Guide · Payroll & Internal Fraud

Payroll Fraud: 7 Schemes Small Businesses Need to Know (2026)

July 2026 Small Business Bookkeepers HR & Payroll 9 min read

Payroll fraud is one of the most damaging fraud categories in the ACFE's data — not because individual losses are the largest, but because it takes the longest to catch. The median payroll fraud scheme runs for 18 months before detection, compared to 12 months for other fraud types. Every month it runs, it costs an average of $2,800. By the time someone notices, the damage is done and the perpetrator is often still on the payroll. This guide covers the 7 most common payroll fraud schemes targeting small businesses — how each works, what makes it hard to spot, and the controls that catch it early.

$50K
median loss per payroll fraud case — ACFE 2024 Report to the Nations
18 mo
median time before payroll fraud is detected — the longest detection lag of any fraud category
15%
of all US and Canadian fraud cases involve payroll — rising to 33% in transportation, warehousing, and retail
⚠️ Why payroll fraud runs so long undetected

Payroll is one of the largest and most routine expenses a small business has — which is exactly what makes it a good place to hide fraud. Individual fraudulent payments are small relative to the total payroll run, they repeat on a predictable schedule, and they're processed by the same person who has access to the records. Without a second set of eyes comparing what was paid to who actually worked, the scheme can run indefinitely.

7 Payroll Fraud Schemes

1
Ghost employee
Internal Critical

A ghost employee is a fictitious or terminated worker who remains on the payroll and collects paychecks that are diverted to the fraudster. Ghost employees are added by someone with payroll system access — typically an HR manager, payroll clerk, or bookkeeper — and are designed to look routine. Payments are small enough to avoid scrutiny and can run for months or years before anyone compares the headcount against actual employees.

In more sophisticated versions, the ghost is assigned to real projects, given fabricated performance reviews, and excluded from headcount reports. The longer the scheme runs, the bolder the fraudster typically becomes — adding overtime, raises, or additional ghost employees.

Documented case
An Illinois nursing home scheduler added fictitious employees to the payroll, falsified their timesheets, and cashed the paychecks herself — siphoning more than $103,000 over two years before the discrepancy was discovered during an audit.
Defense → Regularly compare the payroll register against HR records and a physical headcount. Require that someone outside payroll approves new employee additions. Conduct periodic surprise payroll audits where managers confirm each name on the register is a current, active employee.
2
Paycheck diversion / direct deposit fraud
Internal Critical

Paycheck diversion occurs when an attacker changes an employee's direct deposit routing to an account they control. It can be carried out internally by a payroll administrator changing another employee's banking details, or externally through credential theft — a fraudster phishes a payroll portal login and changes the routing before the next pay cycle. The real employee typically doesn't notice until their paycheck fails to arrive.

AI tools are increasingly being used to facilitate this scheme — deepfake audio and video have been used to impersonate executives or HR staff and authorize payroll banking changes, with documented losses reaching into the millions.

External attack pattern
A fraudster phishes a payroll manager's login credentials, accesses the HR portal from an unrecognized device, and changes three employees' direct deposit accounts to accounts they control — collecting paychecks for two pay cycles before anyone reports a missing payment.
Defense → Require secondary approval for any direct deposit banking change. Send confirmation emails to the employee's existing email address when a banking change is made — not just to the person requesting it. Enable login alerts and device-based authentication on your payroll portal.
3
Falsified timesheets and hours
Internal High

Timesheet fraud involves claiming and receiving payment for hours not actually worked — through falsified manual timesheets, manipulated time-tracking entries, or unauthorized overtime claims. It's the most common form of payroll fraud by volume, particularly in hourly and shift-based workplaces. In small businesses where managers approve their own team's timesheets with limited oversight, it's especially difficult to catch without comparing logged hours against output or project records.

Common patterns
An employee logs 45 hours per week consistently but their output doesn't match. Overtime is claimed every week but was never authorized. Hours are submitted for days the employee was known to be absent.
Defense → Require manager approval for all timesheet submissions — especially overtime. Cross-reference logged hours against project milestones, output, or access logs where possible. Audit timesheets for patterns: consistent round numbers, consistent overtime, or hours on known absence days.
4
Buddy punching
Internal Medium

Buddy punching is when one employee clocks in or out on behalf of a colleague — allowing the absent employee to claim pay for time they didn't work. It's technically collusion between employees rather than a single-actor fraud, and it's extremely common in hourly workplaces with manual or card-based timekeeping. At small businesses, it can be dismissed as a minor issue, but it compounds quickly: even 30 minutes per shift across five employees adds up to thousands of dollars a year.

Defense → Use biometric or PIN-based time tracking that requires the employee themselves to check in. Random spot checks by managers — comparing who is physically present to who has clocked in — catch buddy punching without requiring full system overhauls.
5
Commission and bonus manipulation
Internal High

Commission fraud involves manipulating sales records, customer data, or order history to inflate earnings — claiming commissions on sales that didn't happen, were returned, or belong to another employee. Bonus manipulation is similar: an employee with access to performance data alters the figures that determine their own bonus. Both are difficult to catch when the person processing compensation also has access to the underlying records used to calculate it.

Warning signs
A salesperson's commission is consistently the highest on the team but their actual customer relationships and deal sizes don't match. Returns or cancellations on deals that generated commission are never reversed. Bonus calculations are always done by the same person who benefits from them.
Defense → Separate the person who records sales or performance data from the person who processes commission payments. Audit commissions against CRM records and customer invoices quarterly. Reverse commissions on returns automatically rather than manually.
6
Worker misclassification fraud
Internal Medium

Worker misclassification fraud involves deliberately classifying employees as independent contractors — or vice versa — for financial benefit. An employer might misclassify workers to avoid payroll taxes, benefits costs, or labor law obligations. An employee or manager might misclassify themselves to access contractor payment rates. Either version creates liability exposure beyond the direct financial loss, including IRS penalties and back taxes.

IRS exposure
A manager reclassifies several full-time staff as contractors, stops withholding payroll taxes, and pockets the difference. The IRS identifies the mismatch between W-2 and 1099 filings and initiates an audit.
Defense → Have an external accountant or HR professional review worker classifications annually, particularly for anyone whose status changed in the past year. Cross-reference contractor payments against IRS guidelines for employee vs. contractor determination.
7
Terminated employee still on payroll
Internal High

A terminated employee remaining on the payroll — collecting paychecks after their last day — can be deliberate fraud by the payroll processor, a clerical error, or collusion between the former employee and a current staff member. In high-turnover environments where offboarding is manual and inconsistent, it's common enough that the ACFE identifies it as a distinct variant of ghost employee fraud. The direct deposit continues to a live bank account, and the former employee may not report it.

How it persists
An employee is terminated verbally but HR doesn't formally process the termination in the payroll system for two weeks. During that time, two paychecks are issued. The former employee keeps the money and doesn't report it.
Defense → Require same-day payroll system deactivation as part of every offboarding process — not after the fact. Audit the payroll register monthly against active HR records to confirm every person being paid is still employed.
Concerned about a vendor payment or payroll banking change? PaySentinel checks routing numbers and banking details for fraud signals before you process any payment.
Check it now →

Controls That Catch Payroll Fraud Early

Most payroll fraud is enabled by the same structural gap: one person has access to both the payroll records and the ability to process payments, with no independent review. These controls close that gap.

The most effective detection method

Tips — not audits.

The ACFE consistently finds that tips from employees are the most common way payroll fraud is detected, accounting for more than half of all reported cases. This means the second most important control, after separation of duties, is a clear and safe way for employees to report something that looks wrong. A payroll register that any manager can request and review is often enough — because the person most likely to notice a ghost employee is a manager who knows their team.

Red Flags to Watch in Your Payroll Register

These signals don't confirm fraud on their own, but each one warrants a closer look before the next payroll run.

Red flag What it might indicate
Two employees sharing a bank accountGhost employee whose payments route to a real employee's account
Employee with no vacation, sick days, or PTO takenGhost employee — fictitious workers never take leave
Round-number salary or hourly payFabricated entry — real compensation rarely comes out to exactly $50,000 or $25/hr
Employee address matches a payroll administrator's addressGhost employee whose checks route to the perpetrator
Recent direct deposit change with no HR documentationPaycheck diversion — routing changed without the employee's knowledge
Consistent maximum overtime week after weekUnauthorized overtime claims or timesheet inflation
Employee whose name doesn't appear in any communication, project, or systemGhost employee who has never actually worked at the company
Paycheck issued after an employee's listed termination dateTerminated employee still on payroll — either fraud or offboarding failure

Frequently Asked Questions

What is payroll fraud?

Payroll fraud is any scheme in which an employee or external attacker manipulates a company's payroll system to obtain unauthorized compensation. The ACFE defines it as a fraudulent disbursement scheme in which an employee causes their employer to issue a payment by making false compensation claims. Common forms include ghost employees, falsified timesheets, paycheck diversion, and commission manipulation.

How common is payroll fraud at small businesses?

The ACFE's 2024 Report to the Nations found that payroll fraud accounts for 10% of all occupational fraud cases globally, rising to 15% in the United States and Canada. In high-turnover industries like transportation, warehousing, and retail, the rate climbs to around 33%. The median loss per payroll fraud case is $50,000, with a median duration of 18 months before detection — the longest detection lag of any fraud category.

What is a ghost employee?

A ghost employee is a fictitious or terminated worker who remains on the payroll and collects paychecks that are diverted to the fraudster. Ghost employees are typically added by someone with payroll system access — an HR manager, payroll clerk, or bookkeeper — and are designed to look routine. Payments are small enough to avoid scrutiny and can run for months or years before anyone compares the headcount against actual employees.

How do you detect payroll fraud?

The most effective detection methods include comparing the payroll register against HR records and physical headcount, checking for duplicate Social Security numbers or bank accounts receiving multiple paychecks, reviewing the payroll register for employees who never take vacation, and auditing any recently changed direct deposit instructions. The ACFE reports that tips are the most common detection method — employees noticing something unusual and reporting it.

What is paycheck diversion fraud?

Paycheck diversion fraud occurs when an attacker gains access to an employee's payroll portal or HR system and changes the direct deposit routing to an account they control. It can also be carried out internally by a payroll administrator who changes another employee's banking details without their knowledge. The real employee typically doesn't notice until their paycheck fails to arrive — at which point one or two pay cycles of wages have already been diverted.

Check a vendor or banking change before you process it

PaySentinel checks routing numbers and banking details for fraud signals — useful for any changed direct deposit or vendor payment you want to verify before it goes out.

Run a free check →