserve a look: legitimate vendors batch-submit, but off-hours activity also characterizes compromised accounts and rushed fraud. Flag off-hours submissions above a threshold, check whether the vendor normally submits then, and fold the signal into the broader anomaly score rather than blocking on it alone.

## Steps

1. Flag invoices submitted outside business hours above an amount threshold.
   Expected: A candidate list.
2. Check the vendor's historical submission pattern.
   Expected: Normal-for-them or anomalous.
3. Combine with other signals (round amounts, new vendor, bank change).
   Expected: A risk score, not a single flag.
4. Review high-score invoices before payment.
   Expected: Targeted scrutiny.
5. Tune thresholds from outcomes.
   Expected: Fewer false positives over time.

## When to use

- Fraud monitoring programs
- Off-hours submission spikes
- Compromised vendor portal investigations

## When not to use

- Approval SLA tracking
- Global vendors in other timezones (normalize first)
- Automated EDI feeds (expected off-hours)

## Compatibility

ERP-agnostic.

## Variant phrasings

### weekend invoice submission fraud

### off hours AP anomaly

### holiday invoice review

## Root cause

Attackers work when defenders do not, and compromised vendor portals get used at odd hours. Timing is a weak signal alone but a useful one in combination.

## Edge cases

- Normalize to the vendor's timezone before flagging
- EDI and API submissions are routinely off-hours; exclude by channel
- Month-end rushes create legitimate off-hours volume

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_vKLtCUDek9EJt3JCmRQo8w