Benford's Law
Definition
An empirical regularity in naturally occurring numerical datasets: the leading digit follows a logarithmic distribution, with 1 appearing about 30% of the time and 9 about 5%. Invoice amounts invented by fraudsters tend to deviate from this distribution, making it a useful screening test.
- Pattern
- Leading digit follows a logarithmic distribution
- 1 as leading digit
- About 30% of naturally occurring values
- 9 as leading digit
- About 5% of naturally occurring values
- Forensic use
- Screening test for fabricated invoice or transaction amounts
Common questions
Why does Benford's Law flag fabricated numbers as suspicious?+
People inventing figures tend to distribute leading digits more evenly than nature does, favouring round numbers or a flatter spread, so a dataset that deviates noticeably from the expected logarithmic distribution is worth closer review, though deviation alone is not proof of fraud.
What kinds of datasets does Benford's Law not apply to?+
It works best on datasets spanning several orders of magnitude and arising without an artificial minimum or maximum, such as invoice totals or account balances. It does not reliably apply to assigned numbers like invoice IDs, phone numbers, or data capped within a narrow range, such as prices set at a fixed price point.
Is a Benford's Law deviation enough evidence to prove fraud on its own?+
No. It is a screening tool that flags accounts or vendors for further investigation, not a standalone finding of wrongdoing; legitimate processes such as tiered pricing, rounding rules, or a small sample size can also produce deviations from the expected distribution.
Related terms
- ACL / Galvanize HighBond
- A purpose-built audit analytics platform (originally Audit Command Language) that imports financial data, executes statistical and rule-based tests, and produces exception reports...
- Chi-Square Test
- A goodness-of-fit test comparing the observed digit frequencies in a dataset to the expected Benford frequencies, producing a test statistic that is...
- Continuous Monitoring
- An automated control framework that applies fraud indicator tests to transactions as they are processed or on a frequent scheduled basis, generating...
- Duplicate-Payment Analysis
- A data analytics test that identifies invoice payments made more than once for the same obligation, by matching on vendor, invoice number,...
- Fuzzy Matching
- A string-comparison technique that identifies near-identical records by measuring edit distance or phonetic similarity rather than requiring character-exact matches. Used in duplicate...
- IDEA
- Interactive Data Extraction and Analysis: an audit data analytics tool that supports Benford analysis, duplicate detection, stratification, and custom query filters across...
- Mean Absolute Deviation (MAD)
- A practical Benford conformity measure that averages the absolute differences between observed and expected proportions across all leading digits, with Nigrini benchmarks...
- Network Link Analysis
- A technique that represents entities (vendors, employees, bank accounts, addresses) as nodes in a graph and shared attributes as edges, enabling investigators...
- Pass-Through Scheme
- A billing scheme in which a legitimate supplier is used as a conduit. The fraudster, who controls or colludes with the supplier,...
- Second-Digit Test
- Analysis of the second significant digit in isolation, where 0 is expected to appear about 11.97% of the time. A spike in...
- Shell Company
- A legal entity with no genuine business operations, created to receive fraudulent payments. In vendor fraud, the fraudster controls the shell and...
- Three-Way Match
- An accounts-payable control that requires a supplier invoice to match an authorised purchase order and a goods receipt note before payment is...
Explained in these topics
- Benford's Law and Digital AnalysisThe empirical observation that in naturally occurring numerical data spanning multiple orders of magnitude, the leading digit d appears with probability log10(...
- Billing and Vendor Fraud Schemes
- Data Analytics and Continuous Monitoring in Fraud DetectionAn empirical observation that in many naturally occurring numerical datasets, the leading digit follows a predictable logarithmic distribution: 1 appears about...