Payroll Fraud: 7 Schemes Small Businesses Need to Know (2026)
Payroll fraud is one of the most damaging fraud categories in the ACFE's data — not because individual losses are the largest, but because it takes the longest to catch. The median payroll fraud scheme runs for 18 months before detection, compared to 12 months for other fraud types. Every month it runs, it costs an average of $2,800. By the time someone notices, the damage is done and the perpetrator is often still on the payroll. This guide covers the 7 most common payroll fraud schemes targeting small businesses — how each works, what makes it hard to spot, and the controls that catch it early.
Payroll is one of the largest and most routine expenses a small business has — which is exactly what makes it a good place to hide fraud. Individual fraudulent payments are small relative to the total payroll run, they repeat on a predictable schedule, and they're processed by the same person who has access to the records. Without a second set of eyes comparing what was paid to who actually worked, the scheme can run indefinitely.
7 Payroll Fraud Schemes
A ghost employee is a fictitious or terminated worker who remains on the payroll and collects paychecks that are diverted to the fraudster. Ghost employees are added by someone with payroll system access — typically an HR manager, payroll clerk, or bookkeeper — and are designed to look routine. Payments are small enough to avoid scrutiny and can run for months or years before anyone compares the headcount against actual employees.
In more sophisticated versions, the ghost is assigned to real projects, given fabricated performance reviews, and excluded from headcount reports. The longer the scheme runs, the bolder the fraudster typically becomes — adding overtime, raises, or additional ghost employees.
Paycheck diversion occurs when an attacker changes an employee's direct deposit routing to an account they control. It can be carried out internally by a payroll administrator changing another employee's banking details, or externally through credential theft — a fraudster phishes a payroll portal login and changes the routing before the next pay cycle. The real employee typically doesn't notice until their paycheck fails to arrive.
AI tools are increasingly being used to facilitate this scheme — deepfake audio and video have been used to impersonate executives or HR staff and authorize payroll banking changes, with documented losses reaching into the millions.
Timesheet fraud involves claiming and receiving payment for hours not actually worked — through falsified manual timesheets, manipulated time-tracking entries, or unauthorized overtime claims. It's the most common form of payroll fraud by volume, particularly in hourly and shift-based workplaces. In small businesses where managers approve their own team's timesheets with limited oversight, it's especially difficult to catch without comparing logged hours against output or project records.
Buddy punching is when one employee clocks in or out on behalf of a colleague — allowing the absent employee to claim pay for time they didn't work. It's technically collusion between employees rather than a single-actor fraud, and it's extremely common in hourly workplaces with manual or card-based timekeeping. At small businesses, it can be dismissed as a minor issue, but it compounds quickly: even 30 minutes per shift across five employees adds up to thousands of dollars a year.
Commission fraud involves manipulating sales records, customer data, or order history to inflate earnings — claiming commissions on sales that didn't happen, were returned, or belong to another employee. Bonus manipulation is similar: an employee with access to performance data alters the figures that determine their own bonus. Both are difficult to catch when the person processing compensation also has access to the underlying records used to calculate it.
Worker misclassification fraud involves deliberately classifying employees as independent contractors — or vice versa — for financial benefit. An employer might misclassify workers to avoid payroll taxes, benefits costs, or labor law obligations. An employee or manager might misclassify themselves to access contractor payment rates. Either version creates liability exposure beyond the direct financial loss, including IRS penalties and back taxes.
A terminated employee remaining on the payroll — collecting paychecks after their last day — can be deliberate fraud by the payroll processor, a clerical error, or collusion between the former employee and a current staff member. In high-turnover environments where offboarding is manual and inconsistent, it's common enough that the ACFE identifies it as a distinct variant of ghost employee fraud. The direct deposit continues to a live bank account, and the former employee may not report it.
Controls That Catch Payroll Fraud Early
Most payroll fraud is enabled by the same structural gap: one person has access to both the payroll records and the ability to process payments, with no independent review. These controls close that gap.
- Separate payroll processing from HR record keeping — the person who adds employees to the system should not be the person who processes payments
- Require manager sign-off on all new employee additions — no one is added to payroll without a second approver outside the payroll function
- Require secondary approval for all direct deposit changes — and notify the employee at their existing contact information when a change is made
- Compare payroll register to HR headcount monthly — every person being paid should appear in active HR records
- Deactivate payroll access on the day of termination — not days or weeks later
- Audit for duplicate bank accounts — two employees sharing a direct deposit account is an immediate red flag
- Require manager approval for overtime — before it's worked, not after it's submitted
- Rotate who reviews payroll — mandatory vacation for payroll staff exposes irregularities that depend on one person staying continuously present
Tips — not audits.
The ACFE consistently finds that tips from employees are the most common way payroll fraud is detected, accounting for more than half of all reported cases. This means the second most important control, after separation of duties, is a clear and safe way for employees to report something that looks wrong. A payroll register that any manager can request and review is often enough — because the person most likely to notice a ghost employee is a manager who knows their team.
Red Flags to Watch in Your Payroll Register
These signals don't confirm fraud on their own, but each one warrants a closer look before the next payroll run.
| Red flag | What it might indicate |
|---|---|
| Two employees sharing a bank account | Ghost employee whose payments route to a real employee's account |
| Employee with no vacation, sick days, or PTO taken | Ghost employee — fictitious workers never take leave |
| Round-number salary or hourly pay | Fabricated entry — real compensation rarely comes out to exactly $50,000 or $25/hr |
| Employee address matches a payroll administrator's address | Ghost employee whose checks route to the perpetrator |
| Recent direct deposit change with no HR documentation | Paycheck diversion — routing changed without the employee's knowledge |
| Consistent maximum overtime week after week | Unauthorized overtime claims or timesheet inflation |
| Employee whose name doesn't appear in any communication, project, or system | Ghost employee who has never actually worked at the company |
| Paycheck issued after an employee's listed termination date | Terminated employee still on payroll — either fraud or offboarding failure |
Frequently Asked Questions
Payroll fraud is any scheme in which an employee or external attacker manipulates a company's payroll system to obtain unauthorized compensation. The ACFE defines it as a fraudulent disbursement scheme in which an employee causes their employer to issue a payment by making false compensation claims. Common forms include ghost employees, falsified timesheets, paycheck diversion, and commission manipulation.
The ACFE's 2024 Report to the Nations found that payroll fraud accounts for 10% of all occupational fraud cases globally, rising to 15% in the United States and Canada. In high-turnover industries like transportation, warehousing, and retail, the rate climbs to around 33%. The median loss per payroll fraud case is $50,000, with a median duration of 18 months before detection — the longest detection lag of any fraud category.
A ghost employee is a fictitious or terminated worker who remains on the payroll and collects paychecks that are diverted to the fraudster. Ghost employees are typically added by someone with payroll system access — an HR manager, payroll clerk, or bookkeeper — and are designed to look routine. Payments are small enough to avoid scrutiny and can run for months or years before anyone compares the headcount against actual employees.
The most effective detection methods include comparing the payroll register against HR records and physical headcount, checking for duplicate Social Security numbers or bank accounts receiving multiple paychecks, reviewing the payroll register for employees who never take vacation, and auditing any recently changed direct deposit instructions. The ACFE reports that tips are the most common detection method — employees noticing something unusual and reporting it.
Paycheck diversion fraud occurs when an attacker gains access to an employee's payroll portal or HR system and changes the direct deposit routing to an account they control. It can also be carried out internally by a payroll administrator who changes another employee's banking details without their knowledge. The real employee typically doesn't notice until their paycheck fails to arrive — at which point one or two pay cycles of wages have already been diverted.
Check a vendor or banking change before you process it
PaySentinel checks routing numbers and banking details for fraud signals — useful for any changed direct deposit or vendor payment you want to verify before it goes out.
Run a free check →