Ghost Employees: How to Identify and Prevent This Common Fraud Scheme
7/13/2026
A ghost employee is a person on the payroll who does not work for the organization. It is the most lucrative payroll fraud scheme because it is recurring — every cycle produces another payment, indefinitely, and each individual payment looks entirely ordinary.
It is also among the easiest schemes to prevent, because it requires a specific and identifiable combination of access. Understanding that combination is the whole of the prevention strategy.
The Four Variants
The fabricated employee. A person who never existed, created in the payroll system with a plausible name, an address the perpetrator controls, and bank details routing to their own account. Requires the ability to add an employee and release payment.
The retained terminated employee. A real former employee never deactivated, with bank details subsequently changed. Frequently the easiest variant to execute, because the record already exists with a legitimate history — no fabrication is required, and the audit trail shows only a bank detail change.
The non-working relative or associate. A real person, genuinely identifiable, who does no work. Harder to characterize as fraud and consequently harder to address, particularly in family-held businesses or where the person is connected to management.
The pre-hire or post-departure overlap. An employee paid before their actual start date or after their last day, sometimes as a deliberate favor rather than for personal gain. Small per instance and rarely prosecuted, but it is the same control failure.
Why It Requires Specific Access
Every variant requires the perpetrator to control two capabilities:
- Creating or maintaining the employee record — adding a person, keeping a terminated person active, or changing bank details
- Causing payment to occur — releasing the payroll, or having it released without review
Where those two capabilities sit with different people, the scheme requires collusion, which is substantially rarer and substantially riskier for the participants. Where they sit with one person, the scheme requires only opportunity.
This is why segregation of duties is not one control among many for this scheme — it is the control. Everything else is detection after the fact. See our segregation of duties guide.
A related access pattern worth noting: the scheme is also available to a manager who can both hire and approve time in a decentralized environment, without any payroll system access at all. A department head who creates a requisition, hires a person who does not exist, and approves their timesheets has the same two capabilities through a different route.
Why It Persists for Years
Each payment is unremarkable. A ghost employee earning an ordinary wage produces an ordinary payment. No variance report flags it, because nothing varies — that is the defining characteristic. Variance-based controls are designed to catch change, and a ghost employee is perfectly stable.
Nobody reconciles headcount to reality. Payroll reconciles to HR, and HR reconciles to payroll, and both records may contain the same fabricated person. The reconciliation that catches it — asking a department manager to confirm the people on their own team — is rarely performed.
Terminated employees are a process weak point. Deactivation depends on a notification arriving from elsewhere, and late or missing termination notices are so routine that an employee remaining active does not look suspicious.
Decentralized approval hides it. In an organization where department managers approve their own team's time, nobody outside that department knows who should be on it.
Growth conceals it. In a growing organization, headcount changes constantly, and one additional person is not noticeable.
The Detection Tests
Ordered by effectiveness.
Duplicate bank account and routing numbers. Sort all active employees and look for repeats. Legitimate matches exist — spouses, a parent and adult child — and each should be confirmed individually rather than assumed innocent or guilty. An account shared by employees with no apparent relationship is the strongest single indicator available.
This test also finds the diversion variant, where a real employee's bank details were redirected to an account already receiving another payment.
Duplicate addresses. Same method. Household members are legitimate; unrelated employees at one address warrant examination. Include a check for addresses matching a payroll or HR staff member's own address.
Headcount confirmation by department manager. Provide each manager a list of the employees charged to their department and ask them to confirm each person. This is the test that finds a ghost employee whose HR record is also fabricated, and it is the one most organizations never perform. Do it annually at minimum.
Employees with no deductions. A fabricated employee has no benefit elections, no garnishments, and often only tax withholding. A real employee almost always has something more.
Employees with no leave usage across an extended period.
Employees with no email account, badge access record, or system login, cross-referenced against IT and facilities records. A person who is paid but has never logged in or entered a building is either genuinely remote and identifiable, or not real.
Terminated employee payment check — compare the register to HR's termination list every cycle.
Employees added and paid in the same cycle, especially where the record was created by whoever released the payroll.
Manual and off-cycle payments, which bypass the normal review.
Missing or invalid Social Security numbers, or numbers failing a format check. Note that Social Security Administration verification is intended for wage-reporting accuracy rather than as a fraud tool, but a mismatch notice is nonetheless information.
Our How to Prevent Payroll Fraud session covers the full test set, and our fraud detection guide covers the other schemes.
The Preventive Controls
Separate record creation from payment release. The person who adds an employee must not be the person who releases the payroll. In a small department the release approval can sit with a manager, controller, or owner reviewing a variance report — it does not require a second payroll professional.
Require documented authorization to add an employee. An approved requisition or offer, from someone other than the person entering the record.
Verify bank account changes through a second channel, and hold the first payment to a new account. This addresses both the diversion attack and the terminated-employee variant.
Make termination processing reliable. A same-day or next-business-day standard for entering separations, with monthly reconciliation of HR terminations against active payroll records. This control serves several purposes simultaneously — it also protects the COBRA notification window, which runs from the qualifying event. See our COBRA administration guide.
Reconcile to a third source. Department manager confirmation, badge access records, or system login records. Payroll-to-HR reconciliation alone cannot detect a person fabricated in both.
Mandatory vacation for payroll staff, with the cycle run by someone else. One of the few controls that surfaces a scheme without anyone looking for one.
Rotate duties where staffing permits.
Review access on every departure and role change. An active account for a departed administrator is a serious gap.
Provide an anonymous reporting channel. A meaningful share of frauds are discovered through a tip rather than a control, frequently from someone who noticed a name they did not recognize.
Handling the Non-Working Relative
Worth addressing separately, because the response differs.
Where a real, identifiable person is on the payroll doing no work — frequently a family member of an owner or executive — this may or may not be fraud in the criminal sense, but it is a genuine problem with several dimensions:
- Tax treatment. Wages paid for no services may be recharacterized, with consequences for deductibility and for the recipient.
- Benefit plan implications. The person may be participating in a retirement or health plan on the basis of employment that does not exist, which can create qualification issues.
- Workers' compensation and unemployment premium and reporting consequences.
- Fiduciary duty, where the organization has outside investors or is a nonprofit.
- Discovery risk in any audit, examination, or transaction due diligence.
The practical difficulty is that the person authorizing it is frequently senior to whoever notices. A payroll professional in that position should document the facts factually, escalate through whatever channel exists — internal audit, the board, an ethics line — and seek advice rather than confronting it alone. This is precisely the situation an anonymous reporting channel exists to serve.
Quantifying and Recovering
Once a ghost employee is confirmed, two workstreams run in parallel, and the second is frequently neglected.
Quantify precisely. Establish the total from payroll records rather than estimating — every payment, every period, with the employer's payroll tax cost on those wages included, since FICA and unemployment taxes were paid on fictitious wages. Add any benefit contributions made on the ghost's behalf, including retirement plan contributions and health premiums, which are also losses. Document the methodology, because both insurance recovery and any restitution depend on a defensible figure.
Notify your insurer promptly. Fidelity, crime, and employee dishonesty coverage typically responds to this loss, and policies carry notice requirements that can be short. Late notice is a common reason a recoverable loss goes unrecovered. Involve the broker early and follow the policy's proof-of-loss requirements precisely.
Pursue tax recovery. Employment taxes paid on wages to a person who did not exist may be recoverable through amended returns, and Forms W-2 issued to a fictitious person require correction. This is technical work worth doing, because the amounts are meaningful and the corrections are required regardless.
Consider the reporting obligations. Depending on the organization, these can include notifying the external auditor, disclosing to a board or audit committee, and in regulated industries a regulatory filing. A material fraud discovered and not disclosed to the auditor creates a second problem.
Coordinate with counsel on referral. Whether to refer to law enforcement is a decision with consequences for the investigation, for the insurance claim, and for any employment action, and it should be made deliberately rather than reactively.
Then fix the access. A scheme that ran for years reveals the specific combination of capabilities that enabled it, and terminating the individual closes none of it.
Frequently Asked Questions
What is a ghost employee?
A person on the payroll who does not work for the organization. Four variants exist: a fabricated person who never existed, a real terminated employee kept active with bank details subsequently changed, a real non-working relative or associate, and an employee paid before their start date or after their last day. It is the most lucrative payroll fraud scheme because it recurs every cycle indefinitely.
How do you find a ghost employee on the payroll?
The most effective test is sorting all active employees by bank account and routing number to find duplicates, confirming each legitimate match individually. Follow with duplicate address tests, a headcount confirmation asking each department manager to verify the people charged to their team, reports of employees with no deductions or no leave usage, and cross-references against IT login and badge access records.
Why don't variance reports catch ghost employees?
Because variance controls are designed to detect change, and a ghost employee is perfectly stable. The payment amount is the same every cycle, so nothing varies and nothing is flagged. This is why detection requires existence tests — confirming that each paid person is real — rather than change detection.
What single control prevents ghost employee fraud?
Separating the ability to create or maintain an employee record from the ability to release payment. Every variant requires one person to control both, so where those capabilities sit with different people the scheme requires collusion, which is far rarer and riskier. In a small department the release approval can sit with a manager or owner reviewing a variance report rather than a second payroll professional.
Can a ghost employee scheme happen without payroll system access?
Yes. A department manager in a decentralized environment who can both initiate a hire and approve timesheets has the same two capabilities by a different route — creating the record and causing payment — without touching the payroll system. This is why headcount confirmation should come from a source independent of the person who approves the department's time.
What should you do about a non-working relative on the payroll?
Document the facts factually and escalate through an available channel — internal audit, the board, or an ethics line — rather than confronting it, since the person authorizing it is frequently senior to whoever notices. Beyond the fraud question, wages paid for no services raise tax recharacterization, benefit plan qualification, workers' compensation and unemployment reporting, and fiduciary duty issues, all of which surface in any audit or transaction due diligence.
Going Deeper
Detection requires existence tests rather than change detection, and prevention requires separating record creation from payment release. Reconcile to a source independent of both payroll and HR, since a person fabricated in both systems cannot be found by comparing them.
