Are You Paying Ghost Employees? The Multi-Billion Risk from Payroll Fraud in Large Organizations

Payroll fraud is one of the most common forms of internal fraud in companies, yet it frequently goes undetected precisely because it occurs within the payroll process itself.

This type of fraud can be carried out by employees, HR staff, payroll administrators, managers, or other internal parties with access to attendance data, overtime records, salary components, or payment accounts.

Payroll fraud is therefore not just an administrative issue. It is also a matter of internal controls, governance, and data security.

This article covers the definition of payroll fraud, its most common types, case examples, penalties, and how to detect and prevent it.

What Is Payroll Fraud?

Payroll fraud is the manipulation of a payroll system to unlawfully obtain personal financial gain.

It can take many forms, from manipulating attendance and overtime records and making unauthorized salary changes, to redirecting salary payment accounts.

Because payroll is connected to HR data, attendance, overtime, and disbursements, fraud in this area often looks like normal transactions until an anomaly is eventually discovered.

From a classification standpoint, payroll fraud is both employee fraud and financial fraud, and within the ACFE framework it falls under occupational fraud.

This means the perpetrator exploits a position, access rights, or the trust granted by the company to obtain financial benefit unlawfully.

In practice, perpetrators can range from ordinary employees and supervisors to HR staff, payroll officers, and any internal party with authorization to modify sensitive data.

Read also: Payroll Data Encryption: Why Security Matters

Types of Payroll Fraud

Payroll fraud is one of the more prevalent forms of occupational fraud.

This shows that payroll fraud is not a marginal issue. It is a real and recurring pattern of fraud.

1. Ghost Employee Fraud

Ghost employee fraud occurs when fictitious employee names are entered into the payroll system to receive salaries despite not actually working.

This is one of the most frequently discussed payroll fraud schemes, because once fake employee data is in the system, funds can continue flowing out every payroll cycle until the fraud is detected.

Thomson Reuters cites this scheme as an example of fake employee files being created by someone with access — such as a manager, HR staff, or payroll professional.

The impact is significant because the fraud is recurring. Without strong audits or reconciliation processes, payments to fictitious “employees” can continue for months.

Since payroll fraud typically goes undetected for around 18 months on average, ghost employee losses tend to accumulate before the company realizes funds have been leaking continuously.

2. Timesheet Fraud or Working Hours and Overtime Manipulation

Timesheet fraud occurs when employees inflate their working hours, claim overtime they did not work, or enter inaccurate time records in order to receive higher pay.

Thomson Reuters notes that in the United States and Canada, payroll fraud schemes account for roughly 15% of occupational fraud schemes, and one of the most common forms is the manipulation of working hours and payroll entries.

A simple example would be an employee who consistently reports high overtime with no clear operational justification, or a supervisor who approves overtime that was not actually needed.

If attendance records, timesheets, and payroll data are not cross-validated, this type of fraud can easily appear “normal” because it surfaces as a legitimate payroll component.

3. Unauthorized Salary Adjustment

This scheme occurs when someone changes a salary, allowance, payroll rate, or other compensation component without official authorization. The primary vulnerability is almost always the same: weak internal controls or controls that can be overridden.

Miller Cooper, summarizing the 2024 ACFE data, notes that nearly half of all fraud cases occur due to a lack of internal controls (32%) or the override of existing controls (19%).

In the context of payroll, this means a single person with overly broad access can change salary amounts, bonuses, allowances, or payroll components without any adequate verification layer.

Because the change occurs within the official system, this type of fraud often only comes to light during an audit, a payroll comparison across periods, or when another party raises a concern.

4. Buddy Punching

Buddy punching is the practice of one employee recording attendance on behalf of a colleague who is not actually present.

This is a form of time fraud because it produces false work records that can subsequently affect payroll. AIHR defines it as a form of time theft in which someone is paid for hours they did not actually work.

This scheme is most common when companies still use manual attendance systems or have loose attendance controls.

5. Expense Reimbursement Fraud

Expense reimbursement fraud occurs when employees submit false, inflated, duplicated, or personal expense claims.

This type of fraud often appears legitimate because it comes with supporting documents, receipts, or proof — even though those documents may be forged or the amounts marked up.

KPM, citing an Emburse survey, notes that nearly 25% of workers surveyed admitted to having charged personal purchases as work expenses.

While not all reimbursement fraud flows directly through the main payroll, many companies process reimbursements via payroll or monthly compensation components — which is why this fraud remains relevant in payroll and employee expense governance.

6. Commission Fraud

Commission fraud occurs when sales data is manipulated so that employees receive higher commissions than they are entitled to. The methods can include fake sales, inflating transaction figures, transferring transactions under a specific name, or changing commission rates.

In practice, this fraud often surfaces in sales functions when sales data, commission approvals, and payroll do not share a single source of truth.

What makes commission fraud particularly dangerous is that it can easily resemble high performance. Without cross-validation between the sales, finance, and payroll systems, commission figures can appear reasonable even when the underlying transaction data has been manipulated.

7. Payroll Diversion Fraud

Payroll diversion fraud is the redirection of salaries to a different account without legitimate authorization. This scheme typically occurs through phishing, email compromise, account takeover, or fraudulent requests to change bank account details.

Thomson Reuters explains that payroll diversion occurs when a perpetrator impersonates an employee via phishing email or account takeover, then requests a change to bank account details so that funds are deposited into their own account.

This fraud is increasingly relevant as payroll becomes more digitized, because account changes can happen quickly when verification controls are weak.

Because it looks like a routine employee data update, companies without multi-layer confirmation processes are highly vulnerable to having salaries diverted without immediately realizing it.

Penalties and Legal Consequences for Payroll Fraud

Payroll fraud is not merely an internal policy violation. It can also constitute a criminal offense in many jurisdictions.

Depending on how the fraud is carried out, perpetrators may face charges related to fraud, theft, embezzlement, false accounting, identity theft, tax evasion, or the misuse of company funds.

The legal consequences can be severe because payroll fraud typically involves an abuse of trust. In most cases, the perpetrator is an employee, manager, HR professional, payroll administrator, or finance staff member who has been granted access to sensitive payroll information and uses that access for personal gain.

• In the United States, payroll fraud is commonly prosecuted under offenses such as wire fraud, embezzlement, identity theft, tax fraud, or theft of company assets. Sentences can include substantial fines, restitution, and imprisonment. In one case prosecuted by the U.S. Department of Justice, a former payroll administrator was convicted of wire fraud, identity theft, and theft after carrying out a payroll scheme that caused approximately US$1.5 million in losses.
• In the United Kingdom, payroll fraud may fall under the Fraud Act 2006, particularly under fraud by false representation or fraud by abuse of position. The latter is especially relevant when an employee exploits a position of trust to manipulate payroll records, salaries, or payments for personal benefit. Serious fraud offenses can result in significant custodial sentences, with major fraud offenses carrying penalties of up to 10 years’ imprisonment.

Across many jurisdictions, organizations themselves may also face legal exposure if they fail to maintain adequate anti-fraud controls.

Recent UK regulations, for example, introduced a “failure to prevent fraud” offense that can hold certain organizations liable when fraud is committed for the company’s benefit and reasonable prevention procedures are not in place.

Beyond criminal penalties, payroll fraud often results in employment termination, civil lawsuits, financial restitution, regulatory investigations, and long-term reputational damage.

Read also: Payroll Risk Management: Challenges & Mitigation Guide

Payroll Fraud Case Examples

Payroll fraud is not merely a theoretical risk.

Real-world cases show how weaknesses in payroll controls can lead to significant financial losses, whether through fictitious employees, payroll manipulation, or the misappropriation of employee salaries.

These cases highlight why strong internal controls, payroll audits, and segregation of duties are essential for protecting payroll integrity.

1. Ghost Employee Case

CNBC Indonesia reported on a case involving an HR manager in China who created 22 fictitious employees in the company’s payroll system.

Although these individuals did not actually work for the organization, they were recorded as active employees and continued to receive salaries through the payroll process.

The salaries paid to these “employees” were allegedly redirected to accounts controlled by the perpetrator. Over time, the scheme resulted in estimated losses of approximately IDR 38 billion before it was eventually discovered.

This case demonstrates how ghost employee fraud can continue undetected for years when organizations lack regular workforce verification, payroll audits, and reconciliation between employee records and actual business operations.

2. HR Staff Embezzling Employee Salaries

In Indonesia, police in Bantul uncovered a case involving an HR staff member who allegedly misappropriated employee salary funds that had been entrusted to them for distribution.

According to official police statements, the perpetrator was responsible for distributing salaries to 20 employees. Instead of transferring the funds to the intended recipients, the money was allegedly used for personal purposes.

Authorities charged the individual with embezzlement in office, an offense that carries a potential prison sentence of up to five years under Indonesian law.

This case illustrates that payroll fraud does not always involve sophisticated schemes or technology. In many situations, fraud occurs because a single individual has excessive control over payroll processes without sufficient oversight, approval controls, or verification mechanisms in place.

How to Detect Signs of Payroll Fraud

Payroll fraud is notoriously difficult to identify because fraudulent transactions are often disguised as legitimate payroll activities.

Salaries, overtime payments, allowances, commissions, and reimbursements all move through normal business processes, making suspicious transactions harder to spot than other forms of fraud.

For this reason, organizations should not rely solely on annual audits. HR, payroll, and finance teams need to continuously monitor payroll data and investigate unusual patterns before they develop into significant financial losses.

The following warning signs are among the most common indicators of potential payroll fraud.

1. Inconsistent Payroll Data

One of the earliest signs of payroll fraud is unusual payroll activity that cannot be explained by legitimate business changes.

Organizations should regularly compare payroll reports across pay periods to identify unexpected salary increases, duplicate payments, recurring allowances, or sudden changes in compensation components.

Payroll figures should also be reconciled against employment contracts, salary structures, attendance records, and approved compensation policies.

For example, if an employee’s salary suddenly increases without any promotion, compensation adjustment, or documented approval, the discrepancy should be investigated immediately.

Likewise, duplicate employee records or multiple employees sharing the same bank account may indicate ghost employee fraud or payroll manipulation.

2. Employees with No Clear Work Activity

Ghost employee schemes often remain undetected because the fictitious employee exists only within HR and payroll systems.

To identify this risk, companies should periodically verify that every employee on the payroll has a legitimate role, reporting manager, attendance history, work output, and documented employment records.

HR teams should work closely with department heads to confirm that payroll records accurately reflect the active workforce.

An employee who consistently receives salary payments but has no attendance logs, project assignments, deliverables, or manager oversight should be treated as a significant red flag. Workforce reconciliation exercises can help uncover these anomalies before they become costly.

3. Excessive Overtime Without Business Justification

While overtime is common in many organizations, unusually high or recurring overtime claims may indicate payroll abuse.

HR and payroll teams should analyze overtime trends across employees, departments, and reporting periods. Particular attention should be paid to employees who consistently record significantly higher overtime than their peers despite performing similar roles.

Every overtime claim should be supported by attendance records, management approval, and a clear operational reason.

If overtime expenses continue increasing without a corresponding increase in workload, project demand, or staffing shortages, the company should investigate whether timesheet manipulation or fraudulent approvals are occurring.

4. Salary or Bank Account Changes Without Proper Authorization

Unauthorized changes to payroll information are among the clearest indicators of potential fraud.

Organizations should maintain detailed audit trails for modifications involving salaries, bonuses, allowances, tax information, and employee bank account details. Any changes that occur outside standard approval workflows should be reviewed immediately.

For example, if an employee’s bank account information is modified shortly before payroll processing, or if compensation figures are adjusted without supporting documentation, there may be an attempt to divert funds or manipulate payroll records.

Strong access controls and approval mechanisms are essential for detecting and preventing these activities.

5. Anonymous Complaints or Reports from Employees

Many payroll fraud cases are discovered not through audits, but through tips from employees, managers, vendors, or other internal stakeholders.

Employees often notice unusual payroll behavior before formal controls identify it. They may become aware of suspicious overtime approvals, fictitious workers, reimbursement irregularities, or salary discrepancies that would otherwise go unnoticed.

For this reason, organizations should establish secure whistleblowing channels that allow employees to report concerns confidentially and without fear of retaliation.

Anonymous reporting mechanisms can significantly improve fraud detection and often help companies uncover issues much earlier than traditional audit processes.

6. Unusual Payroll Cost Trends

Payroll fraud can sometimes be detected through broader financial analysis rather than individual employee reviews.

Finance teams should monitor payroll expenses over time and compare them against workforce size, hiring activity, departmental budgets, and business performance.

Unexpected increases in payroll costs without corresponding changes in headcount or compensation policies may indicate hidden payroll irregularities.

For example, if payroll expenses rise by 15% while employee headcount remains relatively stable, organizations should investigate the underlying drivers rather than assuming the increase is legitimate.

7. Excessive Access Rights to Payroll Systems

Many payroll fraud schemes occur because a single individual has the ability to create employee records, modify payroll data, approve payments, and process payroll without independent oversight.

Companies should regularly review user access permissions and identify employees with excessive privileges. Individuals who can perform multiple critical payroll functions without review represent a significant control risk.

Segregation of duties remains one of the most effective fraud prevention mechanisms because it reduces the likelihood that a single person can initiate and conceal fraudulent activity.

How to Report Payroll Fraud Activity

Identifying payroll fraud is only the first step. Once suspicious activity is discovered, organizations need a structured reporting process to ensure allegations are investigated properly while protecting both the company and the individuals involved.

A poorly handled report can compromise evidence, disrupt business operations, or expose employees to retaliation. For this reason, companies should establish clear reporting procedures and communicate them to all employees.

1. Gather and Preserve Relevant Evidence

Before making a report, any available evidence should be documented and preserved. This may include payroll records, payslips, attendance logs, overtime approvals, screenshots of system changes, reimbursement claims, email communications, or audit reports.

Employees should avoid altering documents or attempting to conduct their own investigation. The objective is simply to preserve factual information that may assist the authorized investigators.

Well-documented evidence helps organizations distinguish between genuine fraud, administrative errors, and payroll process failures.

2. Report Through Official Internal Channels

Most organizations have designated reporting channels for suspected misconduct. Depending on the company’s structure, reports may be submitted to HR, finance leadership, internal audit teams, compliance officers, legal departments, or designated fraud investigation teams.

If a whistleblowing system is available, it is generally the preferred reporting mechanism because it provides a formal process for documenting concerns and tracking investigations.

Companies should ensure employees know where and how concerns can be reported, particularly when payroll-related issues involve individuals in positions of authority.

3. Escalate High-Risk Cases Appropriately

Not every payroll irregularity is necessarily fraud. Some cases may result from human error, system configuration issues, or process breakdowns.

However, if there is evidence of intentional misconduct, falsified records, unauthorized payments, or significant financial losses, the matter should be escalated immediately to senior management, internal audit, compliance, or legal teams.

Organizations should have clear escalation criteria so that potentially serious cases receive prompt attention and independent review.

4. Protect Confidentiality During the Investigation

Confidentiality is critical throughout the reporting and investigation process.

Information should only be shared with individuals who have a legitimate role in assessing the case. Premature disclosure can compromise evidence, damage reputations, and create unnecessary workplace conflict.

Many organizations therefore allow anonymous reporting and implement whistleblower protection measures to encourage employees to come forward without fear of retaliation.

5. Involve External Authorities When Necessary

If the investigation uncovers evidence of criminal activity, organizations may need to involve law enforcement agencies, regulatory authorities, or external legal counsel.

This is particularly important in cases involving embezzlement, identity theft, payroll diversion, financial statement manipulation, tax fraud, or large-scale misappropriation of company funds.

The decision to escalate externally will depend on the severity of the misconduct, applicable legal requirements, and the organization’s governance policies.

6. Review Internal Controls After the Investigation

Reporting payroll fraud should not mark the end of the process. Once an investigation is completed, organizations should identify the control failures that allowed the fraud to occur in the first place.

This may involve reviewing approval workflows, payroll access permissions, segregation of duties, audit procedures, or payroll system configurations.

By addressing the root cause rather than only the individual incident, companies can significantly reduce the likelihood of similar payroll fraud occurring in the future.

How to Prevent Payroll Fraud

Preventing payroll fraud requires more than simply identifying suspicious transactions after they occur. Organizations need a combination of technology, internal controls, governance processes, and employee accountability to reduce opportunities for fraud in the first place.

Because payroll fraud often exploits weaknesses in processes rather than technology alone, effective prevention depends on creating multiple layers of oversight throughout the payroll cycle.

The following practices are among the most effective ways organizations can strengthen payroll governance and minimize fraud risk.

1. Use an Integrated Payroll System

Many payroll fraud risks arise when payroll data is spread across multiple spreadsheets, disconnected systems, or manual processes.

In these environments, attendance records, overtime claims, employee information, and payroll calculations may be maintained separately, making errors and manipulation more difficult to detect.

An integrated payroll system helps create a single source of truth by connecting payroll with attendance, leave management, employee records, and compensation data.

Because information flows automatically between systems, opportunities for unauthorized changes and duplicate entries are significantly reduced.

Integration also improves visibility for HR and finance teams, making it easier to identify discrepancies and investigate anomalies before payroll is processed.

2. Implement Segregation of Duties and Layered Approvals

One of the most effective anti-fraud controls is ensuring that no single individual has complete control over the payroll process.

Organizations should separate responsibilities for data entry, payroll review, approval, and payment execution. For example, the person who updates employee information should not be the same person who approves payroll changes or authorizes salary payments.

Sensitive modifications involving salaries, bonuses, commissions, allowances, or employee bank account details should also require multiple levels of approval.

This creates additional verification checkpoints and makes it substantially more difficult for fraudulent transactions to go unnoticed.

3. Conduct Regular Payroll Audits

Payroll audits remain one of the most effective tools for identifying fraud, errors, and control weaknesses before they result in significant losses.

Organizations should periodically review employee records, payroll transactions, overtime claims, compensation changes, and payroll expenses to ensure all payments are legitimate and properly authorized.

Depending on the size and complexity of the business, audits may be conducted monthly, quarterly, or annually.

In addition to scheduled reviews, surprise audits can be particularly effective because they reduce opportunities for individuals to conceal fraudulent activities before an inspection takes place.

Read also: Payroll Audit Checklist: A Step-by-Step Guide for Accuracy and Compliance

4. Maintain Comprehensive Audit Trails

Strong payroll governance requires complete visibility into every change made within the payroll system.

Organizations should ensure that all payroll-related actions are automatically logged, including changes to employee information, salary adjustments, overtime approvals, payroll calculations, and bank account details. These records should capture who made the change, when it occurred, and what information was modified.

Comprehensive audit trails not only support fraud investigations but also act as a deterrent, since employees are aware that their actions can be traced and reviewed if irregularities arise.

5. Strengthen Employee Awareness and Reporting Culture

Technology and controls alone cannot eliminate payroll fraud. Employees often play a critical role in identifying suspicious behavior that systems may overlook.

Organizations should provide regular training on payroll policies, fraud risks, reporting procedures, and ethical conduct.

Employees should understand how payroll fraud occurs, the consequences of misconduct, and the importance of reporting concerns promptly.

Equally important is creating a workplace culture where employees feel safe reporting potential issues. Confidential reporting channels and whistleblower protections encourage individuals to speak up when they observe suspicious activity, allowing organizations to detect fraud much earlier.

6. Continuously Review Access Controls

Payroll systems contain highly sensitive employee and financial data, making access management a critical component of fraud prevention.

Organizations should regularly review user permissions to ensure employees only have access to the information and functions required for their roles.

Access rights should be updated whenever employees change positions, receive additional responsibilities, or leave the organization.

Periodic access reviews can help identify excessive privileges that may allow individuals to create employee records, modify payroll data, and approve payments without adequate oversight.

Read also: Payroll Security: Common Risks and How to Secure Payroll Data

7. Build Payroll Governance Into the Organization

Ultimately, payroll fraud prevention should not be viewed as solely an HR or payroll responsibility. It is a governance issue that requires collaboration between HR, finance, compliance, internal audit, and business leadership.

Organizations with strong payroll governance frameworks typically combine technology, approval controls, audits, monitoring, employee education, and executive oversight.

By establishing multiple layers of accountability, companies can significantly reduce opportunities for payroll fraud while improving payroll accuracy, compliance, and operational efficiency.

Optimize Payroll Governance and Minimize Fraud Risk with Mekari Talenta

Payroll fraud is often not just about the perpetrator. It is also an indicator that a company’s payroll systems and governance are still weak.

Organizations that still rely on manual processes and disconnected systems tend to be more vulnerable to fraud, errors, and bottlenecks, because payroll, attendance, leave, and compensation data are not properly locked together.

By contrast, an integrated payroll solution can significantly reduce the risk of manipulation because controls, approvals, and data visibility are substantially stronger.

Mekari Talenta is relevant in this context as a cloud-based HRIS that helps companies manage payroll end-to-end with stronger controls, real-time visibility, and better-managed fraud risk.

Mekari Talenta explains that its payroll is connected to attendance, leave, benefits, recruitment, and performance — so the payroll process does not operate in isolation from the rest of the HR data ecosystem.

Some of Mekari Talenta’s most relevant capabilities for payroll governance and fraud prevention include:

• End-to-End Payroll Calculation. Mekari Talenta automates payroll and connects it directly to other HR modules, reducing manual intervention and making unauthorized data changes less likely.
• Role-Based Access and Approval Workflows. Mekari Talenta supports tiered access control, role-based access separation, and payroll approvals — ensuring that sensitive data changes cannot be made arbitrarily and must pass through layered approvals.
• Real-Time Data Visibility. More centralized payroll, attendance, and HR data helps HR and finance teams detect anomalies faster before they cause significant damage. Mekari Talenta also highlights end-to-end integration to simplify reconciliation.
• Audit Trail and Activity Logging. Mekari Talenta employs audit trails and comprehensive activity logging to monitor system activity — essential for tracking and investigation when fraud indicators arise.
• End-to-End HR Ecosystem Integration. Mekari Talenta connects payroll with attendance, leave, compensation, and other systems, and can also integrate with ERPs or financial software. This helps eliminate fraud vulnerabilities caused by data duplication or manipulation across platforms.
• Compliance and Regulatory Support. Mekari Talenta ensures its payroll configuration aligns with the latest government regulations, keeping the payroll process consistent with regulatory obligations.

If you want to strengthen payroll governance and reduce fraud risk with a more integrated process, you can learn more about Mekari Talenta or contact us directly to see how the system can be tailored to your company’s needs.