- Payroll fraud means paying money the company does not owe. The ACFE describes payroll schemes as employees causing the employer to issue payment through false claims for compensation.
- In the ACFE's 2024 study, payroll schemes were about 10% of cases worldwide and 15% in North America. The median loss was $50,000, and cases ran about 18 months before detection.
- The main schemes are ghost employees, falsified hours or overtime, payroll diversion, and unauthorized pay changes.
- A payroll error is not the same as fraud, but the data checks overlap. A flag is a reason to look, not proof.
- Many schemes only show up when you compare payroll with the HR system and the ledger. Single-system review misses them.
- Controls matter as much as detection: separate duties, confirm changes independently, and review the payroll register every run.
Payroll fraud is easy to miss because payroll runs on a schedule and the totals tend to look normal. A fake employee, a padded timesheet, or a redirected deposit can sit inside a stable payroll for months.
The Association of Certified Fraud Examiners (ACFE) found that payroll schemes made up about 10% of the fraud cases in its 2024 study, with a median loss of $50,000 per case. In North America the share was higher, at 15%.
This guide explains the main types of payroll fraud, the red flags that point to ghost employees and other schemes, the data checks that catch them across payroll, HR, and the ledger, and the controls that make them harder to commit.
What Is Payroll Fraud?
Payroll fraud is any deliberate scheme that causes a company to issue pay it does not owe, whether through fake employees, false hours, unauthorized pay changes, or redirected payments.
The ACFE defines payroll schemes as a fraudulent disbursement in which an employee causes the employer to issue a payment by making false claims for compensation. It places them under asset misappropriation, the most common category of occupational fraud.
Most payroll fraud comes from inside the company, but not all of it. Three groups are worth separating:
Insiders. Employees, managers, or payroll and HR staff who abuse access or collude.
Outsiders. Criminals who impersonate an employee by phishing or account takeover to change bank details.
Errors that look like fraud. Mistakes such as a terminated employee left active or a run posted twice. These need fixing, but they are not fraud unless someone intended them.
For the error side, see our guide to payroll errors.
How Common Is Payroll Fraud?
The best public data is the ACFE's Occupational Fraud 2024: A Report to the Nations. It analyzed 1,921 cases across 138 countries, so it is a global study, not a US-only one.
Across payroll fraud cases in the data, schemes were about 10% of all cases (190 cases), with a median loss of $50,000.
Summaries of the report put the median time to detect a payroll scheme at about 18 months, which is roughly $2,800 in losses for each month it runs.
In North America, payroll schemes were 15% of cases.
Construction showed the highest share within a single industry, at 23% of that industry's cases, ahead of government at 18%.
Across all fraud types, tips detected 43% of cases, while automated transaction and data monitoring detected 3%. Organizations with proactive data monitoring had a median loss of $100,000, versus $200,000 for those without it.
Read that last pair carefully. Monitoring rarely makes the first catch. Where it exists, losses are smaller.
The Main Types of Payroll Fraud
| Scheme | How it works | Typical red flag | Where to look |
|---|---|---|---|
| Ghost employee | A person who does not work for the company is added to payroll, or a former employee is left active, and the pay is collected | Payroll record with no matching HR record, no time records, or shared bank details | Payroll register against the HR employee list |
| Falsified hours or overtime (timesheet fraud) | Hours or overtime are overstated, sometimes with a supervisor's help | Overtime that does not match schedules or approvals | Timesheets, approvals, and overtime by supervisor |
| Buddy punching and time theft | One employee clocks in for another, or claims time not worked | Identical clock-in times, or hours with no activity | Time system logs against payroll hours |
| Payroll diversion | A criminal impersonates an employee and changes the direct deposit account | A bank detail change shortly before a pay run | Change log for bank details, and confirmation records |
| Unauthorized pay changes | Rates or bonuses are raised without approval | A rate change with no approver or effective date | Compensation change history |
| Commission or bonus manipulation | Sales or targets are inflated to raise variable pay | Commission growing faster than revenue | Variable pay against source sales records |
| Paying terminated employees | A departed employee stays active, by error or on purpose | Pay after the termination date | Termination dates against payroll history |
Some sources add worker misclassification and duplicate payments. Misclassification is usually an employer-side compliance issue, and duplicate payments are often errors, so they are treated separately here.
Ghost Employees: How They Get on Payroll
Ghost employee fraud is the best-known payroll scheme. A ghost employee is someone on payroll who does not actually work for the company. There are three common versions.
A fictitious person. A made-up name is added to payroll and the pay is collected.
A former employee left active. The record should have been closed, but pay continues.
A real person who is not working. Someone is on payroll for a role that does not exist, sometimes as a favor.
Ghost employees usually need a weakness in the process. Typical causes are one person who can both add employees and approve payroll, no independent confirmation that a new hire is real, and no regular comparison between payroll and HR.
Red Flags to Watch For
Red flags are signals. Each one has an innocent explanation more often than not, so treat them as reasons to check the records.
Process and people
- One person can add employees, change pay, and approve the payroll run.
- Payroll or HR staff who never take time off, or who resist others reviewing their work.
- Last-minute or off-cycle changes, especially near deadlines.
- Employees who are hard to reach, never seen, or unknown to their listed manager.
- Manual checks or paper pay for people who could be paid by direct deposit.
Data
| Red flag | What it may point to |
|---|---|
| Two employees with the same Social Security number, address, or bank account | Ghost employees or duplicate records |
| A payroll record with no match in the HR system | Ghost employee |
| Pay continuing after a termination date | Left-active record, by error or on purpose |
| A bank account change just before a pay run | Payroll diversion |
| Overtime that grows without a business reason | Falsified hours |
| A pay rate change with no approver | Unauthorized pay change |
| Pay with no time record or approval | Unsupported payment |
| Round or repeated amounts to the same account | Possible fabricated entries |
Find Payroll Issues Before They Grow
Compare payroll, HR, and accounting records to identify mismatches that can be missed when each system is reviewed separately.
Explore HobasaHow to Detect Ghost Employees: Eight Data Tests
These tests compare records. They work best when you run them across systems, not inside one.
| # | Test | Compare | A hit looks like | Systems needed |
|---|---|---|---|---|
| 1 | Payroll to roster | Payroll register against the HR employee list | A paid person with no HR record | Payroll, HR |
| 2 | Master file duplicates | Social Security numbers, addresses, and bank accounts across employees | Two employees sharing one bank account | Payroll or HR |
| 3 | Paid after termination | Termination dates against pay dates | Pay after the end date | Payroll, HR |
| 4 | Pay without time or approval | Paid hours against time records and approvals | Salary or hours with no supporting approval | Payroll, time system |
| 5 | Bank change review | Direct deposit changes against the change log and confirmations | A change with no verified request | Payroll |
| 6 | New hire confirmation | New hires against the hiring manager's confirmation | A hire the manager does not recognize | HR, manager |
| 7 | Rate and bonus changes | Compensation changes against approvals | A raise with no approver | Payroll, HR |
| 8 | Payroll to ledger | Payroll register totals against labor cost posted | A difference that is not explained | Payroll, ledger |
A practical way to start is a quarterly run of tests 1, 2, and 3. They need only the payroll register and the HR list, and they catch most ghost employee patterns.
Compare Payroll, HR, and Ledger Records
See how cross-system checks can surface missing employee records, unexplained payroll differences, and other exceptions for review.
See How Hobasa WorksWhy Single-System Checks Miss It
Each system can look clean on its own.
- The payroll provider shows a valid employee being paid the right amount.
- The HR system may never have been told about a hire or a termination.
- The ledger shows labor cost within the normal range.
The problem only exists in the comparison. That is how a ghost employee, a left-active record, or a redirected deposit survives for months.
Illustrative example. A payroll register includes a worker with no matching record in the HR system. The pay goes to a bank account that also receives pay for another employee. There is no time approval for the last four runs. Payroll, HR, and the ledger each look normal in isolation. The pattern appears only when the three are compared.
The example is fictional. A pattern like this is a reason to investigate, not proof of fraud.
For more on how disconnected systems hide problems, see financial leakage and our guide to HRIS and payroll connections.
Read also: 10 Signs Your Business Is Losing Money Between Systems in 2026
How to Prevent Payroll Fraud: Controls That Work
Payroll fraud prevention starts with controls. Detection finds problems late, while strong payroll internal controls make them harder to start.
| Control | What it prevents | How to apply it |
|---|---|---|
| Separate duties | One person controlling the whole process | Different people add employees, change pay, approve the run, and reconcile the result |
| Independent confirmation of new hires | Ghost employees | Have the hiring manager confirm each new hire before the first payment |
| Verify bank changes through a trusted channel | Payroll diversion | Confirm by phone or in person using contact details already on file, not details in the request |
| Approve all pay changes | Unauthorized raises and bonuses | Require an approver and an effective date, and keep the history |
| Review the payroll register every run | Unexplained additions | Someone outside payroll reviews new names, changes, and totals |
| Approve time before it is paid | Falsified hours | Managers approve hours, and overtime has its own approval |
| Restrict access and use multi-factor authentication | Account takeover | Limit who can change payroll data, and log every change |
| Offer a way to report concerns | Hidden schemes | Tips are the most common way fraud is found, at 43% in the ACFE study |
| Train managers and staff | Missed warning signs | ACFE data links fraud training to lower losses |
For monitoring approvals and segregation of duties, see our guide to compliance monitoring tools.
What to Do If You Suspect Payroll Fraud
Treat a suspicion carefully. Mistakes at this stage can damage an investigation or create legal exposure.
Do not confront anyone yet. Avoid tipping off the person involved.
Preserve the evidence. Keep payroll registers, change logs, HR records, and emails as they are. Do not edit or delete records.
Limit access. Restrict the ability to change the affected records, quietly and promptly.
Involve the right people. Bring in legal counsel and your HR lead. Consider a forensic accountant for complex cases.
Check your insurance. Look at your crime or employee dishonesty coverage and its reporting deadlines.
Document each step. Write down what you found, when, and who saw it.
Fix the control gap. After the issue is resolved, change the process that allowed it.
This is general guidance, not legal advice. Laws and reporting requirements vary by state.
A Payroll Integrity Cadence
| When | What to check |
|---|---|
| Every payroll run | New names, bank detail changes, pay rate changes, and overtime outliers |
| Monthly | Payroll register against labor cost in the ledger, and headcount in HR against employees paid |
| Quarterly | Ghost employee tests 1 to 3 across the full employee list |
| Annually | A review of who can change payroll data, and whether duties are properly separated |
Keep a short log of what you checked and what you found. Over time it shows patterns, such as a location or manager where exceptions cluster.
The Role of Hobasa in Detecting Payroll Fraud
Hobasa is not a forensic or investigative tool, and it does not decide whether fraud occurred. A flag is a reason to look, and the judgment stays with your team.
What Hobasa does is the cross-system comparison that single systems miss. It reads across payroll, HR, and accounting systems and surfaces where they disagree.
Payroll against HR. Records paid in payroll but missing or closed in the HR system, and pay continuing after a termination date.
Payroll against the ledger. Differences between payroll register totals and labor cost posted.
Payroll anomaly signals. Unusual pay, hours, or classification patterns flagged for review.
Duplicate payments. Flagged against your rules.
Approval and control monitoring. Adherence to approval workflows, delegated authority, and segregation of duties.
Every finding cites the exact record it came from, and an analyst reviews it before it reaches you. Access is read-only by default, and Hobasa works alongside your payroll, HR, and accounting tools. It is delivered as a managed layer with people supporting your team.
It connects to systems including ADP Workforce Now, Workday, Rippling, BambooHR, UKG Pro, Paylocity, QuickBooks Online, NetSuite, and Sage Intacct. See integrations. If a system is not listed, the team can confirm how quickly it can be connected.
It suits CFOs and controllers who want the payroll, HR, and ledger comparison run for them. It also suits advisors who review many clients, including fractional CFOs, fractional CHROs, and CPA firms.
If you run a small team on one system, a quarterly manual run of the tests above may be enough.
See What Each System Can't See on Its Own
Explore how payroll, HR, and accounting records are compared, with the source behind every finding.
Explore the PlatformConclusion
Payroll fraud means paying money the company does not owe, mainly through ghost employees, falsified hours, and redirected deposits.
ACFE 2024: payroll schemes were about 10% of cases, 15% in North America, with a $50,000 median loss.
A flag is a reason to look, not proof. Errors and fraud look alike in the data.
Compare payroll with HR and the ledger. Single-system review misses many schemes.
Prevent with separated duties, independent confirmation of changes, and a review of the payroll register every run.
Hobasa is the cross-system comparison layer. It is not a forensic tool.
For more guides for finance leaders, browse our CFO guides.
Talk to the Hobasa team about the payroll, HR, and ledger checks you run by hand. Get in touch and tell us which systems you use.
Detect Payroll Mismatches Across Your Systems
Explore how Hobasa compares payroll, HR, and accounting records to surface discrepancies, with the source behind every finding.
FAQs
Payroll fraud is any deliberate scheme that causes a company to issue pay it does not owe. Common forms are ghost employees, falsified hours or overtime, payroll diversion, and unauthorized pay changes. It can come from insiders or from outsiders who impersonate employees.
The most common are ghost employees, falsified hours and overtime, buddy punching, payroll diversion through direct deposit changes, unauthorized pay changes, and commission or bonus manipulation. Paying terminated employees can be fraud or an error, depending on intent.
A ghost employee is a person on payroll who does not actually work for the company. It can be a fictitious name, a former employee left active, or a real person paid for work they do not do. Someone collects the pay.
Compare the payroll register with the HR employee list, look for shared Social Security numbers, addresses, or bank accounts, check for pay after termination, and check for pay with no time record or approval. Have hiring managers confirm new hires.
Red flags include one person controlling the whole payroll process, payroll records with no HR match, shared bank accounts, pay after termination, bank changes just before a pay run, overtime that grows without reason, and pay rate changes with no approver.
In the ACFE's 2024 study of 1,921 cases worldwide, payroll schemes were about 10% of cases and 15% in North America. The median loss was $50,000, and summaries of the report put detection time at about 18 months.
Separate duties where possible, have someone outside payroll review the register each run, confirm new hires and bank changes independently, approve pay changes in writing, and offer a way to report concerns. Even a small team can run quarterly checks.
No. An error is a mistake, such as a run posted twice or a terminated employee left active. Fraud is deliberate. The data checks overlap, so investigate before drawing conclusions, and fix the control gap either way.
Do not confront anyone. Preserve the records, limit access to the affected data, involve legal counsel and HR, consider a forensic accountant, check your insurance coverage, and document every step. This is general guidance, not legal advice.
Payroll software helps with approvals, audit logs, and access controls, but it checks only its own data. It cannot tell that a paid person is missing from the HR system or that the ledger disagrees. A cross-system comparison closes that gap.
Summaries of the ACFE's 2024 data put the median for payroll schemes at about 18 months. Across all fraud types, the median is 12 months. The longer a scheme runs, the larger the loss tends to be.
Hobasa does not determine fraud. It compares payroll, HR, and accounting records and flags mismatches and anomalies for review, with the source record behind each finding and an analyst check. Your team investigates and decides. Access is read-only by default.
