Anomalies

DayZero scans your books — on a schedule and on demand — for the things that quietly cost money: duplicate payments, statistically unusual amounts, rapid-succession charges, invoices or bills paid more than once, and duplicate vendor records. Each finding carries a severity, the evidence behind it, and (where it can) a one-click recommended fix. Review what's flagged, fix the underlying record, or dismiss it with a reason to suppress repeats.

Key capabilities

• Six detection types: duplicate payment, unusual amount, rapid succession, duplicate invoice payment, duplicate bill payment, duplicate vendor
• Scheduled scans (daily cron + after each sync) plus on-demand Rescan now
• Default 30-day lookback for transaction-based checks; vendor checks run across all active vendors
• Severity (High / Medium / Low) and type filters, grouped by type and sorted by highest severity
• Summary tiles: Active, High Severity, Medium Severity, and Dismissed counts
• New badge on findings detected in the last 24 hours
• Inline evidence — counterparty, amount, totals, z-score, transaction count
• Recommended actions: draft a void for duplicates, or merge duplicate vendors
• View links jump straight to the affected bill, invoice, or filtered transactions
• Structured dismiss reasons with optional notes, plus Restore
• Dismiss All per type for clearing batches of false positives

How it works

Each scan flags suspicious items with evidence and (when possible) a recommended action. You either fix the record or dismiss the flag with a reason, which suppresses that exact fingerprint on future scans.

flowchart TD
  scan["Scheduled / on-demand scan"] --> checks["Rule + statistical checks"]
  checks --> flag["Flag findings (severity + evidence)"]
  flag --> review["Review + recommended action"]
  review --> decide{"Resolve?"}
  decide -->|"Fix record"| clean["Void / merge / recategorize"]
  decide -->|"Dismiss w/ reason"| suppress["Suppressed by fingerprint"]

How to use it

1. Open Anomalies (/books/anomalies) — findings are grouped by type and sorted with the highest-severity groups first.
2. Use the severity and type dropdowns to filter; toggle Showing dismissed to include previously cleared items.
3. Expand a type group to read each finding, its evidence (counterparty, amount, z-score, transaction count), and the type-level tip.
4. Click View to open the affected record — a bill, an invoice, or the filtered/highlighted transactions.
5. Fix the issue (void a duplicate, recategorize, or merge vendors) using the recommended action or the linked record.
6. To clear a false positive, click Dismiss, choose a reason (Expected/Recurring, Already Resolved, Not an Issue, Other), add an optional note, and confirm. Use Restore to undo.
7. Click Rescan now to re-run detection on the last 30 days; the header shows the last-scanned time and the active lookback window.

Pro tips

• Review anomalies weekly — catching a duplicate payment early saves hours of correction and a refund chase later.
• Sort your attention by severity: duplicate payments ≥ $1,000 and duplicate invoice/bill payments are flagged High.
• Dismissals suppress by fingerprint, not by learning — use clear structured reasons and notes so teammates know why something was cleared.
• Duplicate-vendor findings include a Merge vendors action; use it to clean up the vendor list and keep future matching accurate.
• Genuine recurring payments (e.g. monthly retainers) are deliberately skipped by the duplicate-payment check, but if one slips through, dismiss it as Expected / Recurring.
• Rescan now is rate-limited; the scheduled scans keep things current between manual runs.

In-depth guide

Detection types and thresholds

Recurring-payment guardrail

Before flagging same-amount payments as duplicates, the engine checks whether they follow a roughly weekly, bi-weekly, or monthly cadence. Consistent recurring patterns are treated as legitimate and skipped, so genuine subscriptions and retainers don't generate noise.

Recommended actions and evidence

Findings carry structured evidence rows (date, amount, reference, counterparty) for side-by-side review. Where a safe fix exists, a recommended action is attached:

• Draft void — on duplicate payments and duplicate invoice/bill payments; keeps the earliest payment and voids the rest (with estimated savings).
• Merge vendors — on duplicate vendors; keeps the oldest record.

Fingerprints, dismissal, and restore

• Fingerprint — every finding has a stable SHA-256 fingerprint derived from its type plus the transaction and entity ids involved; this both deduplicates findings and matches dismissals.
• Dismissing — requires a structured reason and accepts an optional note; the fingerprint is then suppressed on future scans.
• Restoring — dismissed items can be shown with the toggle and Restored if cleared by mistake.
• Note — dismissal suppresses; it does not retrain the detector.

Scans, lookback, and scope

• Transaction-based checks (duplicate payment, unusual amount, rapid succession) — run over a 30-day lookback by default.
• Invoice/bill duplicate-payment checks — look at payment records regardless of date.
• Duplicate-vendor detection — runs across all active vendors, independent of the lookback, since vendor records aren't transaction-dated.
• Cadence — scans run on a daily schedule and after syncs; Rescan now triggers a fresh background run.

Start free and let DayZero watch your books for errors.