---
title: "Benford's law, and when it lies to you"
author: "Priya Nagarajan (@ledger)"
date: 2026-01-01T08:33:38.256Z
updated: 2026-01-01T08:33:38.256Z
canonical: "https://jot.place/@ledger/benfords-law-and-when-it-lies-to-you"
description: "The digit distribution, the formula, and the five boring reasons honest data fails it. Plus the arithmetic showing how big a fraud has to be before the test notices."
tags:
  - "accounting"
  - "evidence"
  - "fraud"
  - "maths"
  - "measurement"
---

# Benford's law, and when it lies to you

I have watched a barrister hold up a bar chart of leading digits and describe it to a court as evidence of fabrication. The chart was drawn correctly. The arithmetic behind it was correct. The conclusion was rubbish, and it took forty minutes of cross-examination to get that across, which in courtroom time is a geological era.

So: the distribution first, then the five situations where entirely honest data fails it.

## The distribution

Take a set of numbers that runs across several orders of magnitude and is not fenced in by anything. The probability that the leading significant digit is $d$ is

$$P(D_1 = d) = \log_{10}\left(1 + \frac{1}{d}\right), \qquad d \in \{1, 2, \ldots, 9\}$$

| Leading digit | Probability | Percent |
|---|---|---|
| 1 | 0.3010 | 30.10 |
| 2 | 0.1761 | 17.61 |
| 3 | 0.1249 | 12.49 |
| 4 | 0.0969 | 9.69 |
| 5 | 0.0792 | 7.92 |
| 6 | 0.0669 | 6.69 |
| 7 | 0.0580 | 5.80 |
| 8 | 0.0512 | 5.12 |
| 9 | 0.0458 | 4.58 |

Base 10 is not special. In base $b$ the same argument gives $\log_b(1 + 1/d)$. The law survives a change of units because multiplying every figure by a constant is a shift along the log axis, and the mantissa distribution is uniform along that axis, so it does not notice. Convert a ledger from Singapore dollars to euro and the digit profile barely moves. Theodore Hill's 1995 paper, "A Statistical Derivation of the Significant-Digit Law", gets the whole thing out of invariance conditions rather than out of any particular pile of data, which is the right way round.

Three figures worth carrying. Digit 1 leads $\log_{10} 2 = 0.3010$ of the time. Digits 1, 2 and 3 together lead $\log_{10} 4 = 0.6021$ of the time, so three of the nine digits take 60 percent of the file. And the effect dies quickly: at the second digit the spread runs from 11.97 percent for a 0 down to 8.50 percent for a 9, and by the fourth digit everything is within a hair of 10 percent.

Simon Newcomb noticed the pattern in 1881. Frank Benford published "The Law of Anomalous Numbers" in the Proceedings of the American Philosophical Society in 1938, with a much larger pile of data, and got the name. Hal Varian suggested in 1972 that it might be used to check socio-economic figures submitted in support of public planning decisions, on the reasoning that people who invent numbers spread their digits too evenly. Mark Nigrini built the forensic machinery around it; his 2012 book for Wiley, Benford's Law: Applications for Forensic Accounting, Auditing, and Fraud Detection, is still the standard reference and my copy has a broken spine.

## Five ways honest data fails

### The file spans one order of magnitude

Expense policy is the usual culprit. A subsistence claim has a floor (below it you do not bother) and a ceiling (above it you need approval), so the whole population lands between roughly 20 and 95 units of currency. Leading digit 1 is now impossible. Draw uniformly across that interval and digits 2 to 8 each take 13.33 percent while 9 takes 6.67 percent, because only 90 to 95 qualifies. Every conformity test in the literature will scream. Nothing is wrong. The policy did that.

Heights, exam marks, interest rates and hourly rates inside a single grade are the same problem. Check the range before you run anything.

### The numbers were assigned rather than measured

Invoice numbers, purchase order numbers, cheque numbers, claim references, staff numbers, general ledger codes, IBANs. These are labels. They were issued by a counter or by a person with a preference, and their digits describe the issuing system rather than the world. The own goal I see most often is somebody running the digit test on the invoice number column, because in a filthy extract the invoice number column is the only clean one.

### Prices, and round numbers that humans negotiated

Retail pricing puts a wall of 9s at the front of everything through 9.99, 19.99, 199. Contracts do the opposite: a client of mine had a revenue line that was almost entirely monthly retainers at 8,500 and 12,000, twelve times each, for years. Rent, premiums, licence fees and anything a person signed at a table cluster where people like to sign. Those digits are recording human taste, which is real, and not a distribution.

### The sample is small

This one is my favourite because the literature caused it. Pearson's chi-square gets criticised for excess power: give it a big enough sample and it rejects conformity over deviations nobody cares about. Nigrini's answer was the mean absolute deviation with fixed cutoffs, on the argument, quoted in Cerqueti and Lupi's paper on severe testing, that "what is needed is a test that ignores the number of records" and that MAD is such a test.[^1]

It is not such a test. Cerqueti and Lupi derive the asymptotic distribution and show that both the mean and the standard deviation of MAD go as $1/\sqrt{n}$. Here is what that means in practice. I generated first-digit data that conforms to Benford exactly, by construction, and took the average MAD:

| Records | Average MAD of perfectly conforming data |
|---|---|
| 50 | 0.0332 |
| 100 | 0.0234 |
| 500 | 0.0105 |
| 1,000 | 0.0075 |
| 10,000 | 0.0024 |

Every row is honest. Whatever fixed threshold you pick, it convicts the top of that table and acquits the bottom, and the published thresholds are not even consistent between editions.

### The file is really six files stacked

A group payables extract that is 70 percent payroll and 30 percent capital spend is two populations sharing a header row. Payroll is narrow band and enormous in count, so it drives the histogram, and the capex, which is the interesting part, contributes almost nothing. Split by ledger, entity, currency and approver, then test. Usually the split is the finding.

## What a fraud actually does to the histogram

Here is the arithmetic that changed how I use this. Twelve thousand payments, distributed exactly per the table above. Somebody raises 60 fabricated invoices at 4,800 each, sitting just under a 5,000 approval limit. That is 288,000 stolen.

Expected count for leading digit 4 was $0.0969 \times 12{,}000 = 1{,}163$. Observed is 1,223 out of 12,060, so 10.14 percent against an expected 9.69 percent. Chi-square on eight degrees of freedom comes out at 2.800, which gives $p = 0.79$. That is a data set behaving impeccably.

To push the same file past the 5 percent level you need about 142 fabricated invoices, roughly 682,000. So in that file, the detection threshold of a first-digit test sits somewhere north of half a million. Most of the matters that cross my desk are smaller than that, and not one of them was found this way.

:::tip
If you are going to run it anyway, run the first-two-digits version with its 90 bins, plot it, and read the spike positions instead of the p value. A bulge at 48 and 49 is not a statistical result, it tells you where somebody's approval limit is. That is a place to point a human being.
:::

## What it is actually for

A digit test decides which 300 of 40,000 transactions you open first. That is genuinely useful and I use it most months. It is a sampling instrument, and it is cheaper than the alternatives.

Presented as a finding it is worse than useless, because it is persuasive. It has a formula, it plots beautifully, and it produces a number with a p in front of it, so it walks into a hearing wearing the clothes of evidence. A failed Benford test is consistent with fraud, with a policy limit, with a lazy data extract, with a merger halfway through the year, and with nothing at all. A passed test exonerates nobody, because a competent thief has taken 0.4 percent of the volume and the histogram cannot see them.

The expert report I want to read says: the digit profile of the payables ledger deviates at 48 and 49, we therefore examined all 611 payments in that band, and here are the seven that had no purchase order. The digit test is in the method section, where it belongs. Dr Kruger has written the same complaint from the other end of the building, about people reading a p value as though it were a result: @panacea/how-to-read-a-supplement-study-in-nine-minutes.

The barrister, to be fair, took it well. His instructing solicitor did not.

[^1]: Roy Cerqueti and Claudio Lupi, "Severe testing of Benford's law", arXiv:2202.05237. The quoted line is Nigrini's own, from the 2012 book, reproduced in their section 1.