Common Payroll Frauds

Common payroll frauds are similar to billing schemes. The perpetrators of these frauds produce false documents, which cause the victim company to unknowingly make a fraudulent disbursement. In billing schemes, the false document is usually an invoice (coupled, perhaps, with false receiving reports, purchase orders, and purchase authorisations). In payroll schemes, the perpetrator typically falsifies a timecard or alters information in the payroll records. The major difference between common payroll fraud schemes and billing schemes is that payroll frauds involve disbursements to employees rather than to external parties. In general, payroll schemes fall into three categories: ghost employee schemes, falsified hours and salary schemes, and commission schemes.

Ghost Employees in common payroll frauds

The term ghost employee refers to someone on the payroll who does not actually work for the victim company. Through the falsification of personnel or payroll records a fraudster causes paycheques to be generated to a ghost. The fraudster or an accomplice then converts these paycheques. (See the “Ghost Employees” flowchart that follows.) The ghost employee might be a fictitious person or a real individual who simply does not work for the victim employer. When the ghost is a real person, it is often the perpetrator’s friend or relative.

For a ghost employee scheme to work, four things must happen: (1) the ghost must be added to the payroll, (2) timekeeping and wage rate information must be collected, (3) a paycheque must be issued to the ghost, and (4) the cheque must be delivered to the perpetrator or an accomplice.

Adding the Ghost to the Payroll

The first step in a ghost employee scheme is entering the ghost on the payroll. In some businesses, all hiring is done through a centralised personnel department, while in others the personnel function is spread over the managerial responsibilities of various departments. Regardless of how hiring of new employees is handled within a business, it is the person or persons with authority to add new employees and remove terminated employees that are in the best position to put ghosts on the payroll.


A manager who was responsible for hiring and scheduling janitorial work added over 80 ghost employees to his payroll. The ghosts in this case were actual people who worked at other jobs for different companies. The manager filled out time sheets for the fictitious

employees and authorised them, and then took the resulting paycheques to the ghost employees, who cashed them and split the proceeds with the manager. It was this manager’s authority in the hiring and supervision of employees that enabled him to perpetrate this fraud.

Employees in payroll accounting also sometimes create ghost employees. In a perfect world, every name listed on the payroll would be verified against personnel records to make sure that those individuals receiving paycheques actually work for the company, but in practice this does not always happen. Thus, people in payroll accounting might be able to create fictitious employees by simply adding a new name to the payroll records. Access to these records is usually restricted, with only high-level employees having the ability to make changes to the payroll. These individuals would therefore be among the most likely suspects in a ghost employee scheme. On the other hand, lower level employees sometimes gain access to restricted payroll information and should not be disregarded as possible suspects.


An employee in the payroll department was given the authority to enter new employees into the payroll system, make corrections to payroll information, and distribute paycheques. This employee’s manager gave rubber-stamp approval to the employee’s actions because of a trusting relationship between the two. The lack of separation of duties and the absence of review made it simple for the culprit to add a fictitious employee into the payroll system.

One way perpetrators try to conceal a ghost’s presence on the payroll is to create a ghost with a name very similar to that of a real employee. The name on the fraudulent paycheque will therefore appear to be legitimate to anyone who glances at it. For instance, if a victim organisation has an employee named John Doe, the ghost might be named “John Doer.”

Instead of adding new names to the payroll, some employees undertake ghost employee schemes when they fail to remove terminated employees’ names. Paycheques to the terminated employee continue to be generated even though the employee no longer works for the victim organisation. The perpetrator intercepts these fraudulent paycheques and converts them for his personal use.

Common payroll frauds