AI-made receipts on contractor invoices: check the purchase, not the picture

A vendor sends an invoice for a unit turn. Labour, plus materials at cost with a markup, and for the materials a photo of the receipt: a big-box store, a date, a list of paint, patch and trim, a total. You check that the total matches the invoice line, you approve it, and the owner pays.

That photo was always the weakest document in the pile. It is now one of the easiest to fake.

This is not legal advice.

What the expense-fraud numbers say, and what they do not

The clearest figures come from the corporate expense world, not from property management. AppZen, which audits employee expense reports, said in June 2026 that among the receipts its platform flagged as fake, the share that were AI-generated went from zero in March 2025 to 70.8% by mid-May 2026: 1,471 receipts from 745 employees at 174 companies, as reported by Accounting Today on 23 June 2026.

Three honest caveats before anyone quotes that at a vendor:

• It is a share of the fakes that were caught, not a share of all receipts. It says AI has replaced the old template sites as the way people fake a receipt. It does not say 70% of receipts are fake.
• It is one company’s own platform data, about employees claiming expenses, not contractors billing materials. We could not check it independently.
• The receipts it describes are small: $148,143 across 1,471 receipts, about $100 each on average.

That last point is the one that carries over. Most management agreements set a dollar limit under which you approve repairs without calling the owner. A padded materials line lives under that limit, in the pile nobody re-reads.

What the file can tell you

When ChatGPT or OpenAI’s API makes an image, OpenAI says it embeds Content Credentials (the C2PA standard) in the file, naming the tool that made it. If the receipt image reaches you as that original file, our checker reads those credentials and tells you the file names its maker.

Here is how often that will help you with a receipt: rarely, and you should plan on never.

• A screenshot of the image carries none of it.
• A receipt pasted into a PDF invoice is a new file. Our checker does not read PDFs at all.
• Printing it and photographing the print gives you a genuine phone photo of a fake receipt, complete with a real camera, a real exposure and a real capture time.
• OpenAI itself says the metadata can be removed by platforms, editing tools and file conversions.

We should also say plainly: we have not yet run a receipt made in ChatGPT through our own checker. We read Content Credentials from real signed files and from files built to the specification, and the checker names OpenAI when that name is in the file. A real ChatGPT receipt is the test we have not done.

So a receipt that comes back with nothing on it proves nothing. That is true of every photo, and it is especially true of a document that was probably screenshotted twice before it reached you.

Why not just look for the tells?

Plenty of articles list signs of a fake receipt: fonts that do not match the chain, tax that does not add up, a store number that does not exist, crumples that look painted on. Check the arithmetic, by all means. It costs nothing.

But do not build your process on how a receipt looks. The tells are an arms race, the good fakes do not have them, and a check that clears a receipt because it looked right is worse than no check, because now it has your approval on it.

The check that works: ask the supplier, not the image

A receipt is a claim that a purchase happened. The purchase, if it happened, exists somewhere other than the picture: in the store’s system, in the supplier’s account history, on a card statement. Check that.

1. Put the big suppliers on your account. If vendors buy materials on a trade account in your company’s name at the two or three stores they use most, the supplier bills you directly and there is no receipt to fake. This is the only control on this list that removes the problem instead of detecting it.
2. Where that is not practical, ask for the supplier’s own record. The e-receipt emailed by the store, forwarded from the vendor’s inbox, or an export from the vendor’s own trade account. A photo of paper is the weakest version of the receipt, so do not accept it as the default.
3. Spot-check a few a quarter, with a phone call. Pick a receipt at random, call the store it names, and ask whether that transaction number exists for that total on that date. What they will confirm varies by store; the point is that the vendor knows you do it. Tell every vendor in writing that you spot-check receipts with suppliers. Most padding stops at that sentence.
4. Compare quantities with the job. Fourteen gallons of paint on a one-bedroom repaint is a question worth asking, whatever the receipt looks like.
5. Look for the same receipt twice. Recycling an old real receipt is still easier than generating a new one. Keep a list of receipt numbers per vendor; a repeat is an answer.

None of this needs software, and none of it depends on anyone being able to tell a fake by looking.

Where our checker does help on the same invoice

The receipt is the weak document. The photographs of the work are the strong ones, because a phone photo carries things a generator does not write: the camera, the exposure, and the time the camera’s clock recorded. What the “after” picture proves covers that in full. Ask for the work photos as original files, check that the capture times fall inside the job, and file a dated report listing each file’s SHA-256 so that anyone can later confirm the file in front of them is the one you checked.

The limits, stated plainly

• The AppZen figures are about employee expense claims, from one vendor’s platform, and we could not check them independently. We found nobody publishing the same numbers for contractor invoices.
• Our checker reads evidence that is present in a file. It does not read PDFs, and it does not judge whether a receipt looks real. The report we file gives no confidence score.
• A receipt with nothing on it is not cleared. A phone photo of a printed fake is a real photo.
• What a store will confirm over the phone differs by chain and by store. Ask yours before you depend on it.

---

ImposterShield reads the evidence inside image files. It runs in your browser and uploads nothing. If a file has been stripped, it says so. That is the product working, not failing.