Benford's Law

Benford's Law
Also known as	First-digit law, Newcomb–Benford law, law of anomalous numbers
Formula	P(d) = log10(1 + 1/d)
First digit "1"	≈ 30.1%
Named for	Frank Benford (1938)
First noted by	Simon Newcomb (1881)
Fraud use	Digital analysis of unconstrained financial data

Benford's Law (the first-digit law) is the empirical observation that in many naturally occurring collections of numbers, the leading digit is not uniformly distributed. Instead, the digit 1 appears as the first significant digit about 30.1% of the time, 2 about 17.6%, and so on in decreasing probability down to 9, which leads only about 4.6% of the time. Because honest financial data drawn from real economic processes tends to conform to this distribution, a marked departure can indicate that figures have been invented, rounded, or manipulated. This makes Benford's Law a widely taught tool of digital analysis within analytical methods for fraud detection.^[1]

1 The law and its formula

For the leading digit d (where d ∈ {1, 2, …, 9}), Benford's Law gives the expected probability as:

P(d) = log10(1 + 1/d)

The logarithm is base 10. The intuition is that data spanning several orders of magnitude spends proportionally more "time" with a leading 1 than with a leading 9 as it grows multiplicatively — a set of values distributed uniformly on a logarithmic scale produces exactly this pattern. The expected frequencies for each first digit are:

First digit d	P(d) = log10(1 + 1/d)	Expected frequency
1	log10(2)	30.1%
2	log10(3/2)	17.6%
3	log10(4/3)	12.5%
4	log10(5/4)	9.7%
5	log10(6/5)	7.9%
6	log10(7/6)	6.7%
7	log10(8/7)	5.8%
8	log10(9/8)	5.1%
9	log10(10/9)	4.6%

The frequencies sum to 1. Analogous laws exist for the second digit (which is more nearly uniform), for first-two-digit combinations (10 through 99), and for last digits, all of which examiners use to localize anomalies more precisely than the first digit alone. The first-two-digit test is especially useful in fraud work: it produces 90 expected frequencies rather than 9, so a spike at a specific pair — say, an over-representation of amounts beginning "49" just below a $5,000 approval limit — points directly at threshold-driven manipulation that a first-digit test alone would blur.

2 History

The phenomenon was first documented by the astronomer and mathematician Simon Newcomb in 1881, who noticed that the early pages of logarithm tables — those beginning with low digits — were far more worn than the later pages, and inferred that numbers beginning with 1 occur more often. Newcomb even stated the logarithmic frequencies, but his note attracted little attention.^[2] The law was rediscovered and popularized in 1938 by the physicist Frank Benford, who tested more than 20,000 numbers drawn from disparate sources — river drainage areas, physical constants, street addresses, populations, and figures from newspapers — and found the same leading-digit distribution recurring across them. The law now carries his name, though it is sometimes credited as the Newcomb–Benford law in recognition of the earlier observation.^[2]

3 Application to fraud detection

Benford's Law entered fraud examination because fabricated numbers rarely obey it. When a person invents figures — padding an expense report, manufacturing invoices, or smoothing earnings — they tend to distribute leading digits too evenly, to over-use middle digits that "look random," or to cluster values just under psychological or approval thresholds. A Benford test compares the observed first-digit distribution of a dataset (for example, all disbursements, journal-entry amounts, or reported account balances) against the expected distribution and measures the goodness of fit, commonly with a chi-square statistic or the mean absolute deviation. Digits that appear far more or far less often than predicted flag a stratum of transactions for manual review. The technique is attractive because it is cheap, scalable to entire transaction populations, and difficult for a fraudster to defeat without knowing the law. In practice it is one screen among several in analytical methods, and its hits are treated as leads that direct sampling, not as proof of wrongdoing.^[1]

4 Requirements for a valid test

Benford's Law only applies to data that meets certain conditions. Applying it to unsuitable data produces false alarms and false comfort in equal measure. Generally accepted requirements are:

• Large sample — commonly cited as more than 500 data points, and ideally many thousands, so that the expected small-percentage digits are populated.
• Unconstrained values — the numbers must not be assigned or bounded by external rules. Sequentially assigned invoice or check numbers, ZIP codes, telephone numbers, and prices set at $X.99 do not conform.
• Spanning several orders of magnitude — the data should range from small to large (e.g., from single dollars to millions), not cluster in a narrow band such as amounts between $40 and $60.
• No built-in minimum or maximum — imposed floors or ceilings (like a $10,000 reporting threshold) distort the leading-digit distribution.
• Result of a natural or multiplicative process — combinations of many numbers (transaction totals, populations, market values) conform better than tightly engineered figures.

Disbursement amounts, general-ledger balances, and reported financial-statement line items typically satisfy these conditions, which is why the law is most often used against them.

5 Limitations

Benford's Law is a screening tool, not a test of guilt. Conformity does not prove data is clean — a sophisticated manipulator who understands the law can craft figures that conform — and non-conformity does not prove fraud, because legitimate data can fail the test for benign reasons: too small a sample, a constrained range, price points, assigned numbers, or a genuinely unusual but honest business. Statistically, with very large datasets even trivial and lawful deviations become "significant," inflating false positives; with small datasets the test lacks power. It is also blind to schemes that do not alter the leading-digit profile, such as a small number of large fictitious transactions buried in a huge conforming population. For these reasons the law is deployed alongside ratio, trend, and link analysis, and any hit is corroborated with source documents before conclusions are drawn.^[1]

6 Recent research

Contemporary scholarship continues to validate and extend Benford-based detection. Gorenc (2019) examined the law specifically as a tool to determine fraud in financial statements, testing its diagnostic value on reported figures.^[1] More recent work integrates Benford features into broader models: Gepp and colleagues (2024) situate Benford's Law within a reframed "fraud detection triangle," combining the digit test with other indicators for stronger predictive performance,^[3] and studies pairing Benford's Law with machine-learning classifiers report improved discrimination between fraudulent and legitimate records over either approach alone.^[4] These developments position the first-digit law less as a stand-alone verdict and more as a feature within modern predictive analytics for fraud.

See also: Analytical Methods, Financial Statement Fraud, Red Flags.

References

1. Gorenc, M. "Benford's Law as a Useful Tool to Determine Fraud in Financial Statements." 2019. doi:10.26493/1854-4231.14.19-31
2. Newcomb, S. "Note on the Frequency of Use of the Different Digits in Natural Numbers." 1881; Benford, F. "The Law of Anomalous Numbers." 1938. (historical origin; general knowledge)
3. Gepp, A. et al. "Fraud Detection Triangle" (with Benford's Law). Accounting & Finance, 2024. doi:10.1111/acfi.13192
4. "Benford's Law and machine learning for financial-statement fraud detection." Old Dominion University, 2025. (Benford + ML)