The Association of Certified Fraud Examiners published Occupational Fraud 2026: A Report to the Nations, covering 2,402 real cases investigated by certified fraud examiners across 143 countries, with total losses above $3.4 billion. Median loss per case was $104,000. The average was over $1.4 million.
What Actually Finds It
Now the number that should shape any conversation about AI and fraud. Tips accounted for 43% of detections, more than half of them from employees.
Sit with that for a moment before reading a vendor page about continuous transaction monitoring.
The single most productive detection mechanism in the profession is a person deciding to say something. Not a model, not a rule, not a reconciliation. A person.
The report supports that with a second finding that is easy to skip: 84% of perpetrators displayed behavioural red flags. Living beyond their means, unusual closeness to a vendor, refusal to take leave, control issues around their own work. None of those appear in a general ledger. No amount of transaction analysis will surface them, because they are not transactions.
More than half of cases involved internal control failures, which is a real finding about controls. It is not a finding that better analytics would have caught them.
The Number That Should Reframe the Spend
Here is where the economics sit.
The median scheme ran 12 months before detection. Schemes caught inside six months had a median loss of $40,000. Schemes that ran past five years had median losses exceeding $1.1 million.
That is a curve, and it means the expensive variable is duration rather than detection method. A fraud found in month four by a slightly awkward conversation costs a fraction of the same fraud found in year three by a beautifully engineered anomaly model.
Which points at an uncomfortable question for anyone buying AI for this purpose. Does the tool shorten time to detection, or does it add a second detection channel that mostly duplicates what tips already catch?
Where AI Genuinely Helps
There is a real answer, and it is not the one in the marketing.
Follow what happens after a tip. Somebody raises a concern about a vendor. Now a partner has to work out whether there is anything in it, which means assembling a trail: what has been paid to that vendor, over what period, against which approvals, with what supporting invoices, and whether the documents look like what they claim to be.
Today that assembly takes days or weeks in most small firms. Because it takes days or weeks, small concerns do not get examined. They get noted, and the person who raised it watches nothing happen, which is a good way to ensure the next concern is never raised at all.
Shortening that assembly from two weeks to an afternoon changes which concerns are worth checking. That does not make the software a detector. It makes it the thing that lets a detection turn into a conclusion while the loss is still in the $40,000 band rather than the $1.1 million one.
MetaWurks is built for exactly that half. It ingests the client's invoices, contracts, statements and correspondence and lets an accountant query the whole set in plain English, so tracing everything connected to a vendor across three years is a question rather than a fortnight. Role based access controls decide who can open which client's records, audit logs record who opened what and when, which matters when the enquiry itself is sensitive, and documents ingested into the platform are not used to train models or exposed to other users.
The Cheapest Control Is Still Not Software
One more figure, and it deserves to be said plainly by a company that sells software.
Organisations with fraud awareness training for staff and management had a median loss of $84,000 per case. Those without had $150,000. Employees who received training generated more than twice as many tips.
Nothing in any product catalogue beats that on cost or evidence. If a firm is choosing this quarter between a fraud analytics subscription for a client and an hour of training for that client's staff, the study is not ambiguous about which one moves the number.
Buy the software for the investigation. Run the training for the detection. Do not let a vendor persuade you that the second is what the first is for.
Join the Conversation
The last time someone in a client's business raised a quiet concern about a payment, how long did it take your firm to establish whether there was anything in it?