An office-supplies receipt that isn't office supplies
A vendor expense submitted for reimbursement. Receipts like this normally cover routine purchases - supplies, printed materials, small equipment - so a structured-data audit checks the vendor, category and amount, then clears it. Watch what each layer sees.
| Vendor | MedSupply Direct |
| Category | Office Supplies |
| Amount | $4,950.00 |
| Policy limit | $5,000.00 |
Under the limit. Right category. The rules engine waves it through.
reveals
High risk| Premium Handheld UltrasoundFLAG | $4,900.00 |
| Ballpoint pens, box | $12.00 |
| Sticky notes ×4 | $38.00 |
| Ship to: 142 Elm Ct (private residence)FLAG | - |
risk score0The gap: the structured fields were honest - a sub-limit office-supplies expense. The receipt is where the real story lived. Neocortex reads it the way a reviewer would, and applies human-like judgment to flag it.
The "meal" that was a bottle of liquor
An HCP business meal, logged with a small branded gift - both permitted, with a per-head spend cap. The audit checks the category and the per-attendee amount, sees a meal and token gift within policy, and clears it. Watch what the receipt says.
| Vendor | Skyport Retail Group |
| Category | Business Meal (HCP) |
| Stated purpose | Meal + branded gift |
| Attendees | 2 |
| Amount | $284.00 |
| Per-head cap | $150.00 |
Two attendees, $142 a head, plus a token branded gift. Right category, under the cap. The rules engine waves it through.
reveals
High risk| Macallan 18 single malt, 750mlFLAG | $268.00 |
| Gift wrappingFLAG | $8.00 |
| Duty & tax | $8.00 |
| Sold at: Terminal 4 Duty Free, Gate B22FLAG | - |
risk score0The gap: the structured fields were plausible - an HCP meal, two heads, under the cap. The receipt shows there was no meal at all: a single bottle of premium spirits, gift-wrapped, from an airport duty-free shop. Neocortex reads the line items and calls it what it is.
Same two people, same golf club, every weekend
Here the structured data does see something - the same HCP pair, the same vendor, six weekends in ninety days. But each visit sits under the meeting cap and the vendor reads as a golf club, so the audit clears it. Watch what the receipts say.
| Vendor | Fairway Pines Golf Club |
| Category | Business Meeting |
| Same attendees | Dr. A & Dr. B |
| Frequency | 6 weekends, every Sat |
| Avg per visit | $236.00 |
| Per-meeting cap | $250.00 |
Recurring, but every visit is under the cap and the vendor name reads as a golf club. The rules engine waves it through.
reveals
High risk| Green fees, weekend rate ×2FLAG | $190.00 |
| Padrón 1964 cigars ×2FLAG | $116.00 |
| Macallan 18, double ×2FLAG | $96.00 |
| Venue: Fairway Pines Golf Club - Sat tee timeFLAG | - |
risk score0The gap: the structured data could see the repetition - same two people, same vendor, every weekend - but "Fairway Pines Golf Club" read as an ordinary meeting venue. The receipts show every Saturday was the same: green fees, premium cigars and hard liquor. Neocortex reads the venue and the line items, and connects the pattern.
Dinner in two cities at once
Two HCP dinner expenses on the same day, each under the meal cap. Structured data sees two valid meals and clears both. But a receipt carries a venue and a time - and those two facts cannot both be true.
| Claim A | Dinner, HCP · $138 |
| Claim B | Dinner, HCP · $146 |
| Date | Both Apr 9 |
| Per-head cap | $150.00 |
Two separate dinners, both within policy. Nothing in the fields contradicts itself. The rules engine waves both through.
reveals
Confirmed risk score0The gap: each claim looked valid on its own - right category, under the cap. Only the receipts revealed the contradiction: two venues 100 miles apart, both at 8:30 PM. Neocortex reads venue and time across claims and proves one dinner could not have happened.
One air ticket, billed twice
Two travel expenses, filed eighteen days apart on two different cards - one corporate, one personal - both within policy. Different dates and cards mean a simple duplicate check never matches them. But the receipts underneath tell on each other.
| Claim A | Filed Apr 3 · Corporate Card |
| Claim B | Filed Apr 21 · Personal Card |
| Route (both) | JFK → LHR |
| Amount (each) | $2,480 |
| Duplicate check | No match (dates & cards differ) |
Different filing dates and two different cards, so the duplicate rule never fires. Both sit within the travel limit. The rules engine waves both through.
reveals
Confirmed| Route | JFK→LHR |
| Confirmation | X7K2QP |
| Fare | $2,480 |
| Route | JFK→LHR |
| Confirmation | X7K2QP |
| Fare | $2,480 |
risk score0The gap: the structured duplicate check compares dates and cards, and both differed - one claim on the corporate card, one on a personal card. The receipts share the same confirmation number, the same JFK→LHR route and the same fare - it is one ticket, claimed twice. Neocortex reads the document detail the rule never sees.
The 2 a.m. nightclub tab
An HCP business-meal expense, comfortably under the limit and in a permitted category. The amount looks ordinary. The timestamp and the venue do not.
| Vendor | Velvet Room Hospitality |
| Category | Business Meal (HCP) |
| Amount | $900.00 |
| Policy limit | $1,000.00 |
Under the limit, coded as an HCP meal, a normal-sounding vendor. The rules engine waves it through.
reveals
High risk| Bottle service - Grey Goose magnumFLAG | $420.00 |
| VIP booth, table chargeFLAG | $300.00 |
| Dom Pérignon, champagneFLAG | $180.00 |
| 02:14 AM · Velvet Room nightclubFLAG | - |
risk score0The gap: the amount sat under the cap and it was coded as an HCP meal, so the rules let it pass. The receipt shows a 2 a.m. nightclub tab - bottle service, a $300 table charge and champagne, no business context. Neocortex reads the timestamp and venue and calls it what it is.
A car ride flagged too high
The structured audit raised the alarm - a rideshare fare five times the usual. The amount alone cannot say why. Watch the receipt show what kind of ride it really was.
| Vendor | Uber |
| Category | Ground Transport |
| Amount | $310.00 |
| Typical ride fare | $15–$60 |
More than five times the usual fare. The rules engine flags it for review - suspected luxury car or padded ride.
reveals
High risk| Uber Black, premium class - 6 milesFLAG | $230.00 |
| Surge pricing, 2.4xFLAG | $80.00 |
| Trip: midtown hotel → district office | - |
| Standard UberX for this trip: ~$28FLAG | - |
risk score0The gap: the fare alone only said "high," so the rules could not tell a long airport run from a short luxury hop. The receipt shows the truth: Uber Black premium class with 2.4x surge, for a 6-mile trip a standard UberX does for about $28. Neocortex reads the ride class and route, and confirms the luxury upgrade.
A penthouse suite, or just peak-week pricing?
Not every flag is a violation. The bill shows a penthouse suite - but a major congress was in town those nights, when every hotel rate surges. Was the cost the fancy room, or the flexible pricing? You often cannot tell from the data alone.
| Vendor | Grand Harbor Hotel |
| Category | Lodging |
| Amount | $1,180.00 |
| Event-week allowance | $1,500.00 |
High, but inside the event-week lodging allowance. The rules engine waves it through.
reveals
Needs review| Penthouse suite, 1 nightFLAG | $1,080.00 |
| Resort fee | $60.00 |
| City tax | $40.00 |
| Context: ACC congress Apr 12–15, rates surged citywideCONTEXT | - |
risk score0The judgment: the receipt shows a penthouse suite - well above a standard room. But a major congress was in town those exact dates, when rates spike and rooms are scarce. With flexible pricing, the bill alone cannot tell you whether the cost came from the suite or the surge. Neocortex surfaces both the upgrade and the context, and routes it for human review instead of crying wolf.
Dinner in two cities, around the same time
Two HCP dinner expenses that the card statement posted on the same date - one in New York, one in Philadelphia, both around 8:30 PM. Structured data reads it as impossible travel and flags it. But a card often posts the wrong date. Watch the receipts settle it.
| Claim A | Dinner, NYC · $138 |
| Claim B | Dinner, Philadelphia · $146 |
| Card-posted date | Both Apr 9 |
| Distance apart | 100 miles |
Same posted date, two cities, same evening - the rules engine reads impossible travel and flags it for review.
reveals
Cleared| Dinner A · NYC | Apr 9 |
| Dinner B · Philadelphia | Apr 9 |
| Reads as | same evening |
| Dinner A · NYC | Apr 9 |
| Dinner B · Philadelphia | Apr 10 |
| Actually | two nights |
risk score0The clear: on the card statement the two dinners looked simultaneous - 100 miles apart, same evening. Credit cards often post a transaction a day off. The receipts carry the true dates: Dinner B was actually the next night. Neocortex reads the receipt dates the structured flag never sees, and clears the false alarm.