Quick Answer
Benford’s Law predicts that in naturally formed numeric data, the first digit is 1 about 30.1% of the time and 9 only 4.6%, following P(d) = log₁₀(1 + 1/d). Genuine ledgers — invoices, payments, expense claims, journal entries — usually track this curve; fabricated or manipulated numbers usually don’t, because humans invent digits more uniformly and calibrate amounts around approval thresholds. Forensic teams run first-digit and first-two-digit tests over full transaction populations, measure deviation with MAD/chi-square/Z-scores, and drill into the deviating clusters. It is a targeting tool, not proof — but it reliably tells an investigator where to dig.
Last Updated: 15 August 2026 | Applies To: Forensic investigations, internal audit analytics, statutory audit journal-entry testing under SA 240, lender-mandated forensic reviews, and GST/income-tax data analytics | Reference: Newcomb (1881); Benford (1938); Nigrini, Benford’s Law: Applications for Forensic Accounting, Auditing, and Fraud Detection; ACFE Fraud Examiners Manual
In 1881 the astronomer Simon Newcomb noticed that the front pages of logarithm books — those covering numbers beginning with 1 — were dirtier and more worn than the back pages. Physicist Frank Benford rediscovered the pattern in 1938 and tested it against more than 20,000 observations: river drainage areas, populations, physical constants, street addresses, death rates. The same striking regularity held everywhere: small first digits dominate. Six decades later, accounting professor Mark Nigrini demonstrated that the pattern holds for transactional accounting data — and, crucially, that people inventing numbers break it. Since then, digit analysis has become a standard weapon in forensic accounting, tax-administration case selection and audit journal-entry testing. This guide explains the mathematics in plain terms, when the law applies and when it misleads, exactly how to run the tests on your own ledgers, what real detection looks like, and how a Certified Fraud Examiner (CFE) turns a digit anomaly into admissible findings.
Definition — Benford’s Law (First-Digit Law): In many naturally occurring collections of numbers, the probability that the leading digit is d equals log₁₀(1 + 1/d). The distribution is logarithmic, scale-invariant (it survives conversion between rupees and dollars) and base-invariant — properties that make it a robust benchmark for testing whether numeric data was formed by natural processes or by human invention.
The probability that a number’s first significant digit is d is P(d) = log₁₀(1 + 1/d):
| First digit | Expected frequency | In 10,000 transactions |
|---|---|---|
| 1 | 30.10% | ~3,010 |
| 2 | 17.61% | ~1,761 |
| 3 | 12.49% | ~1,249 |
| 4 | 9.69% | ~969 |
| 5 | 7.92% | ~792 |
| 6 | 6.69% | ~669 |
| 7 | 5.80% | ~580 |
| 8 | 5.12% | ~512 |
| 9 | 4.58% | ~458 |
The asymmetry surprises everyone the first time: a genuine purchase ledger will have roughly six and a half times as many amounts starting with 1 as amounts starting with 9. Intuition expects each digit to appear about 11% of the time — and that very intuition is what betrays people who fabricate numbers.
Three intuitions, in increasing rigour:
This is also why the law needs range: data confined to a narrow band (salaries in one grade, items priced ₹80–₹120) never had the chance to develop logarithmic spread, and testing it against Benford is a category error.
People inventing amounts leave three signatures:
Key insight: the fraudster must invent many numbers over months or years while staying under thresholds and avoiding suspicion. Each individual amount looks plausible; the population of amounts cannot help but carry the statistical fingerprint. Benford analysis reads the population, which is exactly the level at which sampling-based review is blind.
| Good candidates | Poor candidates (expect false alarms) |
|---|---|
| Vendor invoice and payment amounts | Assigned numbers — invoice serials, cheque numbers, PINs, phone numbers |
| Journal entries, general-ledger postings | Prices set by policy — MRP items, fixed fees, tariffs, per-diems |
| Expense claims across an organisation | Narrow-range data — one pay grade’s salaries, one SKU’s sales |
| Loan disbursements, insurance claims | Data with floors/caps — minimum billing, credit-limit-capped draws |
| GST invoice values, e-way bill amounts | Small samples — under ~500–1,000 records lack statistical power |
| Inventory receipts, sales registers spanning many magnitudes | Aggregated or averaged figures — monthly totals, ratios, percentages |
Nigrini’s working rule: the data should describe sizes of similar phenomena, have no built-in minimum or maximum, not be assigned identifiers, and ideally span three or more orders of magnitude. An hour spent confirming suitability saves a week of chasing structural “anomalies” that are really pricing policy.
Eyeballing a chart is not a finding. Three statistics discipline the conclusion:
The professional discipline: statistics decide whether to investigate; the drill-down decides what to investigate; documents decide what happened.
Excel (adequate up to ~100k rows):
=LEFT(TEXT(ABS(A2),"0"),1); first two digits: =LEFT(TEXT(ABS(A2),"0"),2) on amounts ≥ 10;=LOG10(1+1/d); first-two-digits =LOG10(1+1/dd) for dd = 10…99;=AVERAGE(ABS(actual% − expected%)); flag bins with |Z| > 1.96;Python (for scale and repeatability): a dozen lines with pandas — extract leading digits with string operations on the absolute amount, value_counts(normalize=True) against np.log10(1 + 1/np.arange(1,10)), MAD as the mean absolute difference, and a groupby on the flagged bins. Wrap it once and every quarter’s ledger takes minutes. Audit platforms (IDEA, ACL/Galvanize, Arbutus) ship the same tests pre-built with drill-down linked to source rows.
Practitioner’s note: always run the tests by segment as well as in aggregate — by vendor, branch, approver, expense head. A clean company-wide curve routinely hides one procurement officer whose personal population is wildly nonconforming; aggregation launders the signal.
Scenario 1 — the 49-thousand procurement officer. A manufacturer’s purchase register conformed overall (first-digit MAD 0.005). Segmented by buyer, one officer’s population showed a first-two-digit spike at 48–49 with |Z| > 6. Purchases needed director approval above ₹50,000. Drill-down found serial order-splitting and two favoured vendors; document testing found the vendors were shells. The Benford screen took forty minutes; it targeted three years of sampling straight at the right desk.
Scenario 2 — expense claims that were too even. A services firm’s travel claims showed first-digit frequencies of 14–13–12–11–11–10–10–9–9% — nearly uniform, the classic human-invention signature. Last-two-digit testing showed almost no 00 endings (claimants avoiding “suspicious” round numbers). Cross-matching flagged claims against attendance and travel-booking data substantiated systematic fabrication across one regional team.
Scenario 3 — journal entries before year-end. Running the first-two-digit test on manual journal entries by month showed conformity all year except March, where entries spiked at 99 and 98 first-digit pairs — postings calibrated to sit just below the component-materiality threshold the group auditor was known to apply. This is why SA 240 journal-entry testing increasingly embeds digit analytics, and why manipulation aimed at financial-statement thresholds is better caught by population screens than by sample vouching.
Scenario 4 — the macro-level uses. Digit analysis flagged anomalies in Greece’s reported deficit statistics before the Eurozone crisis; tax administrations worldwide — including Indian GST analytics — use digit and threshold-clustering screens for case selection; and lenders’ forensic auditors apply them to loan-book data, where the DHFL fictitious-borrower machinery illustrates what population-level testing finds that file review cannot.
A digit anomaly becomes a defensible finding through a disciplined sequence:
CA V. Viswanathan, FCA, CFE (Certified Fraud Examiner): Benford analysis earns its place in my toolkit for one reason: it is the cheapest honest question you can ask a ledger. Forty minutes with a payments extract tells me whether a population behaves like commerce or like imagination — before a single document is pulled, before anyone knows an examination has begun. Three disciplines separate professional use from parlour tricks. First, suitability before significance: half the “Benford findings” brought to me by in-house teams are pricing policy, not fraud, because nobody asked whether the data could conform in the first place. Second, segment relentlessly: in nearly every engagement where digit analysis broke a case — the order-splitting buyer, the too-even expense team — the aggregate curve was clean and the individual’s curve was screaming. Fraud is committed by people, so test at the level of people. Third, treat the output as a search warrant, not a verdict: the CFE curriculum drills this into you — the digit chart directs the document testing, the documents support the interviews, the interviews complete the evidence, and only that full chain survives a courtroom. I also tell audit committees the quieter benefit: run these analytics annually and publicise internally that you run them, without saying where. The deterrent effect of known, unpredictable population-level testing is worth as much as any single detection — opportunity shrinks when the ledger itself becomes a witness.
Want your payments, payroll or expense data screened?
Virtual Auditor’s CFE-led forensic team runs the full analytics battery — Benford, duplication, threshold and matching tests — and converts anomalies into documented, court-ready findings. Call +91 99622 60333 or contact us online.
What is Benford’s Law in simple terms?
Benford’s Law says that in many naturally occurring sets of numbers — invoice amounts, payments, populations, expense claims — the first digit is far more often small than large. The digit 1 leads about 30.1% of the time, 2 about 17.6%, falling steadily to just 4.6% for 9. Genuine transactional data usually follows this curve; numbers invented by people usually do not, because humans intuitively spread digits evenly or favour certain digits. Comparing a dataset’s actual first-digit frequencies against the Benford curve is therefore a fast screen for manipulation.
Why do naturally occurring numbers follow Benford’s Law?
Because quantities that grow multiplicatively — by percentages, compounding, or combinations of several factors — spend more “time” with a leading 1 than with a leading 9. Moving from 1,00,000 to 2,00,000 requires 100% growth, while moving from 9,00,000 to 10,00,000 requires only about 11%. Data spanning several orders of magnitude, formed by multiplying prices by quantities or compounding over time, therefore naturally produces logarithmically distributed first digits: P(d) = log10(1 + 1/d).
Which datasets are suitable for Benford analysis and which are not?
Suitable: large populations (ideally 1,000+ records) of naturally formed amounts spanning several orders of magnitude — vendor invoices, journal entries, expense claims, insurance claims, loan disbursements, GST invoice values. Not suitable: assigned numbers (invoice serials, phone numbers, PIN codes), amounts with built-in floors or caps (fixed fees, MRP-priced items, per-diem allowances), small samples, and data drawn from a narrow range such as salaries within one grade. Running Benford on unsuitable data produces false alarms, not findings.
Can Benford’s Law prove fraud?
No — and no competent forensic accountant claims it can. A Benford deviation is an indicator that directs deeper testing toward specific digit ranges, ledger accounts, vendors or approvers; the proof comes from the underlying documents, funds tracing and interviews that follow. Courts and tribunals treat digit analysis as investigative methodology that justifies scrutiny, not as standalone evidence of wrongdoing. Conversely, conformity with Benford does not prove data is clean — small or proportionally scaled manipulations can preserve the curve.
How do I run a Benford test in Excel?
Extract the amounts column, remove zeros, negatives (test them separately) and blanks. Get the first digit with =LEFT(TEXT(ABS(A2),"0"),1), count frequencies with COUNTIF, convert to percentages, and compare against the Benford expectations (30.1%, 17.6%, 12.5%, 9.7%, 7.9%, 6.7%, 5.8%, 5.1%, 4.6%) with a column chart overlaying actual versus expected. For sharper targeting, repeat on the first two digits (10 through 99) — spikes at specific two-digit combinations such as 49 or 99 point directly at threshold behaviour.
What does a spike just below an approval threshold mean?
It is one of the most reliable red flags in forensic analytics. If purchases above ₹50,000 need senior approval and the first-two-digit test shows an abnormal concentration of amounts beginning with 48 and 49, someone is structuring transactions to stay under the limit — splitting orders, trimming invoice values, or calibrating fake claims to avoid review. The same signature appears below ₹1 lakh vendor-payment limits, below audit sampling thresholds, and below cash-transaction reporting limits.
Which statistical tests confirm a Benford deviation is significant?
Practitioners use the Z-test per digit for spot deviations, the chi-square test across all digits for overall fit, and — most usefully for large populations — the Mean Absolute Deviation (MAD) with Nigrini’s thresholds: for first-digit tests, MAD under 0.006 indicates close conformity, 0.006–0.012 acceptable, 0.012–0.015 marginal, and above 0.015 nonconformity warranting investigation. On very large datasets chi-square rejects almost everything, so MAD plus visual inspection of which digits deviate is the working standard.
Where has Benford’s Law actually caught fraud?
Digit analysis has featured in exposing fabricated vendor invoices, inflated expense claims, manipulated bank loan files and accounting irregularities worldwide — it flagged anomalies in Greece’s reported EU deficit statistics and is standard in tax administrations’ audit selection, including analytics used by Indian authorities on GST and income-tax data. In our own practice, first-two-digit spikes below approval thresholds have opened vendor billing schemes and expense frauds that document-level sampling had passed for years.
Is Benford analysis useful for GST and income-tax data in India?
Yes. Tax administrations use digit and pattern analytics to select cases — unusual concentrations of invoice values just below e-invoicing or e-way-bill thresholds, round-amount clustering in cash expense claims, and digit anomalies in turnover distributions across a taxpayer population. For businesses, running the same tests internally on purchase registers and expense data before an assessment is inexpensive insurance: you find the anomalies (and their innocent or guilty explanations) before the department does.
What should a company do when a Benford test flags anomalies?
Treat it as targeting, not verdict. First re-check data suitability to rule out structural explanations — pricing conventions, fixed fees, thresholds inherent to the business. Then drill into the deviating digit range: which vendors, accounts, approvers and periods drive it. Pull the underlying documents for that cluster, test them against goods-receipt and bank records, and only then interview. If the cluster survives document testing, escalate to a full forensic investigation with evidence preservation, because the analytics file itself will become part of the evidentiary record.
Need a forensic data-analytics review — or a full fraud investigation? Virtual Auditor’s CFE-led team screens payments, payroll, inventory and loan data, and converts anomalies into court-ready findings. Call +91 99622 60333 or email support@virtualauditor.in.