$10,000 in Gift Cards, Hiding in the Level 3 Data

Purchasing cards are one of the best things to happen to Accounts Payable in years. They’re also one of the easiest ways to quietly bleed money if no one is watching. This is a story about the second part, and about the data most companies never bother to look at.

Why PCards exist in the first place

As companies streamline AP, they almost always expand their purchasing-card programs, and for good reason. PCards are perfect for the one-off, low-dollar buys that would be miserable to run through a full procure-to-pay process. Think of the person responsible for keeping a building running: they need paint from the hardware store, a few 2x4s, a new fridge for the break room. Nobody wants to cut a PO, wait for an invoice, and process a payment for a $40 can of paint. A PCard handles it in seconds.

That convenience is the whole point. But it comes with a catch: a PCard is only a good control if it’s monitored. Otherwise, “fast and easy” cuts both ways.

The engagement

I was hired to review a company’s purchasing-card program and its data. The first thing I did was request a feed of their VCF data from their bank.

Quick explanation, because not everyone lives in this world: VCF stands for Visa Commercial Format: it’s the enhanced data feed the card network and issuing bank can provide for commercial card programs. The basic transaction data everyone sees is just the merchant name and the amount. VCF goes deeper, down to what’s called Level 3 data, the individual line items on the purchase, including item descriptions, quantities, unit prices, and product codes. Essentially, the digital version of the itemized receipt. (Mastercard has its own equivalent.) It’s the difference between knowing someone spent $312 at a big-box store and knowing exactly what was in the cart.

Reading the receipts

Most people, when they analyze PCard data, look at the merchant and the amount. I went straight for the line-item descriptions, the Level 3 detail, because that’s where the truth is. I ripped the descriptions apart into individual words and started looking for patterns.

One pattern jumped out immediately: gift cards.

Now, who’s buying gift cards on a purchasing card? Maybe, just maybe, the occasional small reward for an employee who did great work. I can talk myself into that. But then I looked at the volume. One cardholder had purchased over $10,000 in gift cards. And they weren’t the only one; other cardholders were doing it too, just nowhere near that level.

Gift cards should make the hair on the back of your neck stand up. They’re as good as cash, they’re nearly impossible to trace once they’re bought, and there is rarely a clean business reason for them on a PCard. Ten thousand dollars’ worth is not a pattern you explain away.

It was never just gift cards

So we dug into that cardholder. And of course, it wasn’t only gift cards. Once we read through the line items, the picture filled in fast: refrigerators and a long list of other personal purchases, all charged to the company card. All of it sitting right there in the Level 3 data, in plain sight.

And that’s the part I want to land. None of this was hidden in some clever way. It was hidden by the fact that nobody was reading the receipts. At the merchant-and-amount level, these looked like ordinary purchases at ordinary stores. It was only in the line-item detail, the words on the receipt, that “gift card” and “refrigerator” showed up and told the real story.

The takeaway

If you run a purchasing-card program of any real size, you need the tools to analyze Level 3 data, not just the summary. The convenience of a PCard is exactly what makes it risky: it’s fast, it’s low-friction, and it skips the controls that catch problems on the AP side. The line-item data is your window back into what’s actually being bought, and it’s the difference between a program you think is clean and one you can actually prove is.

The card did its job. So did the person misusing it. The only thing missing was someone reading the receipts.