When a duplicate payment is not a duplicate

Finance teams often flag two identical amounts on the same day as duplicates. In forensic work, that label is a hypothesis — not a finding. Split settlements, partial refunds reversed the next morning, and mirrored feeds from two banks can look identical in a flat export.

Start with the bank reference and the approval artefact, not the amount. If both lines share one purchase order and one approval email, you likely have a true duplicate. If each line maps to a different delivery note or a staged invoice schedule, the pattern is commercial, not fraudulent.

Document the decision rule you used. External reviewers care less about the exception list and more about whether your team applied a consistent test. A short note — “matched on amount + vendor + date within 48 hours, then cleared against PO and remittance” — saves days of follow-up.

When the source systems disagree, treat the bank statement as the settlement truth and the ERP as the intention record. The forensic question is usually the gap between those two, not which system “wins.”