How can a small business owner or their accountant tell whether an employee is padding their timesheet, getting a coworker to clock them in, or claiming overtime for hours they didn't work, and how do you stop it without shortchanging people for hours they really did work?

What should I check, step by step?

1. Write down who can approve overtime, that it needs approval before it is worked except in emergencies, and who checks the hours afterwards. A rule nobody wrote down can't be checked.

2. Make payroll accept overtime and timesheet approvals only from the approver's own account in the time or payroll system. Don't accept emailed forms with a pasted or scanned signature, and never let the person claiming the hours be the one who sends the approval to payroll.
3. Give each person their own clock-in code or login, and look for impossible punches: clock-ins from the same device seconds apart for different people, punches on days someone was off, or hours on a day with no work output.
4. Compare the hours claimed with records the employee didn't produce: jobs or tickets closed, deliveries, register logins, door or alarm logs, GPS on company vehicles, customer sign-offs. Overtime with no matching work is the gap to explain.
5. Each pay period, rank overtime by person and by approver. One person's overtime climbing, overtime only ever approved by one supervisor, or overtime that sits just under a review threshold all deserve a look.
6. Watch the person who collects or keys in other people's timesheets most closely. In the Boston case that was the role that let the false forms through.
7. Don't trust the clock-in alone. A clock-in, badge swipe or hand scan only proves someone was there at that moment; spot-check that people are actually at work during long or overtime shifts.
8. Keep the time cards and the approvals. Under the federal wage-and-hour rules employers must record hours worked each day and each week, and keep time cards for at least 2 years.
9. If you plan a fingerprint, hand or face clock to stop coworkers clocking each other in, check your state's biometric privacy law first. In Illinois you need written notice and a signed release before collecting it.
10. If you find padded hours, talk to your accountant and an employment lawyer before docking anyone's pay or confronting them, and keep the original records as they are. Fixing padding must never mean cutting hours someone did work.

How do employees get paid for padded timesheets and overtime they didn't work?

The ACFE's Occupational Fraud 2026 report defines a payroll scheme as a fraudulent disbursement scheme in which an employee causes their employer to issue a payment by making false claims for compensation, giving as examples an employee claiming overtime for hours not worked and an employee adding ghost employees to the payroll.

• In the Boston Housing Authority case announced by the U.S. Attorney's Office for the District of Massachusetts on March 31, 2026, the employee was an executive secretary who collected the weekly timesheets and overtime forms of other staff and could earn overtime herself. Overtime had to be approved in advance by senior management, and she was supposed to send her form to her supervisor by email for electronic approval. From January 2023 she instead entered overtime she hadn't worked, falsified her supervisor's signature without the supervisor's knowledge, and emailed the forms directly to payroll, which added the overtime to her weekly paycheck: over 100 forms through August 2024, about USD 72,131. She pleaded guilty to wire fraud.
• The lesson is about the path, not the form. Payroll paid on a document that looked approved; it had no way to tell that the approval never came from the approver. An approval recorded in the approver's own account, or sent by the supervisor directly, closes that path.

Does a time clock or biometric scanner stop overtime fraud?

On October 20, 2026 a former MBTA track inspector pleaded guilty to conspiracies including overtime fraud. According to the U.S. Attorney's Office for the District of Massachusetts, from January to October 2024 he and his alleged co-conspirators submitted false overtime sheets: they didn't show up for the shift at all, showed up hours late, or showed up at the start of the shift, used the hand scan and then disappeared for hours, sometimes to sleep in their vehicles, before coming back. The same release says inspection records were also falsified and made to look longer than they were.

• A biometric or badge clock stops one person clocking in for another, but it only records a moment. The check that would have caught the rest is a comparison of paid hours with the work those hours should have produced, done by someone other than the people claiming them.
• The federal rules don't require a clock at all. 29 CFR 785.48 says time clocks are not required, that minor differences between clock records and hours actually worked can't always be avoided, but that major discrepancies should be discouraged because they raise doubt about the accuracy of the records. Rounding to the nearest 5, 6 or 15 minutes is accepted only if, over time, people are still paid for all the time they actually worked.

What records do employers have to keep for hours worked and overtime?

Under 29 CFR 516.2, employers covered by the federal minimum wage and overtime rules must keep, for each such employee, the hours worked each workday and the total hours worked each workweek, along with straight-time earnings and overtime premium pay. Under 29 CFR 516.6, the time cards or sheets showing daily start and stop times must be kept for at least 2 years from the last entry. State rules can ask for more.

• For fraud checks, keep three things side by side: the hours as clocked, any edits to them with who made the edit, and the approval for each overtime block. A time record that can be edited after approval, with no trace of the edit, is as weak as a forwarded form.
• If you add a fingerprint, hand-geometry or face clock, the Illinois Biometric Information Privacy Act (740 ILCS 14/15) requires a public written retention and destruction policy, written notice of what is collected, why and for how long, and a signed written release, which for employees can be signed as a condition of employment. Section 20 sets statutory amounts of USD 1,000 per negligent violation and USD 5,000 per intentional or reckless one; since Public Act 103-769 (effective August 2, 2024), collecting the same biometric from the same person by the same method more than once counts as one violation.
• In the ACFE's 2026 report, payroll schemes appeared in 227 of 2,402 cases (10%), with a median loss of USD 63,000, a median duration of 13 months and a median of about USD 4,800 lost per month. They showed up in 13% of cases at organizations with fewer than 100 employees against 8% at larger ones. Across all schemes, 43% of frauds were first detected by a tip, and 55% of tips came from employees, so coworkers who see a colleague's empty shift are often the first to know.