What to do if…
you suspect someone is using your name to approve purchases or invoices at work
Short answer
Stop any further approvals under your name and report it immediately (in writing) to your manager and Accounts Payable/Finance (and IT/security), asking them to freeze approvals, hold payments, and preserve audit logs.
Do not do these things
- Do not confront the person you suspect or accuse anyone on Slack/Teams/email.
- Do not try to “undo” it by re-approving, backdating, or editing records — it can damage the audit trail.
- Do not delete emails, approval notifications, or system records.
- Do not forward invoices or vendor banking information to your personal email/text unless your employer explicitly permits it.
- Do not wait for certainty if payments are pending — containment comes first.
What to do now
- Contain immediately (minutes):
Ask Accounts Payable/Finance to pause payments tied to approvals under your name and to temporarily disable your approval role (or require a second approver) until reviewed. - Report to the right internal owners (today, in writing):
Notify your manager, AP/Finance, and IT/security (or the helpdesk). Include invoice numbers, vendor names, amounts (if known), dates/times, and where you saw your name attached. Ask them to confirm receipt and that logs are being preserved. - Preserve evidence without investigating (today):
Make a simple timeline for yourself. Save approval emails/notifications and take screenshots that show your name attached to approvals without altering records. - Secure your work accounts and permissions (today):
Ask IT/security for:- password reset(s) and confirmation that MFA is enabled
- a check for mailbox forwarding/rules, suspicious logins, and connected apps/OAuth access
- a review of any delegated approval permissions, shared roles, or shared credentials
- Ask Finance/Procurement for a targeted control check (today):
Ask them to check for:- recent vendor bank detail changes
- invoices split to avoid approval limits
- duplicate invoices or unusual “rush” payments
- whether your name is attached via a workflow role rather than your specific login
- Use a confidential channel if you’re worried about retaliation or management involvement:
If your employer has an ethics/compliance hotline or formal reporting channel, use it and keep the report factual. Save any case/reference number. - If you suspect your personal identity is being misused beyond work:
Use IdentityTheft.gov to file a report and get a step-by-step recovery plan. If you’re worried someone may try to open credit in your name, consider a fraud alert or a credit freeze with each of the three nationwide credit bureaus.
What can wait
- You do not need to decide now whether to quit, confront anyone, or hire an attorney.
- You do not need to prove who did it before reporting — your priority is freezing approvals and preserving logs.
- You can wait to contact credit bureaus unless you see personal signs (new accounts, credit inquiries, collection notices, missing mail).
Important reassurance
Feeling panicked is normal — this can threaten your reputation and job security. Reporting promptly, keeping it factual, and asking for audit logs to be preserved is a responsible, protective move.
Scope note
These are first steps to limit damage and protect you from being wrongly tied to approvals. The deeper investigation and any recovery actions should run through your employer’s formal finance/security processes.
Important note
This is general information, not legal advice. Policies differ by employer and industry. If you are pressured to approve or certify records you do not understand, it’s reasonable to pause and insist the issue be handled through documented internal channels.