A finance manager at a Melbourne construction firm reconciled her Xero accounts every month without fail. The bank reconciliation report balanced perfectly — every line matched, every period closed cleanly. Then an auditor found $47,000 in duplicate payments spanning eight months, all hiding in plain sight within those "balanced" reconciliations.
The problem wasn't that she was careless. The problem was that Xero's reconciliation process confirmed the transactions existed in both places — the bank and the books — without questioning whether they should exist.
According to the ACFE's 2024 Report to the Nations, 32% of occupational fraud cases occurred because of a lack of internal controls, and organisations with fewer than 100 employees suffered a median fraud loss of $145,000. Bank reconciliation is supposed to be a key control. But when it has gaps, it becomes a false sense of security.
Here are five reconciliation gaps that cost Australian businesses thousands — and how to close each one.
In this article:
- Gap 1: Xero's Duplicate Detection Only Catches Exact Matches
- Gap 2: Bank Rules That Auto-Match Without Human Review
- Gap 3: No Monitoring of Supplier Bank Detail Changes
- Gap 4: Month-End Reconciliation Instead of Daily
- Gap 5: No Segregation Between Transaction Entry and Reconciliation
- How These Gaps Compound
- Related Reading
- Closing the Gaps
Gap 1: Xero's Duplicate Detection Only Catches Exact Matches
Xero includes a built-in duplicate detection warning that flags transactions when it spots an identical match. On the surface, that sounds like solid protection against paying the same invoice twice.
In practice, it misses far more than it catches.
Xero's duplicate check looks for exact matches on amount, date, and reference. If a supplier sends the same invoice twice with a slightly different date — or your accounts payable team enters a payment manually while the bank feed also imports it — Xero won't flag it. The descriptions differ. The dates might be a day apart. Xero treats them as two separate, legitimate transactions.
How this costs you money: Duplicate payments are one of the most common accounts payable errors. Research from the Institute of Finance and Management suggests that 0.1% to 0.5% of all AP disbursements are duplicates. For a business processing $5 million in annual supplier payments, that's $5,000 to $25,000 walking out the door — silently.
How to close it: Don't rely on Xero's built-in detection alone. Run a periodic duplicate payment scan that checks for fuzzy matches — same supplier with similar amounts within a rolling window, regardless of whether dates and references match exactly. OutflowGuard's free audit tools include duplicate bill detection that catches the near-misses Xero's native checks overlook.
Gap 2: Bank Rules That Auto-Match Without Human Review
Bank rules are one of Xero's most powerful time-saving features. You set up a rule — "any transaction from Telstra goes to account 400-Telecommunications" — and Xero applies it automatically to every matching bank feed line.
The problem is what happens when those rules age without review.
Over time, bank rules accumulate. Businesses set them up during onboarding, add more as new suppliers appear, and rarely audit the list. Rules created for a supplier who changed their trading name still match. Rules with broad matching criteria ("contains 'PAY'") catch transactions they were never intended to catch. And because rules auto-code and auto-match, nobody reviews the individual transactions.
How this costs you money: A misapplied bank rule doesn't just miscategorise a transaction — it hides it from scrutiny. If a fraudulent or erroneous payment happens to match an existing rule, it gets coded, matched, and swept into the reconciled pile without anyone looking at it.
How to close it:
-
Audit your bank rules quarterly. Go to Accounting > Bank Accounts > [Account] > Manage Rules in Xero. Delete rules for inactive suppliers and tighten matching criteria.
-
Avoid "create and auto-match" for high-value categories. For supplier payments above a threshold (say $5,000), use rules that suggest matches rather than auto-apply them.
-
Review the "auto-matched" count in your reconciliation summary each month. If the percentage is climbing while your team isn't manually reviewing more, you have a growing blind spot.
Gap 3: No Monitoring of Supplier Bank Detail Changes
This is the gap that Xero's reconciliation process simply cannot close on its own — and it's the one that leads to the largest single-incident losses.
Payment redirect fraud (also called business email compromise or mandate fraud) works by changing a supplier's bank details in your system so that legitimate payments go to a fraudster's account. The invoice is real. The amount is correct. The bank reconciliation balances perfectly. The only thing wrong is where the money went.
Xero records supplier bank detail changes in the contact's history, but it doesn't alert you when they happen. There's no notification, no approval workflow, no flag in the reconciliation process. A change made today could affect every payment to that supplier going forward — and you'd only discover it when the real supplier chases their unpaid invoice weeks later.
How this costs you money: The ACCC's Scamwatch reported that Australian businesses lost $334.8 million to scams in 2025, with payment redirection among the costliest categories. A single compromised supplier payment can easily exceed $50,000 for a mid-sized business.
How to close it: You need a monitoring layer that sits between your Xero data and your payment process. This means either:
-
Manual: Assign someone to review the History & Notes section of every supplier contact before processing payments. This works for small volumes but doesn't scale.
-
Automated: Use a tool that monitors your Xero organisation for supplier bank detail changes in real time and alerts your team before the next payment goes out. This is exactly what OutflowGuard's bank detail change monitoring does — with dual-approval workflows so changes require verification from two people before they're accepted.
Gap 4: Month-End Reconciliation Instead of Daily
Many Australian SMBs still treat bank reconciliation as a monthly task — something the bookkeeper does at month-end alongside BAS preparation and management reporting. It's understandable. Monthly feels manageable.
But monthly reconciliation creates a detection window of up to 30 days where errors, fraud, and anomalies go unnoticed.
Consider what can happen in that window. A duplicate payment made on the 3rd isn't caught until the 30th. A fraudulent transaction on the 10th has 20 days to disappear into the noise. An employee who discovers that nobody checks the bank account for weeks at a time has an open invitation to test boundaries.
How this costs you money: The ACFE's 2024 report found that proactive detection methods — including regular account reconciliation — led to 50% lower median fraud losses compared to passive discovery methods. The faster you reconcile, the faster you catch problems, and the less they cost.
How to close it:
-
Move to daily reconciliation if your transaction volume exceeds 20 per week. In Xero, this takes minutes once bank feeds are connected and bank rules are set up.
-
Set a "stale reconciliation" alert. If your Xero bank account shows unreconciled transactions older than 3 business days, something needs attention.
-
Lock reconciled periods. Once a period is reconciled, use Xero's lock date feature (Settings > General Settings > Financial Settings) to prevent backdated changes that could throw off your already-confirmed balances.
Gap 5: No Segregation Between Transaction Entry and Reconciliation
In small finance teams — and Australia has plenty of businesses where one or two people handle everything from invoicing to payments to reconciliation — the same person who creates transactions is often the same person who reconciles them.
This violates a fundamental principle of internal controls: the person who performs a transaction shouldn't be the same person who confirms it.
When one person controls both sides, reconciliation becomes a self-certification exercise. They're checking their own work against their own records. Any intentional or unintentional error passes through unchallenged.
How this costs you money: The ACFE found that more than half of all fraud cases (51%) were linked to either a lack of internal controls or management override of existing controls. In small organisations, this isn't malice — it's usually resource constraints. But the financial impact is the same.
How to close it:
-
Separate who creates and who reconciles. Even in a two-person team, split the duties. Person A enters bills and makes payments. Person B reconciles the bank account. If you truly have only one finance person, have the business owner review reconciliation reports monthly.
-
Use Xero's user permissions to enforce the separation. Set the bill-payer as a Standard user with invoice/payment access, and give Adviser-level access only to the person reviewing reconciliation reports.
-
Introduce automated oversight. Tools like OutflowGuard provide an independent monitoring layer that flags anomalies regardless of who created or reconciled the transaction. This acts as a compensating control when full segregation isn't practical.
How These Gaps Compound
These five gaps don't exist in isolation. They reinforce each other.
A business that reconciles monthly (Gap 4) with broad bank rules (Gap 2) and no supplier monitoring (Gap 3) has created an environment where a duplicate payment or redirected payment can sit undetected for weeks. Add in no segregation of duties (Gap 5) and weak duplicate detection (Gap 1), and you have a system where the reconciliation process actively masks problems rather than surfacing them.
The ACFE's data is clear: organisations with strong proactive controls — including regular reconciliation, monitoring, and segregation of duties — detect fraud faster and lose less money. The median loss for organisations with these controls was roughly half that of organisations without them.
The critical shift is in mindset. Bank reconciliation isn't just a compliance task to tick off. It's a detective control — and it only works if it's designed to catch things, not just confirm them.
Related Reading
- How Duplicate Payments Slip Through Xero (And How to Catch Them) — A deeper dive into why duplicates happen and detection strategies
- Vendor Fraud in Australian Small Businesses: The Silent Problem Costing Billions — Common vendor fraud schemes and warning signs
- What Is Cash Outflow Monitoring? A CFO's Guide to Stopping Revenue Leaks — How automated outflow monitoring works alongside reconciliation
Closing the Gaps
Xero is excellent accounting software. Its bank reconciliation workflow is genuinely well-designed for what it's built to do: matching bank feed lines to ledger entries quickly and accurately.
But matching isn't monitoring. Reconciliation confirms that transactions in your books match transactions at your bank. It doesn't ask whether those transactions were legitimate, whether a supplier's bank details were recently changed, or whether you've paid the same invoice twice with slightly different references.
Closing these five gaps doesn't require replacing Xero. It requires supplementing it — with better processes, tighter controls, and monitoring that watches for the things reconciliation was never designed to catch.
If you want to see what your Xero data reveals, OutflowGuard's free audit scans for ghost suppliers, round-number invoices, and duplicate bills across your connected organisations. No payment details required — read-only access only.