Payroll fraud is manipulating the payroll process to divert wages, pay people who do not exist, or inflate hours, rates, commissions, and expenses. Because payroll runs on a trusted, repeating schedule, small ongoing thefts blend into normal pay runs and can continue for years.
What is payroll fraud, in plain English?
Payroll fraud is theft that happens through the wage-payment system rather than a cash drawer or a bank transfer. Someone with access to payroll, whether in HR, finance, or a manager approving timesheets, tweaks the inputs so money flows to the wrong place: a fake worker, an inflated paycheck, or a padded expense claim.
The reason it works is that payroll is high-volume, repetitive, and trusted. Every pay cycle moves money to many people automatically, and nobody scrutinizes each line the way they would a one-off payment. A ghost employee earning a modest salary, or a real employee getting a few extra hours each period, disappears into the totals.
Payroll fraud is a specific form of occupational and insider fraud. It is usually enabled by weak oversight, especially when the same person can add employees, approve hours, and set up bank details without an independent check.
The main payroll schemes
Payroll fraud shows up in a handful of recognizable patterns:
Scheme | How it works | Tell in the data |
Ghost employee | A fake or terminated worker stays on payroll and the fraudster collects the pay | Pay to unknown or ex-staff; shared bank details |
Inflated hours | Real employees or managers pad timesheets or overtime | Hours that are not physically possible |
Rate tampering | Pay rates or salaries are quietly raised without authorization | Off-cycle rate changes by the same editor |
Commission and expense | False commissions or padded reimbursements are claimed | Claims that do not tie to real sales or receipts |
Who is involved?
Who | Their role |
The payroll administrator | Controls the master file and bank details; best placed to create ghosts or change pay. |
The approving manager | Signs off timesheets and overtime; can inflate hours for themselves or a team member. |
The colluding employee | Shares a bank account or splits the proceeds of a ghost or inflated paycheck. |
HR and finance controls | Separation of duties and active-employee audits that should catch the mismatch. |
What it looks like in practice
In practice
A payroll administrator keeps a departed contractor active in the system after their contract ends. They change the contractor's direct-deposit details to a second account they control, and the modest biweekly payment keeps landing as if nothing changed.
Nobody notices because the amount matches the old contract and the name is still recognizable. The scheme only surfaces during a routine audit that reconciles the active-employee list against current department headcounts and flags a worker no manager can account for, whose bank details match another employee's.
Why it matters to operators
Payroll fraud is a slow leak, not a spike. Individually the amounts are small enough to ignore, but they recur every cycle and can run for years, so the cumulative loss is large by the time it is found. It also damages trust internally, because the fraudster is usually a trusted member of HR or finance.
The good news is that payroll is structured, comparable data, which makes analytics effective. Employees sharing a bank account, pay going to terminated staff, duplicate deposit details, and impossible hours are all detectable if someone runs the checks. The failure is almost always oversight, not lack of a signal, so separating duties and auditing the active roster are the core defenses.
What to watch in payroll data
- Shared bank accounts. Two or more employees with the same direct-deposit account or address is a classic ghost or collusion marker.
- Pay to terminated staff. Deposits still going to workers who have left is the simplest ghost-employee tell.
- Duplicate deposit details. The same bank account attached to multiple employee records.
- Impossible hours. Timesheets showing more hours than exist in a period, or overtime that never matches real coverage.
- Unauthorized changes. Rate, salary, or bank-detail edits made off-cycle, especially by someone editing their own record.
Quick questions
What is a ghost employee?
A worker on payroll who either does not exist or no longer works there, whose pay is collected by the fraudster. It is one of the most common payroll schemes and often uses a bank account the fraudster controls.
Who usually commits payroll fraud?
Most often someone in payroll, HR, or a managerial role who can add employees, approve hours, or change bank details. It is a form of insider and occupational fraud, and collusion between an approver and an employee is common.
Why is it hard to spot?
Payroll is high-volume and trusted, so individual lines get little scrutiny and small ongoing thefts blend into routine pay runs. Without periodic audits, a scheme can persist for years.
What is the single best control?
Separating the people who add or change employees from those who approve and run payroll, so no one person controls the whole chain. Periodic active-employee audits and validating bank accounts back that up.
How does payroll fraud relate to occupational fraud?
It is a subtype of occupational fraud, specifically asset misappropriation through the wage system. Ghost employees and inflated pay sit alongside procurement and expense schemes under the same insider-fraud umbrella.
Can automation reduce it?
Analytics help by continuously checking for shared accounts, terminated-staff payments, and impossible hours. But automation only works if someone acts on the exceptions and if the duties behind the data entry are genuinely separated.
Go deeper
- FTC Consumer Advice: Scams ↗ — US consumer guidance on current scams and fraud, and how to report them.
- FBI IC3 ↗ — The FBI Internet Crime Complaint Center. Fraud reporting and annual trend reports.