Common Payroll Frauds Explained: Ghost Employees, Phantom Vendors and More
Payroll is one of the largest expenses a business carries — and, for that reason, one of the most attractive targets for fraud.
Sometimes, the perpetrator is an outside party who found a crack in your system. But it could just as easily be a trusted employee, or even a manager with unchecked authority. But no matter who’s committing it, payroll fraud can bleed a company quietly for months or even years before anyone notices.
That’s why it’s so important to be familiar with the most popular schemes and know what to watch out for.
Read on as we discuss some of the most common payroll frauds. Understanding how these schemes work is the first step toward stopping them.
What Is Payroll Fraud?
Payroll fraud occurs when someone manipulates a company’s payroll process to illegally divert funds. It can take many forms, from simple timesheet inflation to sophisticated multi-layered schemes involving fake employees or vendors.
According to the Association of Certified Fraud Examiners, payroll fraud makes up about 15% of all occupational fraud at U.S. and Canadian businesses. This type of fraud tends to last 18 months on average, at an estimated cost of $2,800 a month, or $50,400 annually, a figure that can be devastating to a small or midsize company.
Common Payroll Frauds
Now, let’s look at some of the most popular ways people try to sap company payrolls.
The Ghost Employee Scheme
One of the most common payroll frauds is also one of the most damaging: the ghost employee scheme.
In this scenario, a fraudster, typically someone with access to the payroll system, adds a fake person to the payroll. This “ghost” never shows up for work because they don’t actually work for the company. This could be a real person, such as a friend or family member of the perpetrator, or a former employee who was never removed from the system. It could even be an entirely made-up individual.
But whoever the “ghost,” they’re being paid for work they never perform. The fraudster routes the ghost’s paychecks to an account they control, collecting the wages indefinitely.
These schemes are particularly insidious because the paychecks look legitimate on the surface and can easily blend into a large payroll run.
Phantom Vendors in the Payroll Process
Phantom vendor fraud is when a dishonest employee creates a fake vendor, submits invoices for services never rendered and directs payment to an account they control.
Technically, this is typically an accounts payable issue, not a payroll issue. However, it intersects with payroll when a ghost worker is classified as an independent contractor rather than an employee (aka worker misclassification). This can make the fraud harder to detect because contractor payments may receive less scrutiny than regular payroll, and 1099 documentation can be fabricated or omitted entirely.
Worker misclassification can be used fraudulently in a different way, too. Sometimes managers will misrepresent employee roles as contractor roles to avoid certain employee costs, such as benefits and payroll taxes.
Timesheet and Hours Manipulation
Not all payroll fraud involves fictitious people. A very common and frequently underestimated scheme involves real employees manipulating their reported hours. Workers might clock in for colleagues who aren’t present (a practice known as “buddy punching”), falsify overtime hours or report hours on days they didn’t actually work.
Managers can perpetrate this fraud as well, by approving inflated hours for subordinates in exchange for kickbacks or simply by manipulating their own time records. Over time, even modest daily exaggerations can add up to significant losses.
Payroll Diversion
Often an “outside” job, payroll diversion is when a criminal impersonates an employee to have their direct deposit paychecks redirected to their own bank account. Attackers will use phishing or stolen credentials to access payroll systems and change account information.
Expense Reimbursement Fraud
Expense reimbursement fraud is one of the most widespread and easy-to-overlook payroll-adjacent schemes, precisely because it relies on a process that employees use legitimately every day. In these schemes, employees submit false or inflated expense claims to receive reimbursements they haven’t earned.
Reimbursement fraud is particularly difficult to catch in organizations where expense approvals are cursory or where managers approve their own reports without a secondary review. Businesses that rely on an honor system rather than a documented policy with receipt requirements and spending limits are especially vulnerable.
Unauthorized Bonuses and Off-Cycle Payments
Bonus fraud occurs when someone with payroll system access issues bonus payments that were never approved, either to themselves or to co-conspirators. Bonuses are often processed separately from regular payroll runs and might not follow a predictable schedule. Thus, they can be easier to slip through without triggering immediate scrutiny.
The risk is higher in businesses where bonus criteria are loosely defined or where a single individual has the authority to both approve and process compensation changes.
Unauthorized Pay Rate Changes
Another common scheme involves altering an employee’s pay rate in the system. This may be either the fraudster’s own rate or that of a co-conspirator.
Small adjustments, such as changing an hourly rate from $22.00 to $24.50, can easily go unnoticed in a busy payroll run, especially if no one is reconciling rates against employment agreements on a regular basis.
Preventive Controls That Make a Difference
The good news? You can prevent business fraud with the right financial controls in place. Key measures to ward off payroll fraud schemes include:
- Segregation of duties. No single employee should have end-to-end control over the payroll process. The person who enters payroll data should not be the same person who approves it or reconciles the accounts.
- Regular payroll audits. Periodically reviewing payroll records, including cross-referencing employee lists against HR records, verifying pay rates and confirming that terminated employees have been removed, can catch anomalies early.
- Supervisor approval requirements. Overtime, schedule changes, and new vendor or contractor setups should require documented approval from someone outside the payroll department.
- Mandatory vacations and job rotation. Fraudsters often need ongoing access to keep up their schemes. Requiring employees to take consecutive days off and rotating duties can expose schemes that depend on continuous individual control.
- Whistleblower policies. Encouraging employees to report misconduct without fear of retaliation doesn’t just create an ethical culture; it also helps catch problems early, avoid costly investigations or lawsuits and protect your company’s reputation and bottom line.
- Technology and access controls. Payroll software should log all changes. It should also have alerts triggered by unusual activity such as new direct deposit accounts, rate changes or additions to the employee roster outside of normal onboarding periods.
- Third-party payroll review. Engaging an outside accounting or forensic professional to review your payroll process periodically adds an objective layer of scrutiny that internal teams may miss.
What to Do If You Suspect Payroll Fraud
If you notice warning signs, such as unexplained increases in payroll costs, employee complaints about discrepancies or anomalies in your payroll reports, do not attempt to investigate alone. Alerting the suspected perpetrator too early can result in evidence being destroyed.
Instead, document what you’ve observed. Restrict access where possible. And bring in a qualified forensic accountant to conduct a formal review. Acting quickly and carefully preserves your ability to recover losses and pursue legal remedies.
Protect Your Business From Common Payroll Frauds (And More)
Payroll fraud can quietly drain a company for years, but with the right oversight and expertise, it can be detected, stopped and prevented.
McManamon & Co. provides both fraud deterrence and investigation services to small and midsize businesses. We provide fraud risk assessments, where we analyze your operations to identify risk areas so they can be better managed and mitigated. We also provide assistance with the design and implementation of fraud deterrence systems. And if you’re currently facing a fraud or corruption situation, our fraud examiners and forensics accountants can uncover the facts and get to the root of the problem.
Let us help you bolster your defenses. Call us at 440.892.8900 or contact us online today.
Tags: fraud, identity theft, small business, small business accounting, small business finances, small business fraud | Posted in Fraud, McManamon & Co.