Your payroll runs like clockwork every two weeks. Hundreds ,maybe thousands ,of transactions. Every one of them is trusted, rarely scrutinized. Which is exactly why payroll is one of the most reliably exploited systems in any organization.
Payroll fraud affects 27% of businesses annually and costs an average of $383,000 per case. What makes it especially dangerous isn’t the size of the hit ,it’s how long it hides. The typical payroll fraud scheme runs undetected for 18 to 30 months, quietly bleeding an organization’s finances while the books look perfectly normal from the outside.
Ghost employees and fake timesheets together account for 52% of all payroll fraud cases, making them the two mechanisms your organization is most likely to encounter ,and most likely to miss. Here’s how both schemes work, what they look like in practice, and exactly what you can do to shut them down.
How Ghost Employee Fraud Works
A ghost employee is exactly what it sounds like: a worker who exists on paper and nowhere else ,drawing a salary, collecting benefits, and sometimes accumulating overtime, all while performing zero work.
There are two primary versions of this scheme:
Fictional ghost employees ,A payroll or HR insider creates an entirely fabricated identity, complete with a manufactured Social Security number and a bank account they control. Each pay cycle, the ghost collects a check that flows directly to the fraudster.
Retained ghost employees ,A real former employee is terminated, but never removed from the payroll system. The fraudster ,often someone in HR or payroll who processes the offboarding ,quietly redirects the former employee’s direct deposit to their own account and keeps cashing checks.
Both versions thrive in the same environment: organizations with high employee turnover, large workforces where headcount is hard to monitor, and weak separation of duties between HR and payroll functions.
Real-world example: In a 2023 Chicago case, a nursing home employee named Alisha Richardson was federally indicted after creating fictitious ghost workers, logging fraudulent hours for each of them, and pocketing over $100,000 in fraudulent paychecks before investigators caught up with her.
Common red flags of ghost employee fraud:
- Multiple employees sharing the same bank account number or mailing address
- Payroll expenses rising without a corresponding increase in headcount
- Employee names on the payroll that no current manager can identify
- Former employees still appearing on the active payroll register
- Paychecks being issued as physical checks for employees who previously used direct deposit
If any of these patterns sound familiar, our breakdown of the 10 red flags your accountant might be embezzling covers the behavioral warning signs that typically accompany this kind of internal scheme.
How Fake Timesheet Fraud Works
Timesheet fraud is broader, more common, and often harder to prosecute because the employee in question is genuinely employed ,they’re just stealing time rather than creating a fictitious identity.
The mechanics vary, but the most prevalent forms include:
Buddy punching ,One employee clocks in or out on behalf of a coworker who isn’t present. The absent employee collects wages for hours never worked. This scheme is so common it has its own industry term, and it’s a form of collusion that can involve entire departments when left unchecked.
Hour inflation ,An employee manually submits timesheets with inflated hours, or makes small adjustments ,rounding up by 15 or 30 minutes per shift ,that accumulate significantly over months. A pattern of perfectly round-number overtime entries (exactly 10.00 hours, week after week) is a textbook detection signal.
Supervisor manipulation ,In some cases, a manager or payroll insider alters an employee’s recorded hours in exchange for a kickback, creating a two-person scheme that’s harder to catch than one acting alone.
Internal payroll clerk schemes ,A payroll administrator changes their own pay rate, adds unauthorized overtime, or adjusts their classification ,taking advantage of the access they’ve been entrusted with.
The financial damage accumulates fast. One Midwestern manufacturing facility lost over $25,000 in just six months before a supervisor noticed that one employee was clocking in three coworkers each morning before they arrived.
Timesheet fraud is especially prevalent in organizations with hourly workforces, paper-based timekeeping, remote or hybrid work arrangements where physical presence can’t be verified, and minimal supervisory review of payroll data before processing. To understand what a professional investigation looks for when tracing these schemes, see what evidence fraud investigators actually look for.
Why Payroll Fraud Goes Undetected for So Long
Eighteen to thirty months is a long time for money to walk out the door. The reason these schemes persist isn’t incompetence ,it’s structural.
Most payroll fraud succeeds because of four consistent organizational failures:
- Inadequate separation of duties ,When the same person who adds employees to the system also processes payroll and reconciles accounts, there are no independent checkpoints to catch manipulation.
- Absence of mandatory leave policies ,Fraud examiners consistently flag employees who refuse to take vacation or delegate their duties as elevated-risk individuals. The scheme falls apart the moment someone else handles their work.
- Infrequent or superficial payroll audits ,Monthly or quarterly payroll reconciliations are often treated as a rubber stamp rather than a genuine analytical review.
- Over-reliance on trust ,Payroll and HR staff occupy positions of significant trust. The assumption that trusted employees wouldn’t steal is not an internal control.
These vulnerabilities are well documented in the ACFE’s 2024 Report to the Nations, which found that organizations without anti-fraud controls suffer median fraud losses more than twice as high as those with robust programs in place.
For a comparison of how these internal schemes differ from external threats, internal fraud vs. external fraud: key differences for businesses lays out the full picture.
How to Detect Payroll Fraud Before It Becomes a Crisis
Detection isn’t complicated ,it requires consistency and independence. Here’s what works:
Conduct a payroll headcount reconciliation monthly. Compare the number of active employees in your HR system against the number of paychecks issued. Any discrepancy is a finding that requires explanation, not assumption.
Cross-reference payroll data against external records. Match employee Social Security numbers, addresses, and bank accounts against HR records. Flag any duplicates immediately.
Implement automated exception reporting. Configure your payroll system to flag unusual activity: overtime above a defined threshold, pay rate changes without HR approval, new direct deposit accounts added within 30 days of hire, and off-cycle manual checks.
Require mandatory consecutive leave. Rotate payroll duties when employees take time off. Fraud schemes that survived for years have been discovered in a matter of days when a substitute processor notices an anomaly.
Conduct unannounced payroll audits. Surprise reconciliations are significantly more effective than scheduled reviews because the fraudster has no opportunity to clean up their trail in advance.
Deploy biometric time and attendance systems. Studies show that integrated biometric timekeeping ,fingerprint or facial recognition ,can reduce fraud-related payroll losses by as much as 65% compared to swipe card or paper-based systems.
If you’re unsure whether your situation has already crossed the line into something requiring professional review, fraud investigation vs. internal audit: when you need each is a practical guide to making that call.
What to Do If You Suspect Payroll Fraud Right Now
Suspicion is not the same as proof ,and acting without proof can create serious legal exposure for your organization. Before you confront anyone:
- Preserve all payroll records without alerting the suspected employee. This means banking transaction records, timesheet submissions, payroll registers, and audit logs.
- Quantify the potential loss using forensic accounting methods ,not rough estimates.
- Consult legal counsel before any confrontation, termination, or law enforcement referral.
- Engage a professional fraud examiner to document findings in a format that will hold up in court, an insurance claim, or regulatory review.
Acting on suspicion before you have documented evidence is one of the most common ,and costly ,mistakes organizations make. Our guide on what to do if you suspect employee theft before confronting them walks through this process step by step.
Frequently Asked Questions
Q: How do ghost employees go undetected for so long? They exploit the same structural weakness in almost every case: one person controls both the addition of employees to the system and the processing of payroll. Without an independent reviewer checking headcount against paychecks issued, the ghost can collect wages indefinitely. Remote work environments have made this even more difficult to catch, since physical presence is no longer a natural verification mechanism.
Q: Is buddy punching considered serious fraud or just a minor policy violation? It’s both a policy violation and a potentially criminal act. When buddy punching results in an employee receiving wages for hours they never worked, it constitutes wage theft ,which is a form of fraud under federal and state law. Organizations that treat it as a minor HR issue and not a financial crime create environments where larger schemes can grow unchallenged.
Q: What’s the most effective first step in detecting payroll fraud? A payroll-to-headcount reconciliation is the highest-yield first step. Compare the number of active employee records in your HR system against the number of paychecks actually issued each cycle. Any variance that can’t be immediately explained by timing differences is a red flag that warrants investigation.
Q: Can technology fully prevent payroll fraud? Technology significantly reduces risk, but it doesn’t eliminate it. Biometric timekeeping, automated exception alerts, and AI-driven anomaly detection are powerful tools ,but they work best when paired with strong internal controls, segregated duties, and a culture where employees know that fraud will be detected and prosecuted. No software replaces good governance.
Q: Should I report payroll fraud to law enforcement or handle it internally? Both options are available, and the right choice depends on the scale of the loss, the strength of your evidence, and your recovery objectives. For substantial losses, criminal reporting creates the possibility of court-ordered restitution ,which has significant advantages over civil judgments, including non-dischargeability in bankruptcy. When to hire a private fraud investigator vs. a lawyer covers this decision in detail.
Q: Can FraudOrder help investigate suspected payroll fraud? Yes. FraudOrder provides professional fraud investigation support, including payroll record forensics, timesheet analysis, and financial tracing ,all documented to evidentiary standards. Visit fraudorder.co to discuss your situation confidentially with no obligation.
References
- Association of Certified Fraud Examiners. (2024). Report to the Nations: Occupational Fraud and Abuse. https://www.acfe.com/report-to-the-nations/2024/
- Sumsub. (2025). Payroll Fraud: Schemes, Examples & How to Prevent Them in 2025. https://sumsub.com/blog/payroll-fraud/
- Moore Colson. (2025). Tightening Controls on Ghost Employees and Vendor Fraud. https://moorecolson.com/news-insights/the-cost-of-the-unseen-tightening-controls-on-ghost-employees-and-vendor-fraud/
- Clearly Acquired. (2025). Ultimate Guide to Payroll Fraud Detection. https://www.clearlyacquired.com/blog/ultimate-guide-to-payroll-fraud-detection
- Lift HCM. (2025). Payroll Fraud Signs: Red Flags Every Business Owner Should Watch For. https://lifthcm.com/article/payroll-fraud-signs-red-flags-prevention
- HireLevel. (2025). Payroll Fraud Risks in 2025 & How to Protect Your Business. https://hirelevel.com/2025/04/21/payroll-fraud-risks-in-2025-how-to-protect-your-business/
- EisnerAmper. (2024). Protecting Your Organization from Employee & Payroll Fraud Schemes. https://www.eisneramper.com/insights/blogs/forensic-litigation-valuation-blog/payroll-fraud-flvs-blog-1119/
- Papaya Global. (2025). Ghost Employee Fraud: Strategies for Detection and Prevention. https://www.papayaglobal.com/blog/ghost-employee-fraud-detection-and-strategies/
- U.S. Department of Justice. (2025). Fraud Enforcement Resources. https://www.justice.gov/criminal/criminal-fraud
- FBI. (2024). White-Collar Crime Overview. https://www.fbi.gov/investigate/white-collar-crime
Disclaimer: This article is for informational and educational purposes only. It does not constitute legal, financial, or professional advice, and reading it does not create a client relationship of any kind. Every fraud situation is unique ,consult a qualified attorney, forensic accountant, or certified fraud examiner before taking action in your specific case. For questions about FraudOrder services, visit https://fraudorder.co/