Somewhere in your payroll system right now, there could be an employee who doesn’t exist — collecting a paycheck every two weeks, accruing benefits, and draining your bottom line. It sounds like the plot of a crime thriller, but ghost payroll fraud is one of the most common and costly occupational fraud schemes affecting businesses today.
According to the Association of Certified Fraud Examiners (ACFE), payroll fraud schemes have a median duration of 30 months and cause a median loss of $90,000 before detection. For a professional services firm generating $1 million to $10 million in revenue, that kind of loss can devastate profitability, erode trust, and create serious legal exposure.
This guide breaks down exactly how ghost employee schemes work, the warning signs you should watch for, real-world cases that illustrate the damage, and the internal controls that can protect your firm. If you’re building a broader forensic accounting and fraud detection strategy, payroll is the place to start.
Ghost employee fraud occurs when someone — typically a payroll administrator, HR manager, or business owner’s trusted employee — adds a fictitious person to the company’s payroll. The “ghost” employee doesn’t actually work for the company, doesn’t perform any services, and may not even be a real person. Yet they receive regular paychecks, benefits, and sometimes even bonuses.
In some cases, the ghost employee is a completely fabricated identity. In others, it’s a real person — a friend, relative, or former employee — who is listed on the payroll but never shows up to work. The fraudster then diverts the ghost’s paychecks to themselves or to an accomplice.
What makes ghost payroll fraud particularly dangerous is its recurring nature. Unlike a one-time theft, a ghost employee generates fraudulent payments on every single pay cycle. A single ghost earning $50,000 per year costs your business that amount every year the scheme goes undetected — plus employer-side payroll taxes, benefits, and workers’ compensation premiums.
Ghost payroll fraud follows a predictable pattern. Understanding the mechanics helps you spot vulnerabilities in your own processes.
The fraudster adds a fictitious employee to the payroll system. This requires access to HR or payroll software and typically involves fabricating a name, Social Security number, address, and bank account information. In companies with weak onboarding controls, this can be shockingly easy — especially when a single person handles both HR and payroll.
Once the ghost is on the payroll, the fraudster directs payments to a bank account they control. This might be their personal account, a relative’s account, or a newly opened account under the fictitious name. If the company uses paper checks, the fraudster may intercept the checks before they’re mailed or pick them up from a P.O. box.
To avoid detection, the perpetrator takes steps to make the ghost appear legitimate. They may create fake timesheets, enter hours into the time-tracking system, generate fabricated performance reviews, or add the ghost to project rosters. In more sophisticated schemes, they manipulate payroll reports to exclude the ghost from headcount totals or reconciliation documents.
The longer the ghost goes undetected, the bolder the fraudster becomes. They may add additional ghosts, increase the ghost’s salary, or add overtime hours. Because the payments appear as routine payroll, they rarely trigger the same scrutiny as large one-time expenses.
Ghost payroll fraud isn’t theoretical. Some of the most notorious fraud cases in American history involved phantom employees on the books.
While not exclusively a ghost payroll scheme, Rita Crundwell’s fraud — the largest municipal fraud in U.S. history — illustrates what happens when a single person controls financial processes without oversight. As comptroller of Dixon, Illinois, Crundwell diverted $53.7 million over two decades into a secret bank account. She exploited the city’s complete trust in her as the sole financial authority. The fraud was only discovered when a temporary replacement noticed unusual transfers while Crundwell was on vacation. The case, documented by the FBI, remains a stark warning about the dangers of unchecked financial control.
New York City’s public school system has faced repeated scandals involving ghost employees — individuals listed on payroll who either never reported to work or performed no actual duties. Investigations revealed employees collecting full salaries while holding second jobs or simply staying home. In some cases, supervisors knowingly kept these individuals on the rolls as favors, costing taxpayers millions of dollars annually.
For every headline-grabbing case, there are thousands of smaller schemes. A bookkeeper at a 30-person law firm adds her husband to the payroll as an “IT consultant.” A payroll manager at an engineering firm creates a fictitious employee and routes payments to a prepaid debit card. An office manager at a property management company keeps a terminated employee on the books and collects their direct deposits. These schemes typically run between $30,000 and $150,000 before detection, and they’re far more common than most business owners realize.
Ghost employees leave traces. Here are the red flags that should trigger an immediate investigation:
Key Stat: The ACFE reports that tips from co-workers are the #1 way occupational fraud is detected, accounting for 42% of all cases. Create a culture where employees feel safe reporting concerns.
Ghost payroll fraud can happen at any organization, but certain characteristics dramatically increase your exposure:
When a single person handles hiring, payroll processing, and check distribution, the opportunity for ghost employee fraud skyrockets. There’s no second pair of eyes to verify that new employees are real people who actually show up to work. Professional services firms in the $1 million to $5 million revenue range are especially vulnerable because they’re large enough to have complex payroll but small enough to lack robust HR infrastructure.
If one person can add employees, approve timesheets, process payroll, and distribute payments, you have a zero-control environment for payroll. This is the #1 risk factor for ghost payroll fraud.
Rapid turnover creates confusion. When employees come and go frequently, it’s easier for a ghost to hide in the noise. The terminated employee’s payroll record stays active, and no one notices because new names appear constantly.
While direct deposit is more efficient than paper checks, it also removes the physical evidence of unclaimed paychecks sitting in a drawer. With direct deposit, ghost payments flow silently into bank accounts with no visible trail at the office level.
Detection requires a systematic approach. Here’s a step-by-step payroll audit process you can implement immediately:
Pull your complete payroll roster and compare it against your HR system’s active employee list. Every person on the payroll should have a corresponding HR file with an application, offer letter, I-9, W-4, and signed acknowledgment of company policies. Any mismatches require investigation.
Use the IRS’s verification services or the Social Security Administration’s verification system to confirm that SSNs on your payroll correspond to real individuals. Flag any SSNs that don’t validate or that are associated with deceased individuals.
Compare the number of people who actually show up to work against the number of employees on your payroll. For remote employees, verify their identities through video calls and confirm their work output with their managers. This simple step catches a surprising number of ghost employee schemes.
Run a report showing all direct deposit bank accounts. Flag any account that receives payments for more than one employee. Also check whether any employee’s bank account matches a payroll administrator’s account — this is a classic ghost payroll indicator.
Sort employees by address. Legitimate duplicates happen (married couples, roommates), but they should be rare and explainable. Multiple employees sharing the same address as a payroll or HR staff member is a serious red flag.
Review the audit log of your payroll system for recently added employees, rate changes, and bank account modifications. Pay special attention to changes made outside of normal hiring cycles or by users who don’t typically handle onboarding.
Regular bank reconciliation is essential for catching payroll discrepancies. When your bank statements are reconciled promptly and accurately, unauthorized payroll disbursements surface quickly.
Detection is important, but prevention is far more cost-effective. These internal controls create multiple barriers against ghost payroll fraud:
The person who adds new employees to the system should not be the same person who processes payroll or approves payments. At minimum, separate these three functions: (1) employee onboarding, (2) payroll processing, and (3) payment authorization. If your firm is too small for three separate people, ensure that a principal or partner reviews and approves each payroll run before payments are released.
Every new employee added to payroll should require documented approval from a department manager or partner — someone other than the payroll administrator. This single control eliminates most ghost employee schemes because the fraudster can’t unilaterally add fictitious people.
Conduct a full payroll audit at least quarterly. Compare headcount to payroll, verify SSNs, review bank accounts, and examine new hires. Annual audits are not frequent enough — a ghost employee added in January can collect 11 months of paychecks before a year-end audit catches them.
Scheduled audits can be gamed. If the fraudster knows the audit happens every March, they can temporarily remove the ghost and add them back in April. Unannounced, random payroll reviews are significantly more effective at catching active schemes.
Require independent verification of all bank account information before setting up direct deposit for new employees. This means confirming the account holder’s name matches the employee’s name through a voided check or bank letter — not just accepting routing and account numbers submitted on a form.
Use payroll software with role-based access controls and comprehensive audit logs. Every change should be traceable to a specific user with a timestamp. Review these logs monthly as part of your bookkeeping services routine.
| Category | Warning Signs | Detection Method | Prevention Control |
|---|---|---|---|
| Employee Identity | No I-9, missing onboarding docs, unverified SSN | Cross-reference payroll roster with HR files; verify SSNs with IRS/SSA | Require manager sign-off on all new hires; independent SSN verification |
| Bank Accounts | Same account for multiple employees; account matches payroll admin | Run duplicate bank account report monthly | Require voided check or bank verification letter; segregate deposit setup from payroll processing |
| Addresses | Employee address matches payroll staff or other employees | Sort payroll by address; flag duplicates for review | Independent address verification during onboarding |
| Headcount | Payroll count exceeds physical headcount; unknown names on roster | Quarterly physical headcount vs. payroll comparison | Department managers verify their team rosters each pay period |
| Tax & Benefits | No W-4 changes over years; no benefits elections; no tax filings | Annual review of employees with zero benefits activity or unchanged W-4s | Automated alerts for employees with no HR activity for 12+ months |
| Performance | No reviews on file; no project assignments; no email activity | Cross-reference payroll with IT system access logs and project management tools | Tie payroll to active directory/IT accounts; auto-flag employees with no system logins |
| Payroll Processing | Additions made outside normal hiring cycles; changes by unauthorized users | Monthly review of payroll system audit logs | Role-based access controls; dual approval for payroll changes; surprise audits |
Discovering ghost employees on your payroll is alarming, but how you respond in the first 48 hours determines whether you recover your losses or compound the damage. Follow this protocol:
Do not confront the suspected perpetrator or make changes to the payroll system. Export complete payroll records, audit logs, bank account information, and HR files. Create forensic copies of all relevant data. If you alter or delete records, you may compromise a criminal investigation.
A forensic accountant can trace the full scope of the fraud, quantify your losses, identify all fictitious employees, and prepare documentation suitable for legal proceedings and insurance claims. This is not a job for your regular bookkeeper — forensic accounting requires specialized skills in evidence preservation and fraud analysis.
File a report with local law enforcement and consider reporting to the FBI’s Internet Crime Complaint Center (IC3) if the scheme involved electronic transfers. If fabricated SSNs were used, report the identity theft to the IRS. Your forensic accountant can guide you through the reporting process.
If you carry employee dishonesty coverage (also called a fidelity bond) or crime insurance, notify your carrier immediately. These policies typically have strict reporting deadlines, and late notification can void your coverage.
While the investigation proceeds, immediately implement segregation of duties for payroll, change all payroll system passwords, and require dual authorization for any payroll changes. Conduct a full headcount verification and remove any confirmed ghost employees from the system.
Work with your attorney to pursue civil recovery against the perpetrator. In many cases, restitution can be obtained through criminal proceedings as well. Your forensic accountant’s loss quantification will be essential for both civil and criminal recovery efforts.
The most effective defense against ghost payroll fraud isn’t software or policy alone — it’s having independent, professional eyes on your books every month.
When you outsource your bookkeeping to a professional firm, you automatically create segregation of duties. Your internal staff handles day-to-day operations, while an external team independently reconciles accounts, reviews payroll summaries, and flags anomalies. A ghost employee that might go unnoticed for years under internal-only review gets caught in the first monthly reconciliation cycle.
At Steph’s Books, our payroll and bookkeeping processes include:
Professional bookkeeping doesn’t just keep your books clean — it creates the oversight infrastructure that makes payroll fraud nearly impossible to sustain.
Bottom Line: Ghost payroll fraud thrives in environments with concentrated authority and minimal oversight. The median 30-month detection timeline means most schemes run for over two years before anyone notices. By implementing segregation of duties, conducting regular audits, and partnering with a professional bookkeeping firm, you can reduce your detection window from years to weeks.
Don’t wait until you discover a ghost on your payroll. Start with these three steps:
Payroll fraud is preventable. The firms that get burned are the ones that assume it can’t happen to them.
[vc_raw_html]PGRpdiBzdHlsZT0ibWF4LXdpZHRoOiA2MDBweDsgbWFyZ2luOiAwIGF1dG87IHBhZGRpbmc6IDIwcHg7Ij4KPHNjcmlwdCBjaGFyc2V0PSJ1dGYtOCIgdHlwZT0idGV4dC9qYXZhc2NyaXB0IiBzcmM9Ii8vanMuaHNmb3Jtcy5uZXQvZm9ybXMvZW1iZWQvdjIuanMiPjwvc2NyaXB0Pgo8c2NyaXB0PgpoYnNwdC5mb3Jtcy5jcmVhdGUoewogIHJlZ2lvbjogIm5hMSIsCiAgcG9ydGFsSWQ6ICI1MDczMjMzNyIsCiAgZm9ybUlkOiAiZjhlYTE5MmItMDU0ZC00ZGJiLWFkMGYtYjZiYTc0NmFkYWE0Igp9KTsKPC9zY3JpcHQ+CjwvZGl2Pg==[/vc_raw_html]
Get a free quote and see how Steph's Books can save you 40-60% vs hiring in-house.
