Ghost Employee

A ghost employee scheme sends wages to someone who should not be paid as an active worker; the record may be invented, belong to a former employee or use the identity of someone whose pay is redirected. An insider may create or maintain it, and the business loses cash and may also face tax, privacy and trust consequences.

The Association of Certified Fraud Examiners describes ghost-employee patterns, and a state auditor's payroll-fraud alert and a city audit show practical control failures and checks, but a specific person should not be accused merely because a payroll record looks odd, and facts should be verified before deciding intent. Payroll should start from an authorised HR record, so a new worker needs an approved offer, identity verification, start date and pay terms, and changes should flow through a controlled process; a manager's informal message to "add a temp" is not enough to create a permanent payroll profile.

Separate sensitive functions, so that one person cannot create an employee, change their bank account and approve the resulting payroll run without independent review. Small firms may need compensating checks, such as owner review of new payees and monthly bank reconciliation, because the objective is an independent view of who is paid.

Compare the payroll register with the active HR roster, remembering that differences can be legitimate (leave, final pay, contractors or timing of a departure), and investigate each discrepancy by matching employee ID, legal name, department, manager and payment account carefully without exposing personal data broadly. Work evidence can help: for hourly staff, compare time records with supervisor sign-off and site access as appropriate, while a salaried remote employee may not have a daily entry log, so use role and manager confirmation instead and do not treat a lack of badge swipes as proof that the person does not exist.

Bank-detail changes are high risk, so a request to reroute salary should be verified through a trusted employee channel, and alerts for multiple employees sharing one account can flag issues while family or payroll arrangements may explain some matches, so investigate rather than automatically block or accuse. Departures need prompt handling: HR should tell payroll the final date, any earned leave or severance, and approved final payments, and the payroll system should stop routine salary after the appropriate cycle.

An access-removal checklist can help prevent both continuing wages and former staff logging into systems. Temporary and agency workers complicate counts, since some are paid by the agency, not the company payroll, and an internal roster may omit an approved short-term employee, so define the population for each reconciliation; a headcount difference without this definition is an alert, not a loss calculation.

For a simple check, subtract verified active or otherwise payable people from payroll names; if payroll has 212 and HR verifies 209 eligible names, three records require review, but they are not automatically three ghosts, so examine leave, final pay and data timing before recording a loss. Reconcile the bank disbursement file, not just the internal payroll total, because a legitimate payroll report can be altered before funds are sent if access controls are weak.

Compare final approved amounts and beneficiary details with the bank's accepted file, and have a second reviewer check new or changed accounts. Investigations need confidentiality and evidence preservation, so limit access to payroll and identity data, keep system logs, approvals and bank records, and interview relevant people fairly; if wrongdoing is confirmed, legal and employment steps depend on jurisdiction, and an allegation should not be publicised as fact before it is substantiated.

Periodic analytics can flag duplicate tax identifiers, addresses, bank accounts and unusual pay changes, but these are prompts for review, not conclusions, and a common address can be legitimate for family members, so combine analytics with human knowledge and documentary evidence. A ghost-employee scheme exploits gaps between HR, payroll and bank controls, so maintain a current authorised roster, separate powers and reconcile actual disbursements, treating anomalies as questions to investigate that protect both company funds and employees who could otherwise be wrongly suspected.