Ghost Employee Fraud: Strategies for Detection and Prevention

In November 2021, after material irregularities were uncovered within the Passenger Rail Agency of South Africa’s (PRASA) ICT and payroll systems, the South African government launched an investigation into the matter. A year later, a preliminary report revealed that 1,480 PRASA workers could not be verified. In other words, they were ghost employees.

A ghost employee is a worker who exists on paper and is added to a company’s payroll to receive a paycheck, even though the company does not employ them. A recent global fraud study found that ghost employees were one of the most prevalent types of occupational fraud. According to the report, payroll fraud accounted for 8% of reported cases, resulting in substantial financial losses.

In PRASA’s case, early estimates are that launching the investigation saved the agency R200 million. However, payroll fraud continues to be a global problem, affecting organizations in every region and every industry worldwide. In the UK, for example, the annual losses from payroll fraud were estimated at £17 billion.

Ghost employment is a fraudulent practice designed to collect a wage unlawfully. Considered a form of payroll fraud, ghost employment occurs when an individual is added to a company’s payroll and receives a paycheck, although the company does not employ them.

What is ghost employee fraud?

Ghost employee fraud is a white-collar crime in which a dishonest worker adds an individual – often fictitious – to the organization’s payroll. The fraudster sets up these “ghost employees” and arranges for them to receive a salary, benefits, or overtime payments, even though they do not perform any work for the company. The fraudster then diverts these fraudulent payments into their bank account or an accomplice’s.

Identifying ghost employees can be challenging, but the following characteristics can help:

• Unusual patterns in attendance or overtime claims
  Since ghost employees typically do not exist, they don’t physically show up for work. However, the fraudster will manipulate the attendance or timekeeping records to give the impression that these ghost employees are working regular hours or even overtime.

  Unusual patterns may include consistent overtime claims (without a legitimate reason), frequent early arrivals, or other deviations from “normal” attendance patterns for these ghost employees. The fraudster might exploit their position within HR or payroll to facilitate these manipulations.

• Multiple salary payments going to the same bank account
  Ghost employees often use the same bank account for the deposit of wages. This happens because the fraudster directs the fraudulent salary payments to a bank account under their control or to a co-conspirator’s account.

  To avoid suspicion, they may split the payments among multiple ghost employees, each associated with the same bank account. This can make it harder for the fraud to be detected since the total payroll expense may not appear significantly inflated.

• Employees with minimal or no direct supervisor interaction
  Ghost employees often have little or no interaction with their supposed supervisors. They typically don’t attend meetings, participate in training, or communicate with other team members. Lack of performance reviews, absence of work-related emails or communications, or no physical presence at the workplace are indicators of this characteristic.

The Financial implications of ghost employee fraud

Ghost employee fraud can have significant and wide-ranging financial implications for organizations. These implications can negatively affect a company’s bottom line, reputation, and overall operational integrity. Here are some of the main consequences of ghost employee fraud:

• Monetary losses
  Ghost employee fraud results in the embezzlement of funds from the organization. The diversion of salary payments, benefits, and potentially overtime payments can lead to substantial financial losses, i.e., decreased net income and reduced funds available for legitimate business operations, investments, and growth.

  The financial strain caused by ghost employee fraud can also create cash flow problems. Paying nonexistent employees can drain cash reserves, making it challenging for the organization to meet its financial obligations, such as paying bills, suppliers, and creditors on time.

• Erosion of trust
  Employee trust in the organization can be eroded if they become aware of ghost employee fraud. Fraudulent activities within their workplace typically damage employee perception of the company and its leadership, often leading to a decline in morale and productivity.In addition, when trust is compromised due to fraud, employees may become less loyal to the organization.

  In some cases, employees may leave the organization due to concerns about fraud and unethical practices. This can lead to higher turnover rates and the loss of valuable talent.

• Legal repercussions
  Ghost employee fraud can have significant legal repercussions for organizations. Regulatory agencies may take action against the organization if they find that its lack of internal controls or oversight contributed to the fraud. Sanctions can include fines, investigations, and increased regulatory scrutiny.

Additionally, organizations may be sued by shareholders, investors, or other stakeholders who have suffered financial losses because of the fraud. Such lawsuits can result in financial liabilities and legal expenses.

How to detect ghost employee fraud

Detecting ghost employee fraud requires careful monitoring, data analysis, and internal controls. While it can be challenging to identify ghost employees, there are several steps organizations can take to detect this type of fraud:

• Regular payroll audits
  A payroll audit is a periodic review of a company’s payroll processes and records to verify that it’s paying employees accurately, timely, and compliantly. A thorough payroll audit can help uncover fraud attempts, such as creating ghost employees and pocketing their wages.

  Depending on the complexity of the company’s payroll security, the time frame of the audit can range from a single pay period to an entire fiscal year. Crucial things to look at in a payroll audit include names, titles, start dates, and pay rates.Verifying workers’ identity – i.e., ensuring that the list of employees on your payroll matches your employment records – is critical to weeding out ghost employees.

• Cross-verification
  Cross-verification involves comparing and verifying data from various records and sources to identify discrepancies and inconsistencies that may indicate the presence of ghost employees.

  Cross-verification methods include ensuring that every employee listed in the payroll system has a corresponding HR record; comparing attendance and timekeeping records with payroll records; and cross-referencing payroll records with supervisor records or organization charts to confirm that every employee has a designated supervisor.

• Employee verification
  Employee verification is a proactive measure that helps organizations maintain the integrity of their payroll system and detect ghost employee fraud. This process involves thorough checks and validation procedures to ensure that all listed employees are genuine and actively employed by the organization.

  An effective employee verification process includes conducting background checks on new hires, confirming the legitimacy of educational and professional qualifications, and verifying the authenticity of documents submitted by new hires, such as social security cards, birth certificates, and driver’s licenses.

  Another recommended procedure is requiring direct supervisors or managers to confirm the employment of their subordinates by providing written verification that the employees work under their supervision.

• Monitor employee turnover
  Monitoring employee turnover is a valuable means to detect ghost employee fraud within an organization. It starts with regularly calculating employee turnover rates by department, division, or job category to identify unusual patterns. Pay close attention to departments or positions with abnormally low or zero turnover rates.

  Next, you can benchmark your organization’s turnover rates against industry norms and averages; significant deviations from industry standards may be cause for further investigation. Reviewing termination records of departing employees can also help.Discrepancies, such as missing or incomplete termination documentation, can indicate ghost employee fraud.

• Use technology
  Technology can significantly enhance an organization’s ability to identify and prevent this fraudulent activity. Several types of technologies can be leveraged to detect ghost employee fraud, including:

1. 1. Advanced payroll systems. These systems can automatically compare payroll data with other sources of information, such as time and attendance records, to identify discrepancies.
   2. Data analytics tools. These tools can identify unusual patterns, outliers, and anomalies that may indicate ghost employee fraud.
   3. Biometric systems. Implement biometric timekeeping systems that use fingerprint or facial recognition technology to accurately track employee attendance or use biometric data as a more secure form of employee verification.
   4. Artificial Intelligence (AI). Leverage AI-powered algorithms to analyze payroll data and identify unusual patterns that may be challenging for manual reviews to uncover.

• Employ a certified fraud examiner
  Using a certified fraud examiner (CFE) can be highly beneficial in detecting ghost employee fraud within an organization. CFEs are professionals with expertise in fraud detection, investigation, and prevention. They are trained to recognize red flags, anomalies, and irregularities in financial records that may indicate fraudulent activity.

  CFEs can conduct comprehensive fraud risk assessments to identify vulnerabilities in an organization’s systems, processes, and controls that may expose it to ghost employee fraud.They are also skilled in forensic accounting and data analysis, allowing them to thoroughly examine payroll records, timesheets, attendance logs, and financial transactions to uncover inconsistencies or suspicious patterns.If there are suspicions of ghost employee fraud, CFEs can conduct detailed investigations. This includes gathering evidence, interviewing employees and witnesses, and compiling a case that can be used in legal proceedings, if necessary. CFEs follow a structured and ethical investigative process, ensuring that investigations are conducted impartially and within legal boundaries.

Strategies to eliminate ghost employee fraud

Eliminating ghost employee fraud requires a combination of preventive measures, detection mechanisms, and a commitment to ethical behaviour within the organization.

Each internal control addresses a specific weakness or potential vulnerability in the payroll process. From segregation of duties to employee training and education, payroll internal controls work together to establish a solid framework that ensures accuracy, confidentiality, and accountability throughout the payroll cycle.

There are various strategies organizations can adopt, including:

• Implement robust internal controls
  Internal controls are policies, procedures, and practices designed to safeguard an organization’s assets, ensure financial accuracy, and prevent fraudulent activities. By implementing these robust internal controls, organizations can significantly reduce the risk of ghost employee fraud and maintain the integrity of their payroll processes.

  The following mechanisms can help eliminate ghost employee fraud:

1. 1. Segregation of duties
      Segregation of duties is a crucial internal control measure within the payroll process. It involves assigning different individuals or teams to handle various aspects of the payroll process, such as data entry, payroll approval, and disbursements. Ensuring that no one has complete control over the entire process reduces the risk of errors, fraud, and unauthorized activities.
   2. Mandatory vacations
      While it may seem counterintuitive to combat fraud, mandatory vacations can be an effective control mechanism. When an employee is on vacation or leave, their absence can expose irregularities in their responsibilities. Colleagues or supervisors may notice unusual activities or discrepancies in work tasks or financial records during the employee’s absence, which could indicate fraudulent activity.

      In addition, fraudsters often rely on maintaining continuous access to financial systems and records to cover their tracks. Mandatory vacations disrupt this continuity by forcing individuals involved in fraudulent activities to temporarily step away from their schemes, making it more difficult to conceal their actions. This is a very important tool in the payroll risk management a company maintains.

   3. Whistle-blower policies
      Whistle-blower policies create a structured and confidential mechanism for employees to report concerns, unethical behaviour, or fraudulent activities without fear of retaliation, helping organizations maintain their integrity and financial security.

      Whistle-blower policies establish a safe and secure channel through which individuals can report suspicions or evidence of ghost employee fraud. Reports may include information about suspicious payroll activities, unauthorized access to personnel records, or irregularities in the hiring process, helping the organization intervene swiftly.

• Leverage advanced payroll systems
  Modern payroll systems are equipped with various fraud detection capabilities. An advanced payroll platform can help organizations eliminate the risk of ghost employee fraud by enhancing transparency, accuracy, and security in their payroll processes.It starts with integrations.

  Advanced payroll platforms are typically integrated with HR databases and timekeeping systems. This ensures that payroll data is consistently and accurately updated based on employee status changes, such as new hires and terminations.Advanced payroll platforms also offer robust access controls and user permissions. As a result, only authorized personnel can access sensitive payroll data, reducing the likelihood of fraudulent alterations.

  Additionally, payroll platforms maintain detailed audit trails and logs of all payroll activities. Audit trails help track changes to employee data and payroll transactions, making it easier to detect unauthorized alterations.

  Finally, many payroll systems have automated alert mechanisms that notify administrators of unusual payroll activities or patterns. These alerts can trigger investigations into potential schemes, such as ghost employee fraud.

• Continuous training
  This strategy involves providing ongoing education and training to employees, managers, and relevant stakeholders to raise awareness about fraud risks, develop anti-fraud skills, and foster a culture of vigilance.Continuous training ensures employees learn to identify unusual patterns or discrepancies in payroll data, timekeeping, or personnel records.

  The idea is to equip them with knowledge and skills to recognize red flags within the payroll process.Employee training should address typical payroll fraud schemes and guide how to identify and report them. This includes educating employees on different types of payroll fraud, such as ghost employees, the latest fraud techniques, and new ways to counteract them.It also includes system and technology training. Employees should receive training on how to effectively and securely use relevant technologies, such as payroll software or time and attendance systems, with an emphasis on their fraud detection capabilities.

  Continuous training can be achieved through practical exercises, mock scenarios, and case studies that simulate real-world fraud situations. It reinforces the organization’s anti-fraud policies, procedures, and controls. ensuring that employees know how to act when they encounter fraudulent behavior.

• Foster a culture of integrity
  Fostering a culture of integrity is a fundamental and overarching measure; in other words, it’s not a one-time effort but an ongoing commitment that requires sustained leadership, communication, and reinforcement.This approach centers on creating an environment where honesty, transparency, and ethical behavior are embedded in the organizational DNA. Such a culture minimizes the motivations for fraud and makes it more difficult for fraudulent activities, like ghost employee fraud, to occur.

  The commitment to integrity starts at the top. Leaders and executives must lead by example, demonstrating unwavering ethical behaviour in their actions and decisions. When employees see that leadership values ethics and integrity, they are more likely to follow suit.Ethical behavior is not enough, though. Organizations should have well-defined codes of conduct and ethics policies that articulate the expected standards of behavior. These policies should explicitly state the consequences of unethical behavior, including fraud, and emphasize the importance of reporting violations.

  Employees who consistently demonstrate ethical behavior and report concerns should be rewarded and recognized. In addition, employees should be encouraged to provide feedback on the organization’s ethical climate.

Process flow to prevent ghost employee fraud:

Other common payroll schemes

• Buddy punching
  This scheme involves employees punching in or clocking in on behalf of their colleagues, often when the absent colleague is not present at work. This scheme is a form of time theft where one employee falsely records the attendance of another, thereby inflating the absent employee’s hours worked and potentially resulting in improper payment.This is how buddy punching typically works: Many organizations use timekeeping systems, such as electronic time clocks or software-based solutions, to record employee attendance.

  These systems require employees to input a code or swipe a card to clock in and out. The employee who is present at work fraudulently clocks in for their absent colleague by entering the colleague’s identification code or swiping their card. Unless suspicion arises, the fraud often goes unnoticed.Buddy punching is a typical payroll fraud scheme that can lead to significant financial losses for the organization. Preventing buddy punching requires a combination of technology, policy enforcement, and a culture of accountability and transparency within the workplace.

• Overstated hours
  Overstated hours is a fraudulent payroll scheme in which an employee or employees deliberately exaggerate the number of hours they claim to have worked to receive higher compensation than they are entitled to. This type of payroll fraud can occur in various industries and lead to financial losses for the employer.

  There are several ways to overstate work hours. For example, employees can claim overtime hours or additional shifts they did not complete. In organizations with manual timekeeping systems or inadequate controls, employees can alter timecards, attendance sheets, or other time-tracking documents to reflect the inflated hours.Overstated hours schemes may involve the collusion of multiple employees. For instance, employees may cover for each other by vouching for the fictitious hours worked by their colleagues. Over time, if the scheme continues undetected, it can substantially inflate labor costs for the organization, affecting profitability and budgeting.

• Commission Schemes
  In the context of payroll, a commission scheme typically refers to a fraudulent practice where employees manipulate or exploit the commission-based compensation system to maximize their earnings in an unethical or illegal way.There are several types of commission schemes. False sales reporting, for example, is a scheme in which an employee falsely reports sales or transactions that did not occur.

  They might create fictitious sales orders, invoices, or customer accounts to make it appear like they have achieved higher sales targets than they actually have.Another type of commission scheme is inflated sales figures, i.e., exaggerating the value or quantity of actual sales to earn a higher commission percentage. For instance, they might manipulate the numbers to claim larger deals, more units sold, or higher-priced products.

  Sometimes, employees may apply unauthorized discounts or price reductions to sales transactions, reducing the organization’s revenue but increasing their commission earnings. They might also give discounts to friends or associates to boost their commissions.

• Unauthorized pay rate changes
  This scheme involves falsifying one’s hourly wage, salary, or other compensation-related information.
  Pay rate falsification can occur in various ways. Usually, an employee with access to payroll systems or records will make unauthorized changes to their pay rates, either by directly altering the data or through collusion with payroll administrators.

  Unauthorized pay rate changes often involve collusions between employees and supervisors or managers who approve and submit payroll data containing false pay rate information.Employees may also falsely claim eligibility for certain benefits tied to pay rates, such as healthcare or retirement contributions, resulting in increased costs for the employer.

• Deduction fraud
  Deduction fraud is a scheme in which an employee or individuals manipulate payroll deductions to their advantage to increase their net pay or reduce their tax liability in an unethical or illegal manner.Deduction fraud can take various forms. For instance, an employee can falsely claim deductions or exemptions on their payroll documents that they are not entitled to. These deductions may relate to tax allowances or other legitimate deductions that reduce taxable income.Employees may also misclassify personal expenses as business-related expenses to increase the amount of tax-deductible items on their payroll, resulting in lower tax withholding and increased net pay.
  Deduction fraud may involve falsely claiming higher charitable contributions than actually made to reduce taxable income and increase take-home pay. Some forms of deduction fraud may involve manipulating tax credits by providing false information or fabricating dependents.

Securing your peace of mind

Payroll security is the foundation of the trust between employees and employers. At Papaya Global, the world’s leading payroll and payments platform, making payroll processes more secure is a top priority. We pride ourselves on having the highest standards for payroll data and developing the perfect technology to safeguard it. Schedule a demo to learn more.