A manufacturing finance team watching a NetSuite-centred demo paused on a quieter control. Vendors resend invoices. Shared inboxes forward the same PDF twice. Someone uploads a file that already lives in the system. Duplicate detection is table stakes in AP marketing. What buyers leaned into was the lifecycle: recognize the duplicate, link it to the already approved bill, and flag when file metadata looks wrong enough to deserve a human look.
The direct answer: catch duplicates with content and file signals, link them to the surviving invoice, and surface forged or inconsistent metadata as an exception instead of silently creating a second payable.
This matters most if vendors email aggressively, if multiple clerks can upload, and if you have ever paid twice because the second PDF looked "new enough."
Why exact-field duplicate checks are not enough
ERP duplicate rules often key on invoice number plus vendor plus amount. That catches the obvious resend. It misses the near miss: slightly altered number strings, re-exported PDFs, or a second file that carries the same commercial content with different file properties.
Fraud teams care about the second class. Metadata that does not fit the story (create dates that jump, producer strings that look patched, hashes that collide oddly) is not proof by itself. It is a reason to stop and look before approve-and-pay muscle memory takes over.
The second problem after buying "we detect duplicates" is operational. Does the system link you to the already approved invoice, or does it only throw a toast message? Clerks need the prior bill in one click. Otherwise they open a parallel investigation in email.
What the research says without drama
APQC's Open Standards Benchmarking puts the median share of disbursements that are duplicate or erroneous at 1.5 percent, with top-quartile performance near 0.8 percent and bottom-quartile above 2 percent in commonly cited summaries of that measure (CFO.com / APQC coverage). Those percentages are counts of disbursements, not dollars, which is why a "small" rate still hurts.
Ardent Partners' Metrics That Matter in 2025 lists increasing fraud risk as a top challenge for 29 percent of respondents, beside high exception rates for 53 percent. Duplicate controls are not a niche nice-to-have. They are how you keep the exception pile from including cash that already left.
A practical duplicate drill
Once a month, run this without new software.
1. Export paid invoices for thirty days.
2. Cluster on vendor + amount + invoice date within three days.
3. Spot-check clusters that do not share an invoice number.
4. For any second PDF in email, compare file size, page count, and visible invoice number.
5. Ask whether your AP tool would have linked you to the first bill before payment.
If step 5 is "we are not sure," your control is a hope.
What we built
Staging shows duplicate indicators on the invoice list and a Duplicate Invoices relationship on the invoice detail that links to the other record, with exception framing. Demo narratives also include content-plus-file detection and forged metadata flags for review. The design goal is a lifecycle inside the AP object: see the dupe, open the original, decide, do not re-extract blindly.
We rejected silent suppression that hides the second file with no audit trail. Someone should be able to see that a duplicate arrived and what was done.
Who this applies to
This matters most if duplicates slip through when filenames, dates, or totals are tweaked just enough to look like a new bill.
Where this does not help
Nearly every AP vendor claims duplicate detection. If your evaluation cannot put forged-metadata or link-to-original behaviour on screen, treat the claim as undifferentiated.
Metadata flags are signals, not convictions. Odd PDF producers exist for boring reasons. Keep a human in the loop.
Deliberate choice: emphasize link-to-original and metadata review over a higher auto-reject rate. We would rather a clerk confirm than a model quietly delete evidence.
Back to the second PDF
The second PDF will arrive. Vendors are not trying to be unique. Make the duplicate obvious, link it to the first bill, and when the file looks forged, say so early enough that payment is still optional.
Resends are normal. Double pay is optional.
Vendors resend because their collections process is automated, because a clerk asked for a copy, or because portal and email both fired. The behaviour will not stop. Your control has to assume resends are normal. Linking to the already approved invoice turns a normal resend into a one-click confirmation instead of a forensic project.
What to put on the evaluation screen recording
Ask every vendor to film, with synthetic data: a second upload of the same invoice, the list indicator, the detail link to the original, and whatever metadata warning they claim. If they cannot film it, the feature is a sentence. If they can film only an exact invoice-number collision, ask about re-exported PDFs and altered filenames. Your risk is not the identical bit-for-bit resend. Your risk is the almost duplicate that still gets paid.
Credits and replacements complicate the story
Not every second PDF is a hostile duplicate. Sometimes it is a corrected invoice. Sometimes it is a credit memo that resembles an invoice. Duplicate workflows need a path to accept a replacement and void or reverse the prior path without deleting history. If your tool only offers "reject duplicate," clerks will invent side channels again.
Exception metrics should include prevented duplicates
If your KPI pack only counts posted exceptions, you will under-credit duplicate holds that never became payments. Add a prevented-duplicate count. It is an imperfect metric and still better than pretending prevention is invisible.
Content plus file is the minimum bar
Ask whether detection uses commercial content (vendor, amount, invoice number patterns) and file identity signals. Exact filename matching alone is weak. Bit-identical file hashing alone misses re-exports. Content match alone can false-positive across similar recurring bills. The combination, plus a link to the original, is the practical bar for mid-market AP.
Do not confuse duplicate bills with duplicate vendors
Alias problems create duplicate vendors. Resend problems create duplicate bills. Both can cause duplicate payments. Different controls. If your project only cleans the master, resends still land. If you only detect bill dupes, a second vendor master for the same supplier will still get paid. Run both controls.
Train clerks on the happy path for a duplicate
When a duplicate indicator appears, open the linked original, confirm whether payment already left, and document the decision on the exception. A two-minute drill in training prevents twenty-minute Slack threads later. Controls fail when people do not know the happy path for the unhappy document.
Share the linked original with auditors
When internal audit asks how you handle duplicates, show the linked original and the exception decision, not a policy paragraph alone. Evidence beats aspiration. If the product cannot produce that evidence trail, keep looking.
Frequently asked questions
Should duplicates be auto-rejected?
Auto-hold is safer than auto-delete. You need a path for legitimate replacements and credit memos that resemble invoices.
Does duplicate detection replace vendor master cleanse?
No. Two vendor masters for one supplier create duplicate risk no PDF hash will fully solve.
