Benford's Law: The First-Digit Test That Catches Fake Invoices in Your Books

About 30 percent of the numbers in your accounting system should start with the digit 1. Not 11 percent — 30 percent. And only about 5 percent should start with 9. If that sounds wrong, you are in good company: most people assume each leading digit shows up roughly equally often. That wrong intuition is exactly what makes Benford's law one of the cheapest fraud-detection tools a small business can run — because whoever invents fake numbers in your books almost certainly shares it.

This guide explains what Benford's law says, why fabricated invoices and expense reports fail it, which of your accounts are worth testing, and how to run a first-digit test on your own data with nothing fancier than a spreadsheet.

What Benford's Law Actually Says​

Benford's law describes how the leading digits of numbers cluster in naturally occurring datasets: small leading digits appear far more often than large ones, following a logarithmic pattern rather than an even split. The probability that a number starts with digit d is log10(1 + 1/d), which produces this expected distribution:

The pattern has held up across a remarkable range of data: river lengths, street addresses, electricity bills, stock prices, and — most usefully for you — accounting transactions. Astronomer Simon Newcomb noticed it first in 1881, when he observed that the early pages of logarithm tables wore out faster than the later ones. Physicist Frank Benford tested it rigorously in 1938 across more than 20,000 numbers drawn from 20 different datasets and published the result as "The Law of Anomalous Numbers."

The accounting connection came decades later. In the 1990s, researcher Mark Nigrini showed that Benford's law could be applied to audit data as an analytical procedure, work the Journal of Accountancy has covered as a practical fraud-detection technique for auditors. Today, external auditors routinely run digit analysis over client transaction files — and there is nothing stopping you from running the same test on your own books first.

Why Fraudsters Fail the Digit Test​

The power of the test comes from human psychology. When people invent numbers — a padded expense report, a fictitious vendor invoice, a backdated sales figure — they try to make the numbers look "random." But their mental model of random is roughly uniform: each digit feels like it should appear about 11 percent of the time. Real financial data never looks like that.

Fabricated numbers tend to show a few telltale signatures:

Too even a spread. Invented amounts distribute leading digits far more uniformly than the steep 30-to-5 slope Benford predicts. Too many 7s, 8s, and 9s leading amounts is a classic sign that someone typed what "looked right."

Too many round numbers. Real invoices land on odd totals — $1,847.20, $312.55 — because quantities multiply by unit prices and tax gets added. A cluster of clean $500 or $1,000 amounts, especially from one vendor or one employee, deserves a second look.

Threshold clustering. This is the most actionable pattern for a small business. If your policy requires a second signature above $500, watch the $400-to-$499 band. Employees splitting purchases to dodge approval, or a bookkeeper keeping fraudulent invoices under the review limit, pile extra transactions onto leading digit 4. The digit test turns your approval threshold from a control into a tripwire.

Repeated favorites. People unconsciously reuse digit combinations they like. A first-two-digits test (checking the leading pair, 10 through 99, against expected frequencies) can surface one employee whose "random" amounts keep starting with the same pair.

None of these patterns proves fraud. Each one is a reason to pull the underlying paperwork for a closer look — which is precisely what a good screening test should do.

Which Accounts Are Worth Testing​

Benford's law only works on the right kind of data. The rule of thumb: the numbers must occur naturally, span multiple orders of magnitude, and be free of built-in minimums, maximums, or assigned sequences. Here is how common small-business data sorts out.

Good candidates​

Accounts payable and vendor invoices. The single best target. Invoice totals arise from quantities, rates, and taxes multiplying together across vendors of very different sizes — textbook Benford conditions. Run this file first.

Employee expense reports. Meals, mileage, lodging, and supplies vary widely and are entered by many hands. Fabricated or inflated expenses distort the digit pattern quickly.

Sales and revenue transactions. Customer invoices and point-of-sale totals generally conform well, making them useful for spotting backdated or invented sales — or an employee skimming cash sales and covering the gap with made-up figures.

Refund and credit memos. Small in volume but high in risk: fake refunds to a personal card are a perennial small-business scheme, and the amounts are whatever the perpetrator typed.

Poor candidates — skip these​

Payroll. Net pay clusters around salary bands and hourly rates, so it will fail the test for innocent reasons. Test payroll with other controls (headcount reconciliation, ghost-employee reviews), not digit analysis.

Assigned numbers. Check numbers, invoice numbers, purchase-order numbers, and account numbers are sequential by design. Testing them is meaningless.

Constrained amounts. Per-diem payments capped at a fixed rate, subscriptions billed at one price tier, or inventory priced at $9.99 price points all carry artificial floors, ceilings, or spikes. A $9.99-heavy catalog will show a mysterious surplus of 9s that reflects pricing strategy, not fraud.

Small files. A few dozen transactions cannot produce a statistically meaningful distribution. Aim for at least several hundred records spanning multiple orders of magnitude — tens of dollars through tens of thousands — so every leading digit has room to appear at its natural rate.

How to Run a First-Digit Test in a Spreadsheet​

You do not need audit software. The whole procedure takes under an hour the first time and minutes once you have a template.

Step 1: Export a full year of one transaction type​

Pull 12 months of accounts payable (or expenses, or sales) from your accounting system: date, vendor or customer, description, and amount. One transaction type per test — mixing AP with payroll muddies the distribution. Export every record, including voids and corrections; filtering first can hide exactly what you are hunting.

Step 2: Clean the amounts​

Work on a copy. Take absolute values so refunds and credits do not break the digit extraction, and drop zero-amount rows. If your export includes a handful of enormous outliers (a building purchase sitting in AP, for example), note them but leave them in for the first pass — removing data before you understand it is how findings get explained away.

Step 3: Extract the leading digit​

Add a column with a formula that grabs the first digit of each amount. In Excel or Google Sheets, if amounts start in cell A2:

LEFT(TEXT(ABS(A2),"0"),1)

This strips the sign, drops decimals, and returns the leading digit as text. Fill it down the whole column.

Step 4: Tally and compare​

Count how many amounts start with each digit 1 through 9 (COUNTIF does this in seconds), convert each count to a percentage of the total, and set the results beside the expected Benford shares from the table above. A simple bar chart — your percentages against the expected curve — makes deviations jump off the screen. Auditors formalize the comparison with statistical tests, but for a first pass, eyeballing a chart of several hundred transactions is enough to spot a digit running far above its expected share.

Step 5: Drill into the spikes​

Suppose digit 4 comes in at 18 percent instead of the expected 9.7 percent. Filter your export to amounts starting with 4 and look at what is actually there: Which vendors? Which employees entered them? Do the amounts cluster just under an approval limit? Are the same totals repeating? Each answer either clears the spike (a legitimate bulk supplier billing $400-range invoices monthly) or deepens it (eleven $480 invoices from a vendor nobody has heard of).

For a finer lens, extend the test to the first two digits — the leading pair of each amount, from 10 to 99 — and look for individual pairs running hot. Pairs like 48 and 49 lighting up together is the classic signature of under-the-threshold splitting.

Reading the Results: Red Flags vs. False Alarms​

A deviation is a lead, not a verdict. Before confronting anyone, rule out the innocent explanations auditors see most often:

Approval thresholds you forgot about. Any policy limit — $500 needing a manager sign-off, $1,000 needing yours — reshapes behavior around it. Legitimate employees bunch purchases just under limits too. The spike tells you where to look, not what you will find.

Price points and rate cards. If your catalog leans on $19, $29, and $99 price points, expect extra 1s, 2s, and 9s. If one supplier dominates a digit band with a standard monthly charge, that is concentration, not fabrication.

Thin data. Files under a few hundred records, or amounts spanning only one order of magnitude (everything between $100 and $999), wobble around the expected curve by chance. Re-run quarterly as the file grows rather than over-reading a small sample.

One honest giant. A single recurring payment — monthly rent of $4,200 hitting digit 4 twelve times — can tilt a small file. Segment recurring fixed payments out and test the variable remainder separately.

When a spike survives all four explanations, treat it as the starting point of a real inquiry: pull the invoices, verify the vendors exist independently of whoever entered them, check for duplicates and sequential invoice numbers from the same supplier, and confirm the goods or services were actually received.

What to Do When the Digits Look Wrong​

Finding a suspicious pattern puts you at the beginning of a process, not the end of one. Work it carefully:

1. Preserve first, question later. Save a copy of the export and the underlying records before anything can be "corrected." If your books live in version control, this step is already done.
2. Verify vendors independently. Look up unfamiliar suppliers outside your accounting system — a web search, a phone call to a number you find yourself, a check that the remit-to address is not someone's apartment. Fictitious-vendor schemes are among the most common small-business frauds precisely because creating a vendor record is easy.
3. Follow the approval trail. Who created the vendor, who entered the invoice, who approved it? Fraud concentrates where one person controls too many of those steps.
4. Fix the control, not just the instance. Segregate duties so the person who can add a vendor cannot also approve payments to them. Lower or stagger approval thresholds if splitting is the pattern. Require original receipts — not photocopies — for expenses above a set amount.
5. Know when to escalate. If the amounts are material or the pattern points at someone with system access, bring in your CPA or a fraud examiner before tipping anyone off. Occupational fraud runs for months before detection on average, so a careful week of quiet verification beats a hasty accusation.

And remember the base rates that make this worth your time: in the Association of Certified Fraud Examiners' 2024 Report to the Nations, asset misappropriation — billing schemes, skimming, fake refunds — appeared in 89 percent of occupational fraud cases studied, with a median loss of $120,000. Small businesses, with fewer segregated duties and thinner oversight, absorb these losses hardest.

Clean Books Make the Test Possible​

Here is the quiet prerequisite none of the steps above works without: complete, consistently categorized transaction data. A digit test run on half-entered expenses, lump-sum "miscellaneous" postings, and three months of unreconciled bank feeds will produce noise, not signal. Every uncategorized transaction is a place for a fabricated one to hide.

That is the deeper argument for keeping your books current and granular all year — not just at tax time. When every invoice is entered promptly, coded to the right account, and tied to a real vendor record, analytical checks like Benford's law actually bite: anomalies stand out because the baseline is trustworthy. Pair the digit test with a regular visual review — charting spend by vendor or category, the kind of dashboard view Fava's reports provide, makes a new payee or a swelling category obvious at a glance. And if you are starting fresh, the Beancount documentation walks through setting up a plain-text ledger where every transaction is explicit, dated, and reviewable.

Keep Your Books Fraud-Resistant from Day One​

Running a first-digit test once a year costs you an afternoon and can surface the billing scheme or padded expenses that would otherwise run quietly for years. But the test is only as good as the data underneath it — and that data is only as good as your bookkeeping habit. Maintaining clear, complete financial records is the control every other control rests on. Beancount.io offers plain-text accounting that gives you complete transparency and control over your financial data — no black boxes, no vendor lock-in. Get started for free and build the kind of clean, auditable books that make fraud easy to spot and hard to hide.