What is Benford's law, and how does it help catch fraud?

Benford's law describes how the first digits of numbers are distributed in genuine, naturally occurring data. The digit 1 should lead about 30.1 percent of the time, the digit 2 about 17.6 percent, and each later digit from 3 to 9 less often. Fraud examiners compare the leading digits in records such as invoices or payments with this pattern. A large mismatch suggests that the numbers may not be genuine and deserve a closer look. [1] [2]

According to the Arizona Auditor General, the law holds that within large sets of real-life numbers, such as invoice amounts, values are statistically more likely to begin with small digits like 1 or 2 than with large digits like 8 or 9. Plotted as a chart, the expected frequencies form a steeply falling shape that is sometimes called the Benford curve. Accountants can count leading digits in Excel and compare the result with that curve. [2] [1]

The Association of Certified Fraud Examiners distinguishes natural numbers from non-natural ones. Natural numbers, such as payment amounts, are not assigned under a numbering scheme and are not human-generated or produced by a random number system. Non-natural numbers, such as postal codes and telephone numbers, are designed to convey information, so the test does not suit them. [3]

The ACFE explains the idea this way: someone submitting fake invoices tends not to choose small amounts and may favor figures like $800 or $900. Repeated often enough, this disturbs the natural pattern. In the ACFE's example, a test of April payments finds that 35 percent begin with 9, although the law expects about 4.6 percent. [3]

Approval thresholds are another common target. A bookkeeper writing fictitious checks might stay under a $500 or $1,000 limit, which would make 4 and 9 appear too often as leading digits. An ISACA article gives a similar case: if loans of $50,000 or more go to a committee, an excess of amounts starting with 4, or with 49, could point to loan fraud. In the HealthSouth fraud, staff created thousands of fraudulent journal entries just below a $5,000 testing threshold, which is the kind of mechanism this testing can direct auditors toward. [1] [4] [5]

The Arizona report describes two tests. The first-digit test is a high-level reasonableness check that finds only obvious anomalies. For example, if 25 percent of 5,000 vendor invoices began with 4 where about 9.7 percent is expected, that group is anomalous. The first-two-digits test then narrows the focus to a smaller subset, giving a more efficient sample for investigators. [2]

The results are not proof. The Journal of Accountancy says the analysis can never definitively prove the presence or absence of fraud; it only helps gauge whether more investigation is warranted. Deviations may also come from innocent causes, such as processing inefficiencies or many repeated per diem travel allowances. [1] [5]

The data must also be suitable. Each digit from 1 to 9 must have an equal chance of leading, or the law does not apply. Larger data sets work better. The law has been shown to hold for sets as small as 50 to 100 numbers, but some experts prefer 500 or more. The author of the 2017 article notes that some accountants use z-scores to set thresholds, while he considers a visual check of the chart sufficient to raise concerns. That is his own opinion, and practice varies. [1]