Why fraud concentrates in these two functions
Procurement and ground handling share three properties that make them attractive to fraud: high transaction volumes, dispersed authority, and services that are hard to verify after the fact. Nobody can re-count how many loaders worked a turnaround last Tuesday in an outstation six time zones away. Nobody re-weighs the deicing fluid. The airline pays on documents — timesheets, uplift slips, invoices — produced largely by the counterparty, checked locally by a small team that knows the supplier personally.
Fraud in these functions is therefore rarely a single dramatic act. It is a rate applied quietly to a high-volume flow: a small uplift on every fuel docket, a few phantom names on every manpower roster, a service billed at contract-plus on every invoice. Individually immaterial, cumulatively significant, and invisible to any control that examines transactions one at a time.
Procurement: the recurring patterns
In procurement, most schemes are variations on defeating competition or defeating the approval hierarchy. The indicators worth building analytics around:
- Split purchase orders — sequences of POs to the same vendor, each just below an approval threshold, raised within days of one another. Threshold-clustering analysis across the full PO population exposes this in minutes.
- Single-bid and repeat-winner awards — tenders where only one bid arrived, or where the same vendor wins against the same losing bidders repeatedly. The losing bids often exist only to make the file look competitive.
- Specification steering — requirements written so narrowly that only the favoured vendor qualifies; visible when the specification matches a vendor's catalogue language.
- Vendor-master anomalies — suppliers sharing bank accounts, addresses or directors with other suppliers or with employees; dormant vendors reactivated shortly before large payments.
- Emergency purchases as habit — a station or department whose "urgent, non-competed" purchase rate is persistently above its peers.
Ground handling and stations: where verification fails
Station schemes exploit the gap between service delivered and service documented. Ghost manpower — billed staff who never worked — survives because the airline's local representative signs rosters they cannot practically verify. Fuel-uplift manipulation survives because flight-by-flight uplift is rarely reconciled against flight plans, aircraft type burn profiles and remaining-fuel figures. Billing beyond contract survives because the invoice checker at the station has often never seen the master agreement negotiated at head office, and pays rates the contract does not contain — extra equipment hours, weather surcharges, "additional services" with no defined price.
Most station fraud does not defeat the control. It exploits the fact that the person operating the control was never given the means to operate it.
The pattern to notice: in each case the airline holds data that would expose the scheme — movement records, load sheets, flight plans, the contract itself — but that data never meets the invoice. Catering, deicing and into-plane fuelling follow the same logic: whatever is billed per flight, per litre or per unit consumed deserves a reconciliation against an operational record the supplier does not control.
The tests that expose them
A focused fraud-analytics programme over these functions does not require sophisticated tooling. It requires joining datasets that currently live apart:
- Invoiced turnaround services against actual aircraft movements — you cannot be billed for handling a flight that did not operate, yet unmatched billings appear wherever this test is run for the first time.
- Billed manpower hours against flight schedules and typical crew-per-turn norms, by station, trended over time.
- Fuel uplift per sector against flight-plan fuel, by route and aircraft type, flagging stations whose variance sits persistently high.
- Invoice rates against contract rate cards, line by line, with every undefined charge code surfaced for review.
- PO value distributions against approval thresholds, and vendor-master fields against employee records.
These tests work best run continuously rather than as a one-off review, because the schemes they detect are continuous. A quarterly exception report, owned outside the function it examines, changes behaviour even before it catches anyone: rates drift back towards contract when suppliers learn the invoices are being read against it.
When an indicator fires
An indicator is not an accusation. Most exceptions have innocent explanations — schedule disruption, contract variations agreed by email, genuine emergencies. The discipline is to treat indicators as triage, escalate patterns rather than single hits, and move to formal investigation — with evidence preservation, legal involvement and interview protocol — only once a pattern survives the innocent explanations. Airlines that skip this discipline either drown in false positives or, worse, alert the subject before the evidence is secured.
Where to start
Pick one station and one quarter. Obtain the handling invoices, the contract, and the movement log, and reconcile all three. This is a two-week exercise with a small team, and it answers the only question that matters at the outset: does our documentation match what actually happened? The answer determines whether you need better invoice controls, a continuous-monitoring build — or an investigation.