Benford's Law and Your Stripe Export: When It Works (and When It Lies)
Benford's Law Meets Your Stripe Export
The most misapplied tool in financial forensics — and the right way to point it at your revenue.
There's a statistical law auditors use to catch cooked books, and it sounds like a magic trick the first time you hear it: in naturally occurring numbers, the leading digit is a 1 about 30% of the time, and the rest fall off in a fixed curve. Deviate from the curve and you may be looking at fabricated figures.
It's real. It's also the most misapplied tool in financial forensics — and a SaaS Stripe export is one of the easiest places to misapply it. Used naively, it flags honest companies and misses real fraud. Used correctly, it's a sharp, cheap first pass. The whole game is knowing when it applies.
The law that nature obeys
Benford's Law — the "first-digit law" — describes how often each digit 1–9 lands in the leading position of real-world numbers:
| First digit | Expected frequency |
|---|---|
| 1 | 30.1% |
| 2 | 17.6% |
| 3 | 12.5% |
| 4 | 9.7% |
| 5 | 7.9% |
| 6 | 6.7% |
| 7 | 5.8% |
| 8 | 5.1% |
| 9 | 4.6% |
The intuition is growth. Picture a value climbing multiplicatively. To get off a leading 1 — to move from 100 to 200 — it has to double. To move from 900 past 1,000 and reset the leading digit, it only has to grow about 11%. So numbers spend far longer wearing a low leading digit than a high one. Anything that compounds — populations, revenues, asset prices — tends to obey the curve.
That's why fabricated books get caught. People inventing numbers spread their digits too evenly or cluster them around comfortable values. The leading-digit curve flattens, and the flattening is the tell.
Why your Stripe subscriptions break it
Here's the trap. Benford's Law only holds for data that spans several orders of magnitude and comes from an organic, multiplicative process. Subscription revenue is neither.
A SaaS with two plans — say $29 and $99 — produces a charge ledger whose leading digits are almost entirely 2s and 9s. The law expects a leading 1 about 30% of the time and a leading 9 about 5%. This company shows the reverse: a wall of 9s, no 1s, almost nothing in between. By the letter of Benford, it looks fabricated.
It isn't. It's just priced.
So a naive Benford test on a column of subscription charges is a false-alarm machine: it condemns every honest SaaS with fixed pricing and says nothing about the dishonest ones. And anyone who waves "we pass Benford's Law" at you on subscription data is telling you they don't understand the tool — or counting on you not to.
The fix isn't to throw the law out. It's to point it at the data it was built for.
Where digit analysis actually bites
A Stripe export isn't only fixed subscription amounts. The parts that do span ranges are where digit analysis earns its keep:
- Usage-based and metered billing — amounts that vary by consumption, from cents to thousands.
- Proration and mid-cycle adjustments — odd, organic figures created by timing, not pricing.
- Refunds and partial refunds — variable by nature.
- Connect / marketplace payouts — aggregated across many underlying transactions, often Benford-friendly.
- Invoice totals with tax, discounts, and multiple currencies — the messiness restores the range the law needs.
Run the digit test on those columns, across a long enough history, and a genuinely organic business sits close to the curve. A ledger someone assembled by hand usually won't — because hand-built numbers carry human fingerprints.
See Using Benford's Law to Reveal Journal Entry Irregularities for the classic accounting use case. Even that reference — the standard one in the field — cautions that ledgers dominated by a handful of recurring amounts won't conform to the curve, which is exactly why a column of subscription charges doesn't.
The tell that survives: round numbers
Even where the leading-digit curve doesn't apply cleanly, one fabrication signature is remarkably durable: humans love round numbers.
Invent a few hundred transactions under pressure and you'll unconsciously reach for values ending in 0 or 00, and for a couple of favorite digits. In organic billing, amounts ending in 00 are rare — tax, proration, and varied pricing scatter the cents everywhere but round. A fabricated ledger inverts that: a suspicious share of clean round totals, and a last-digit distribution that's too uniform to be real.
In a real export, only a small fraction of charge amounts end in 00. In a hand-built one, that share can balloon — and the gap is visible without any fancy statistics.
So the real digit toolkit isn't just Benford's first-digit test. It's the first-digit test where applicable, plus last-digit uniformity and round-number excess — three cheap checks that are hard to beat all at once.
One flashlight, not the whole room
Even at its best, digit analysis only tells you that a set of numbers looks unnatural. It can't tell you the revenue is real — only that the figures weren't obviously typed by a human. A sophisticated fraud can generate amounts that pass every digit test and still be entirely fabricated, because the numbers were machine-built to look organic in the first place.
That's the ceiling on any single statistical trick, and it's why ProofCap doesn't lean on one. A digit test is a flashlight: fast, useful, and blind to most of the room. The question that actually settles it isn't whether the numbers look natural on their own — it's whether the revenue agrees with the behavior and the traffic that should have produced it. Fabricated figures can survive a Benford test. They can't survive being reconciled against sessions that never happened.
Point Benford's Law at the right columns and it's a fine first pass. Just don't mistake the flashlight for the audit.