# How can I tell if someone is paying a fake or former employee through my small business's payroll?

**Short answer:** Compare the people being paid with the people who actually work for you, and look at where the money lands. A ghost employee is someone on the payroll who doesn't work for you: a made-up person, a departed employee who was never removed, or a friend or relative of the person running payroll. The ACFE's 2024 Report to the Nations found payroll schemes in 10% of 1,921 occupational fraud cases, with a $50,000 median loss, a typical 18 months before detection, and a higher rate at organizations with fewer than 100 employees (14%) than at larger ones (9%). The common tells are two or more employees paid into the same bank account, someone with no tax withholding or benefits deductions, a terminated employee still being paid or whose bank account or address changed after they left, missing personnel files, and payroll running above budget. The control that matters most is that the person who adds people to payroll or changes bank details isn't the person who runs payroll, and that you approve each of those changes yourself and keep a record of what you approved.

## Checklist
1. Get the payroll register for the last few pay periods yourself, straight from the payroll provider, and check every name against people you know are working for you now.
2. Sort the register by direct-deposit account and look for one account receiving pay under two or more names. Ask about anyone with several accounts too.
3. List anyone with no federal tax withholding, Social Security or Medicare, or benefits deductions. Fictitious employees often have none, so check that each of them really exists.
4. Compare the termination list with the last few payrolls: anyone paid after their last day, or whose bank account or mailing address changed after they gave notice, needs an explanation.
5. Check that each employee has a personnel file kept apart from payroll, with a signed Form W-4 and Form I-9 on record.
6. If you have access, verify names and Social Security numbers with the SSA's free Social Security Number Verification Service. The SSA says it's only for wage reporting (Form W-2) of current or former employees.
7. Watch total payroll against your budget and headcount. Labor costs that run above budget, or an employee number far outside the usual range, are worth a look.
8. Separate the duties: whoever adds employees, changes pay rates or changes bank details shouldn't also run and approve payroll. In a small business the usual answer is that the owner approves every new hire, rate change and bank change before the next run.
9. Keep a record of each approval outside the payroll system (who, what, when, and a hash of the bank details you approved), so a later change that wasn't approved stands out.

## How common is payroll fraud in small businesses?
- The ACFE defines a payroll scheme as a fraudulent disbursement in which an employee causes their employer to issue a payment by making false claims for compensation, for example claiming overtime for hours not worked or adding ghost employees to the payroll. In its Occupational Fraud 2024 report, payroll schemes made up 190 of 1,921 cases (10%), with a median loss of $50,000, a median duration of 18 months and a median loss of about $2,800 per month. Payroll schemes appeared in 14% of cases at organizations with fewer than 100 employees, against 9% at organizations with 100 or more.
- The ACFE's fraud tree lists two payroll sub-schemes besides commissions: ghost employees and falsified wages. Joseph T. Wells, the ACFE's founder, wrote in the Journal of Accountancy that a ghost is frequently a recently departed employee, a made-up person or a friend or relative of the fraudster, and that most ghost-employee frauds originate with payroll personnel.
- Ghosts need somewhere to send the money. The ACFE's Other People's Money excerpt explains that purely fictitious ghosts are often paid into the fraudster's own account, sometimes into a separate account opened in the ghost's name so a duplicate-account test won't flag it, and that diverting a former employee's pay means changing that person's address or bank details in payroll or personnel records. That's why bank-detail changes after someone leaves deserve as much attention as new hires.

## What are the red flags of a ghost employee on payroll?
- In the case Wells describes, a payroll specialist added fake master records using a co-worker's password he had watched her type, and had the ghosts' pay direct-deposited into his own account. The clues afterwards included ghost records using dead people's Social Security numbers, employee numbers in a gap well above the real ones, no personnel files and no tax or Social Security withholding, multiple direct deposits to one account under different names, and a payroll summary for the supervisor printed in a different typeface from the real ones.
- Wells's prevention list: segregate payroll preparation, disbursement and distribution; look for paychecks without tax or Social Security deductions; examine paychecks with dual endorsements; check records for duplicate names, addresses and Social Security numbers; now and then hand out paychecks and ask for identification; and be wary of labor costs above budget.
- The ACFE excerpt adds that hiring should be separate from payroll, personnel records should be kept independently of payroll and timekeeping, any payroll change should be verified by someone outside payroll, and direct-deposit account numbers should be checked periodically for duplicates.

## How can a small business without HR keep ghost employees off payroll?
- Most small businesses can't split payroll across three departments. The practical version is that the owner keeps the approvals: every new employee, rate change, bonus and bank-detail change is approved by the owner before the pay run, and the person running payroll can't make those changes alone.
- Then the owner checks the result. Each pay period, compare the register with the approvals: anyone paid who wasn't approved, any rate that differs from the approved one, and any bank account that doesn't match the approved bank details. That comparison only works if the approvals are kept somewhere the payroll person can't edit.

## Ask Rightshold (free, no key)
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code (one-click setup: https://www.rightshold.com/start?ref=seo), then ask: "Before the next payroll run, ask me to approve this new direct-deposit account for employee W-031: our employee reference, a hash of the new bank details and who requested the change. Wait for my yes or no."

```json
{
  "tool": "request_human_approval",
  "arguments": {
    "action": {
      "type": "payroll_bank_change",
      "worker_ref": "W-031",
      "new_bank_details_sha256": "<sha256 of routing and account number as entered in payroll>",
      "requested_by_ref": "<user reference>",
      "effective_pay_date": "2026-11-20"
    },
    "summary": "Approve new direct-deposit account for W-031 before the Nov 20 payroll",
    "expires_in_minutes": 1440
  }
}
```
- Needs an API key. Only the owner's account key can decide (decide_human_approval); delegated agent keys are refused. The signed, timestamped decision goes on Rightshold's ledger.
- Before the pay run, verify_human_approval (free, no key) checks the approval id against the action as it stands in payroll. A different account number gives a different hash, so it won't match.
- Use the same pattern for new hires and rate changes (type new_employee or pay_rate_change with worker_ref and the approved amount in cents).
- Don't send names, Social Security numbers or bank account numbers. Send your own employee reference and a SHA-256 hash of the bank details.

_Rightshold doesn't connect to your payroll provider, HR system or bank, and it doesn't detect fraud or check that an employee exists. It records the approvals you send and lets anyone check them later. It only protects you if your payroll process refuses changes without a matching approval. If you suspect payroll fraud, talk to your accountant, a fraud examiner or a lawyer before confronting anyone, and keep the records as they are. Not legal, tax, audit or employment advice._

## Sources
- [ACFE: Occupational Fraud 2024: A Report to the Nations (payroll 190 of 1,921 cases, $50,000 median, 18 months, 14% vs 9% by size, payroll scheme definition)](https://www.acfe.com/en-us/-/media/files/acfe/pdfs/rttn/2024/2024-report-to-the-nations.pdf)
- [Journal of Accountancy (Joseph T. Wells): Keep Ghosts Off the Payroll](https://www.journalofaccountancy.com/issues/2002/dec/keepghostsoffthepayroll/)
- [ACFE: Other People's Money (2024 excerpt): ghost employee distribution and prevention](https://cms.acfe.com/-/media/files/acfe/word-documents/other_peoples_money_2024_excerpt_redacted.pdf)
- [Social Security Administration: Social Security Number Verification Service (SSNVS)](https://www.ssa.gov/employer/ssnv.htm)

## Related
- [How to spot a fake vendor in your accounts payable](https://www.rightshold.com/answers/how-to-spot-a-fake-vendor-in-your-accounts-payable)
- [How to verify a vendor's bank account change request before you pay](https://www.rightshold.com/answers/how-to-verify-a-vendors-bank-account-change-request-before-you-pay)
- [How to spot signs someone is hiding theft in your bank reconciliation](https://www.rightshold.com/answers/how-to-spot-signs-someone-is-hiding-theft-in-your-bank-reconciliation)
- [How to keep a copy of your business books that your bookkeeper can't edit](https://www.rightshold.com/answers/how-to-keep-a-copy-of-your-business-books-that-your-bookkeeper-cant-edit)

_Not legal advice. Updated 2026-11-10. JSON: https://www.rightshold.com/answers/how-to-spot-a-ghost-employee-on-your-small-business-payroll.json_