Payroll Fraud

The payroll is the largest expense area for many organisations, and one which should be controlled carefully. Nevertheless, payroll fraud accounts for 17% of all fraudulent disbursements suffered by organisations. There are three main types of payroll fraud – Ghost Employees, Overcompensation, and Bonus and Commission Schemes.

Ghost employeesBusiness Fraud

A “ghost employee” is someone on your payroll who does not work for your company. This type of fraud is relatively rare, especially in smaller organisations, but when it does occur the loss can be substantial. This fraud is set up by a person who either has authority to alter payroll records, or carries out the payroll accounting. If the fraudster is senior enough, this type of fraud can occur in quite small companies.

The ghost employee may be fictitious, false records being created but with a real address (often the fraudster’s own) and bank account for direct crediting. This “person” may be given a name close to that of a real employee to appear legitimate if noticed. Another type of ghost is a real person who has left the company but has been retained on the payroll by the fraudster, their address and banking details having been changed. Sometimes a friend or relative of the fraudster is put on the payroll, simplifying processing of pay cheques.

Measures to counter Ghost Employee schemes are centered around separation of duties and records, and scanning records for irregularities. For example, the hiring function should be separated from payroll duties, personnel records should be kept separately from payroll records and the two compared regularly, departmental heads should regularly scan payroll records attributed to their department, payroll records should be checked for employees with the same address or bank details and so on.


This type of fraud is more common, but the amount lost per fraud is less than for Ghost Employees. There are two main types of fraud under this heading – overstating hours worked, and an unauthorized salary increase.

Increased “work” hours are entered into the system by falsifying the records used to calculate wages. This may be done at the worksite on a daily basis by the fraudster or an accomplice, or on approved timesheets when transferring between the authorizing manager and the payroll department. In one type of fraud, supervisors approve inflated hours for accomplice employees in exchange for a cut of the excess pay; in another, the authorizing manager’s signature is forged on timesheets. There are many variations of this type of fraud.

For salaried employees, a fraudster who has access to payroll records can “award” themselves a pay rise. This can occur quite readily in small companies if the same person also processes the payroll and makes the accounting entries.

Also worth mentioning is the practice of taking leave but not reporting it through the official channels. While this fraud does not involve an increase in remuneration, it is in reality stealing paid time.

Overcompensation is countered by measures such as scanning individual payroll records for excessive overtime and pay increases, separating payroll preparation and reconciliation functions, requiring proper authorization of pay changes etc (and checking on this) and comparing payroll expenses to budgets and previous years.

Bonus and Commission Schemes

Organisations are susceptible to Bonus and Commission schemes when a significant proportion of an employee’s remuneration is based on sales performance. There are two components driving the bonus – sales dollar and commission percentage – and both can be manipulated to increase the payout.

Sales records can be falsified on volume, perhaps through fraudulent sales orders or invoices, and price by entering a higher price than that charged on records. Such falsification is quite easy to detect if relevant reconciliations and analysis of uncollected sales are made, and comparison of sales figures between the bonus system and business records is done. More sophisticated systems, such as shipping product to an accomplice customer at the end of the relevant period, then accepting it back the next day as a return, require trend and exception analysis.

In summary, payroll fraud at a low level is probably occurring in most organisations. Unfortunately, the loopholes which allow a bit of unworked overtime to be paid, for example, are also available for a serious fraudster to exploit. This is one area in which a preventative approach is essential.

Case Studies

A temporary employee noticed that the manager did not reconcile monthly expense journals, and so did not know how much was being paid to the temp. agency. The employee was able to fill in fictitious timesheets and receive overpayment without detection.

A manager faced the problem of a valued employee threatening to leave for a better paid job, but she was not able to obtain approval for a pay rise to retain him. She “solved” the problem by routinely authorizing fictitious overtime, thereby effectively giving the employee the pay rise.

A supervisor had two jobs. In the first job he authorised timecards. One of the employees he did this for was his superior at the second job. In order to keep his second job, the supervisor authorised timecards for the employee for two years without the employee ever showing up for work. (Yes, this really happened!)

The following case  does not involve payroll fraud, but utilizes a similar mechanism – instead of former employees, the fraudster used former contractors. The fraudster was employed as a financial officer by a Hunter Valley company. She was responsible for all accounts payable and receivable as well as banking, including electronic transfers. This fraudster created invoices in the name of former contractors, then was able to use her inappropriately wide-ranging authority to process payments to herself (147 of them over 2½ years). In the system, they appeared to be legitimate payments. The fraud netted $345,000, and was only discovered when the company started going backwards even though sales were booming.


“There is no kind of dishonesty into which otherwise good people more easily and frequently fall than that of defrauding the government.” Benjamin Franklin 1706 – 1790