How can I tell if someone is paying a fake or former employee through my small business's payroll?

What should I check, step by step?

1. Get the payroll register for the last few pay periods yourself, straight from the payroll provider, and check every name against people you know are working for you now.

2. Sort the register by direct-deposit account and look for one account receiving pay under two or more names. Ask about anyone with several accounts too.
3. List anyone with no federal tax withholding, Social Security or Medicare, or benefits deductions. Fictitious employees often have none, so check that each of them really exists.
4. Compare the termination list with the last few payrolls: anyone paid after their last day, or whose bank account or mailing address changed after they gave notice, needs an explanation.
5. Check that each employee has a personnel file kept apart from payroll, with a signed Form W-4 and Form I-9 on record.
6. If you have access, verify names and Social Security numbers with the SSA's free Social Security Number Verification Service. The SSA says it's only for wage reporting (Form W-2) of current or former employees.
7. Watch total payroll against your budget and headcount. Labor costs that run above budget, or an employee number far outside the usual range, are worth a look.
8. Separate the duties: whoever adds employees, changes pay rates or changes bank details shouldn't also run and approve payroll. In a small business the usual answer is that the owner approves every new hire, rate change and bank change before the next run.
9. Keep a record of each approval outside the payroll system (who, what, when, and a hash of the bank details you approved), so a later change that wasn't approved stands out.

How common is payroll fraud in small businesses?

The ACFE defines a payroll scheme as a fraudulent disbursement in which an employee causes their employer to issue a payment by making false claims for compensation, for example claiming overtime for hours not worked or adding ghost employees to the payroll. In its Occupational Fraud 2024 report, payroll schemes made up 190 of 1,921 cases (10%), with a median loss of $50,000, a median duration of 18 months and a median loss of about $2,800 per month. Payroll schemes appeared in 14% of cases at organizations with fewer than 100 employees, against 9% at organizations with 100 or more.

• The ACFE's fraud tree lists two payroll sub-schemes besides commissions: ghost employees and falsified wages. Joseph T. Wells, the ACFE's founder, wrote in the Journal of Accountancy that a ghost is frequently a recently departed employee, a made-up person or a friend or relative of the fraudster, and that most ghost-employee frauds originate with payroll personnel.
• Ghosts need somewhere to send the money. The ACFE's Other People's Money excerpt explains that purely fictitious ghosts are often paid into the fraudster's own account, sometimes into a separate account opened in the ghost's name so a duplicate-account test won't flag it, and that diverting a former employee's pay means changing that person's address or bank details in payroll or personnel records. That's why bank-detail changes after someone leaves deserve as much attention as new hires.

What are the red flags of a ghost employee on payroll?

In the case Wells describes, a payroll specialist added fake master records using a co-worker's password he had watched her type, and had the ghosts' pay direct-deposited into his own account. The clues afterwards included ghost records using dead people's Social Security numbers, employee numbers in a gap well above the real ones, no personnel files and no tax or Social Security withholding, multiple direct deposits to one account under different names, and a payroll summary for the supervisor printed in a different typeface from the real ones.

• Wells's prevention list: segregate payroll preparation, disbursement and distribution; look for paychecks without tax or Social Security deductions; examine paychecks with dual endorsements; check records for duplicate names, addresses and Social Security numbers; now and then hand out paychecks and ask for identification; and be wary of labor costs above budget.
• The ACFE excerpt adds that hiring should be separate from payroll, personnel records should be kept independently of payroll and timekeeping, any payroll change should be verified by someone outside payroll, and direct-deposit account numbers should be checked periodically for duplicates.

How can a small business without HR keep ghost employees off payroll?

Most small businesses can't split payroll across three departments. The practical version is that the owner keeps the approvals: every new employee, rate change, bonus and bank-detail change is approved by the owner before the pay run, and the person running payroll can't make those changes alone.

• Then the owner checks the result. Each pay period, compare the register with the approvals: anyone paid who wasn't approved, any rate that differs from the approved one, and any bank account that doesn't match the approved bank details. That comparison only works if the approvals are kept somewhere the payroll person can't edit.