# How can a small business owner or their accountant tell whether an employee is padding their timesheet, getting a coworker to clock them in, or claiming overtime for hours they didn't work, and how do you stop it without shortchanging people for hours they really did work?

**Short answer:** Padded hours get paid because nobody independent compares the hours claimed with evidence the employee didn't produce. The ACFE counts this as a payroll scheme: its 2026 report defines one as an employee making false claims for compensation, for example claiming overtime for hours not worked. Two 2026 federal cases show the two weak spots. A Boston Housing Authority executive secretary who collected other staff's timesheets submitted over 100 overtime forms for hours she hadn't worked, forged her supervisor's signature and emailed them straight to payroll, collecting about USD 72,131 (guilty plea, March 31, 2026). An MBTA track inspector admitted to an overtime conspiracy in which workers used the hand scan at the start of a shift and then disappeared for hours (plea, October 20, 2026). So an approval has to come from the approver's own login, not a forwarded form, and a clock-in only proves someone arrived. Pre-approve overtime, have payroll accept approvals only from the approver, compare claimed hours with work records, and keep the time records. In the ACFE's 2026 report payroll schemes had a median loss of USD 63,000 and ran a median 13 months.

## Checklist
1. Write down who can approve overtime, that it needs approval before it is worked except in emergencies, and who checks the hours afterwards. A rule nobody wrote down can't be checked.
2. Make payroll accept overtime and timesheet approvals only from the approver's own account in the time or payroll system. Don't accept emailed forms with a pasted or scanned signature, and never let the person claiming the hours be the one who sends the approval to payroll.
3. Give each person their own clock-in code or login, and look for impossible punches: clock-ins from the same device seconds apart for different people, punches on days someone was off, or hours on a day with no work output.
4. Compare the hours claimed with records the employee didn't produce: jobs or tickets closed, deliveries, register logins, door or alarm logs, GPS on company vehicles, customer sign-offs. Overtime with no matching work is the gap to explain.
5. Each pay period, rank overtime by person and by approver. One person's overtime climbing, overtime only ever approved by one supervisor, or overtime that sits just under a review threshold all deserve a look.
6. Watch the person who collects or keys in other people's timesheets most closely. In the Boston case that was the role that let the false forms through.
7. Don't trust the clock-in alone. A clock-in, badge swipe or hand scan only proves someone was there at that moment; spot-check that people are actually at work during long or overtime shifts.
8. Keep the time cards and the approvals. Under the federal wage-and-hour rules employers must record hours worked each day and each week, and keep time cards for at least 2 years.
9. If you plan a fingerprint, hand or face clock to stop coworkers clocking each other in, check your state's biometric privacy law first. In Illinois you need written notice and a signed release before collecting it.
10. If you find padded hours, talk to your accountant and an employment lawyer before docking anyone's pay or confronting them, and keep the original records as they are. Fixing padding must never mean cutting hours someone did work.

## How do employees get paid for padded timesheets and overtime they didn't work?
- The ACFE's Occupational Fraud 2026 report defines a payroll scheme as a fraudulent disbursement scheme in which an employee causes their employer to issue a payment by making false claims for compensation, giving as examples an employee claiming overtime for hours not worked and an employee adding ghost employees to the payroll.
- In the Boston Housing Authority case announced by the U.S. Attorney's Office for the District of Massachusetts on March 31, 2026, the employee was an executive secretary who collected the weekly timesheets and overtime forms of other staff and could earn overtime herself. Overtime had to be approved in advance by senior management, and she was supposed to send her form to her supervisor by email for electronic approval. From January 2023 she instead entered overtime she hadn't worked, falsified her supervisor's signature without the supervisor's knowledge, and emailed the forms directly to payroll, which added the overtime to her weekly paycheck: over 100 forms through August 2024, about USD 72,131. She pleaded guilty to wire fraud.
- The lesson is about the path, not the form. Payroll paid on a document that looked approved; it had no way to tell that the approval never came from the approver. An approval recorded in the approver's own account, or sent by the supervisor directly, closes that path.

## Does a time clock or biometric scanner stop overtime fraud?
- On October 20, 2026 a former MBTA track inspector pleaded guilty to conspiracies including overtime fraud. According to the U.S. Attorney's Office for the District of Massachusetts, from January to October 2024 he and his alleged co-conspirators submitted false overtime sheets: they didn't show up for the shift at all, showed up hours late, or showed up at the start of the shift, used the hand scan and then disappeared for hours, sometimes to sleep in their vehicles, before coming back. The same release says inspection records were also falsified and made to look longer than they were.
- A biometric or badge clock stops one person clocking in for another, but it only records a moment. The check that would have caught the rest is a comparison of paid hours with the work those hours should have produced, done by someone other than the people claiming them.
- The federal rules don't require a clock at all. 29 CFR 785.48 says time clocks are not required, that minor differences between clock records and hours actually worked can't always be avoided, but that major discrepancies should be discouraged because they raise doubt about the accuracy of the records. Rounding to the nearest 5, 6 or 15 minutes is accepted only if, over time, people are still paid for all the time they actually worked.

## What records do employers have to keep for hours worked and overtime?
- Under 29 CFR 516.2, employers covered by the federal minimum wage and overtime rules must keep, for each such employee, the hours worked each workday and the total hours worked each workweek, along with straight-time earnings and overtime premium pay. Under 29 CFR 516.6, the time cards or sheets showing daily start and stop times must be kept for at least 2 years from the last entry. State rules can ask for more.
- For fraud checks, keep three things side by side: the hours as clocked, any edits to them with who made the edit, and the approval for each overtime block. A time record that can be edited after approval, with no trace of the edit, is as weak as a forwarded form.
- If you add a fingerprint, hand-geometry or face clock, the Illinois Biometric Information Privacy Act (740 ILCS 14/15) requires a public written retention and destruction policy, written notice of what is collected, why and for how long, and a signed written release, which for employees can be signed as a condition of employment. Section 20 sets statutory amounts of USD 1,000 per negligent violation and USD 5,000 per intentional or reckless one; since Public Act 103-769 (effective August 2, 2024), collecting the same biometric from the same person by the same method more than once counts as one violation.
- In the ACFE's 2026 report, payroll schemes appeared in 227 of 2,402 cases (10%), with a median loss of USD 63,000, a median duration of 13 months and a median of about USD 4,800 lost per month. They showed up in 13% of cases at organizations with fewer than 100 employees against 8% at larger ones. Across all schemes, 43% of frauds were first detected by a tip, and 55% of tips came from employees, so coworkers who see a colleague's empty shift are often the first to know.

## Ask Rightshold (free, no key)
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code (one-click setup: https://www.rightshold.com/start?ref=seo), then ask: "Open a human approval request before payroll pays one employee's overtime for week 45. I want my approval recorded against the exact hours, the pre-approval reference and a hash of the time-clock export, so payroll only pays overtime that matches something I approved from my own account, not an emailed form."

```json
{
  "tool": "request_human_approval",
  "arguments": {
    "action": {
      "type": "overtime_payout",
      "period": "2026-W45",
      "employee_ref": "EMP-31",
      "overtime_hours": 6.5,
      "preapproval_ref": "OT-PRE-2026-1104-07",
      "work_evidence_ref": "JOBS-2026-W45-EMP-31",
      "timeclock_export_sha256": "<sha256 of the week's time-clock export>"
    },
    "summary": "Pay EMP-31 6.5 overtime hours for week 45 (pre-approved as OT-PRE-2026-1104-07; matched to closed jobs in JOBS-2026-W45-EMP-31).",
    "expires_in_minutes": 2880
  }
}
```
- Needs your API key. Only the owner's account key can decide it (decide_human_approval); delegated agent keys are refused. The decision is a signed, timestamped receipt that includes a hash of the action, so an emailed form or a pasted signature can't stand in for it.
- verify_human_approval (free) with the receipt, its signature and the overtime as payroll is about to pay it says whether it matches what was approved. Different hours or a different time-clock export give a different hash, so it won't match. With only {id} it returns the status without comparing the action.
- The mirror ledger has no payroll entry type, so keep the hours and the export hash inside the approval action as shown. Use employee references, not names, and keep who is who in your own files.

_Rightshold doesn't connect to your time clock, scheduling, payroll or HR software, and it can't count hours, see who clocked in or detect padded timesheets. It records the approvals you ask for and lets anyone check them later, so it only helps if payroll checks overtime against them before paying. Case details are from U.S. Attorney's Office press releases (the MBTA release describes some co-conspirators' conduct as alleged); federal rules are from the eCFR and the Illinois law from the Illinois General Assembly site, read November 14, 2026; ACFE figures are from Occupational Fraud 2026. Not legal, employment, payroll or accounting advice._

## Sources
- [U.S. Attorney's Office, District of Massachusetts: Former Boston Housing secretary pleads guilty to falsifying overtime forms (March 31, 2026)](https://www.justice.gov/usao-ma/pr/former-boston-housing-secretary-pleads-guilty-falsifying-overtime-forms)
- [U.S. Attorney's Office, District of Massachusetts: Former MBTA employee pleads guilty to conspiracies to falsify track inspection reports and collect fraudulent overtime payments (October 22, 2026)](https://www.justice.gov/usao-ma/pr/former-mbta-employee-pleads-guilty-conspiracies-falsify-track-inspection-reports-and-0)
- [eCFR: 29 CFR 785.48, Use of time clocks (rounding)](https://www.ecfr.gov/current/title-29/subtitle-B/chapter-V/subchapter-B/part-785/subpart-D/subject-group-ECFR4e5fdb9ac2ab26d/section-785.48)
- [eCFR: 29 CFR 516.2, records of hours worked](https://www.ecfr.gov/current/title-29/subtitle-B/chapter-V/subchapter-A/part-516/subpart-A/section-516.2)
- [eCFR: 29 CFR 516.6, records to be preserved 2 years (time cards)](https://www.ecfr.gov/current/title-29/subtitle-B/chapter-V/subchapter-A/part-516/subpart-A/section-516.6)
- [Illinois General Assembly: Biometric Information Privacy Act, 740 ILCS 14](https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57)
- [ACFE: Occupational Fraud 2026, A Report to the Nations](https://www.acfe.com/-/media/files/acfe/pdfs/rttn/2026/2026-report-to-the-nations.pdf)

## Related
- [How to spot a ghost employee on your small business payroll](https://www.rightshold.com/answers/how-to-spot-a-ghost-employee-on-your-small-business-payroll)
- [How do you catch a salesperson inflating commissions with fake or reversed sales?](https://www.rightshold.com/answers/how-to-catch-a-salesperson-inflating-commissions-with-fake-or-reversed-sales)
- [How to check your payroll provider or bookkeeper actually paid your payroll taxes to the IRS](https://www.rightshold.com/answers/how-to-check-your-payroll-provider-or-bookkeeper-actually-paid-your-payroll-taxes-to-the-irs)
- [How to prove small business books weren't edited after the fact](https://www.rightshold.com/answers/how-to-prove-small-business-books-werent-edited-after-the-fact)

_Not legal advice. Updated 2026-11-14. JSON: https://www.rightshold.com/answers/how-to-catch-employees-padding-timesheets-or-claiming-overtime-they-didnt-work.json_