What to do if…
you suspect someone is using your name to approve purchases or invoices at work

What to do now

1. Pause anything that could add to the problem:
   Stop using the approval function for the affected system. Ask Finance, Accounts Payable, or Procurement to temporarily suspend approvals under your user ID or name, require a second approver, and hold any pending payments linked to approvals in your name until they have checked them.

2. Report it to the right internal owners in writing:
   Email your manager and Finance or Accounts Payable. Include only facts you can point to: invoice numbers, purchase order numbers, supplier names, amounts if visible, dates, times, system names, and where your name appears. Ask them to confirm in writing that they have started a review.

3. Ask IT to secure your account and preserve access evidence:
   Contact IT or the service desk and ask them to reset your password, confirm MFA or 2FA is enabled, check for mailbox rules or forwarding, check suspicious logins, and check delegated access or “approve on behalf of” permissions. Ask them to preserve relevant logs rather than investigating the system yourself.

4. Keep a simple record without changing evidence:
   Make a short timeline on an approved work system: when you noticed the issue, what you saw, and who you told. Keep approval notifications and screenshots only where workplace policy allows, and do not alter the finance or procurement records.

5. Ask Finance or Procurement to check the controls around your name:
   Ask them to check the approval matrix, workflow roles, delegated authority settings, recent supplier bank-detail changes, duplicate invoices, and invoices split into smaller amounts. Also ask them to check whether your name appears because of a workflow role rather than your actual login.

6. Ask for a temporary protective arrangement:
   Ask for your approval role to be removed, paused, or routed to another named approver while the issue is reviewed. Ask for the interim arrangement to be confirmed in writing so you are not pressured to approve items you cannot verify.

7. Use a safer reporting route if normal line management is part of the concern:
   If the issue may involve your manager, senior staff, or retaliation risk, use your employer’s whistleblowing, fraud, compliance, audit, or confidential reporting channel if one exists. In the UK, whistleblowing may be protected in some circumstances, but keep the report factual and avoid naming someone as responsible unless you have clear evidence.

8. Ask who is handling any external fraud report:
   If this appears to be fraud rather than an internal mistake, ask your employer who will report it externally. If you are personally affected, cannot safely use internal routes, or need to make your own report, Report Fraud is the official route for England, Wales, and Northern Ireland. If you live in Scotland or the incident happened there, use Police Scotland, usually via 101. If there is an immediate emergency, call 999.