The Top 5 Ways Your Payroll Person May Be Stealing From You

How Would I Know If My Payroll Admin Is Stealing From Me?

When the Keys to the Kingdom Go to the Wrong Person

Payroll fraud costs U.S. businesses billions of dollars each year, and small to mid-sized companies are disproportionately at risk. The good news: most payroll fraud is preventable with the right systems, policies, and habits in place. 

This post is about how your payroll employees can steal from you without you even having a clue.  Tricks like changing pay rates, adding fake workers, or moving money to their own accounts can cost you tens of thousands of dollars. Little errors and loopholes in controls allow bad actors to pilfer and not get caught immediately.

Even trusted employees might skim if there’s no one watching. Understanding how payroll thieves can steal from you helps finance and accounting leaders detect vulnerabilities and prevent leakage.

Key Takeaways

• Payroll theft most often happens via ghost employees, fake wages, commission scheming, benefit fraud, and data theft. Frequently it happens by taking advantage of lax controls or oversight.
• Periodic audits, separation of duties, and robust access controls are your best defenses against payroll fraud in your organization.
• Introducing tech like secure payroll systems and data analytics can help detect suspicious payroll transactions and fraud patterns quickly.
• Teaching employees about ethics and fraud helps establish an environment of honesty and minimizes the likelihood of internal threats.
• By promoting transparent reporting avenues and safeguarding whistleblowers, businesses enable workers to express concerns without fear of reprisal.
• Talk to attorneys and keep records so you can respond, recover, and sue if you find payroll fraud.

How Employees Steal From Payroll

Payroll fraud is surprisingly common.  Schemes like employment fraud are executed by individuals with access to payroll who manage to steal money they haven’t earned. Sometimes, it’s as simple as switching a few digits in the payroll system. Owners and managers must understand that I’ve witnessed these payroll frauds at both large and small companies, leading to significant financial losses and a breach of trust. Here’s how these scams unfold.

1. Ghost Employees

A ghost employee is a fictitious name on the payroll. The payroll person creates a dummy record and wires money to an account he controls. I’ve even come across instances where a “worker” got paid for years and was never reported. Big hint: payroll for people you’ve never even met.

Another giveaway is when one person is in charge of all hiring, firing, and payroll information... and that person never takes a vacation. Periodic audits and verifying IDs canassist in identifying these phantoms. Employers and managers have to recognize and inquire about anything strange on payroll.

PRO TIP:

Employ separate attendance technology which is putside the payro;; system.  Then reconcile actual workers through their logins/punches against payroll registers.

2. False Wages

Faux wage fraud can be as easy as tacking on overtime or increasing base pay without permission. This can occur when payroll people process changes unchecked. I once found a payroll person who slipped herself a bonus every month, buried in the normal pay file.  In an organization that regularly awards bonuses for extra work or certain duties including shift differentials, these can blend in without notice. 

Payroll employees are uniquely positioned to steal. Look for weird bumps in pay or overtime that is inconsistent with workload. Have managers sign off on any change to pay. Defined guidelines about overtime and bonuses prevent many issues.

PRO TIP:

Many modern payroll vendors can be set to send notifications to specific managers when compensation or other changes are made.  Set these and don't allow the payroll processor to have a security roll in the system that allows them to change it.

Timesheet fraud, which involves faking hours, is also ubiquitous across industries.

So is buddy punching, when a friend punches the clock for somebody else allowing them to arrive late or leave early.

Routine audits make it difficult to conceal inflated hours or wages.

PRO TIP:

Your payroll processor should be sending you or another manager the pre-process payroll report with a gross payroll amount.  If this is done at every pay run, you can easily compare gross amounts across pay periods to catch differences.  In addition, the payroll report will allow the review of any inconsistencies.  Not to mention that it will act as a deterrent to the payroll employee knowing you are watching.

3. Commission Schemes

It’s not as easy to commit commission fraud.  Employees can’t usually overstate sales or fake deals to obtain bigger commissions. So, how do employees steal commissions?  I witnessed one where a worker claimed a big sale each quarter and even submitted flimsy documentation towards it.  But it caught up to them because the revenue never equaled out.

The real way most commissions are stolen involve your payroll admin. The salesperson convinces the payroll employee to pad commission payouts within the system and gives that accomplice a kickback.

Search for commission spikes or other sales that don’t pass normal patterns. Demand evidence with each commission assertion. Educate your employees about proper reporting and drop the hammer that you are reconciling on a regular basis.

PRO TIP:

Scrutinize numbers when you audit sales against commissions.  The smaller OR the bigger the grab the easier it is to pass inspection.  Small steals are harder to detect and large thefts are often ignored because no one thinks an employee would be so bold. 

4. Data Theft

Payroll data holds private details: names, social security numbers, bank accounts, and pay rates.  Often, the information in a payroll system can hold just as much value to a thief as the actual money compensation.  Years ago, I saw a payroll employee who took her work home.  She was bringing home files with sensitive information.  It wasn't even that employee, but the employee's teenager who found the data and stole it, putting it up for sale on the dark web.  

Thieves can steal by duplicating files or by hacking.  A strong passphrase (not just a password) and software updates are your friend.

Restrict payroll data access. Do not allow access from home or removal of payroll or personnel files from the office.  Ensure that paper files kept onsite are always locked... Always.   Do not allow a "bring your own device" policy or any removable storage media to ever be connected to company systems.

PRO TIP:

Educate all employees on phishing schemes. I’ve seen fraud recently where an email comes from what looks like HR with fake “update your account” notices and then those direct deposits get hijacked. 

5. Benefit Fraud

Employee benefits represent one of the most overlooked — and exploitable — areas of payroll fraud. When someone controls the benefit portal, manages deductions, or processes enrollments, they have a surprising amount of power to redirect money in ways that can go undetected for months or even years.  Here's how it typically plays out...

Phantom Deductions That Never Reach Their Destination

A payroll employee sets up a deduction labeled "Health Premium" or "401(k) Contribution" for themselves or a ghost employee. The money is pulled from the company's ledger just like any legitimate benefit deduction — but instead of flowing to an insurance carrier or retirement fund, it routes to a personal account or simply disappears into a fraudulent vendor. Because the line item looks like a normal benefit expense, it rarely raises flags during a routine review.

Inflating Their Own Benefit Elections

Employees with portal access can quietly modify their own benefit elections outside of open enrollment — bumping up their employer-matched contributions, adding dependents who don't qualify as dependents, or enrolling in supplemental benefits they haven't paid for. Since most companies audit benefit elections infrequently (if at all), these changes can persist indefinitely.

Waiver Fraud

Some companies offer a cash-out or stipend to employees who waive employer-sponsored health coverage. A dishonest payroll employee can secretly claim the waiver payment for themselves while also retaining coverage — double-dipping on both the stipend and the benefit. With access to the enrollment system, they can make the records reflect whatever tells the most favorable story.

 

The common thread?

All of these schemes exploit a lack of segregation of duties and/or a lack of financial controls. When one person can both set up  and approve the resulting payments, there's no second set of eyes to catch the discrepancy. Strong internal controls — independent audits, cross-trained positions for accountability, cross-checking deductions against carrier invoices, and spot checks on payroll across pay periods — are some of the most effective deterrents.

Uncovering Payroll Fraud

Payroll fraud is more prevalent than most people want to believe. It is the cause of 1 in every 6 occupational fraud schemes in North America. Typical payroll fraud schemes persist, on average, a year and a half before detection at a cost to businesses of about $2,800 monthly or about $50,000 per incidence.

Small and mid-sized companies are just as vulnerable as the biggest companies. With so much at risk, every owner and manager ought to be aware of the warning signs and prevention measures. Detecting and preventing effectively depends on process, transparency, and technology. Building a culture of trust and enforcing controls is the right mix.

Unusual Transactions

Payroll fraud usually makes a mark in your account records. One classic sign is payment amounts that don’t match the norm. This may be an employee receiving an unauthorized higher pay rate, or additional pay cycles are surreptitiously added.

Sometimes, a Payroll Admin might add ghost employees to grab additional pay. Look for transactions that lack proper supporting documentation, such as absent onboarding paperwork or unusual timing. Genuine payroll runs are typically routine, but scammers might insist on last-minute payments.

Implement alerts for large or unusual payroll disbursements, particularly outside standard cycles. Data analytics can identify incongruous payment patterns, such as hours rounded up regularly or payments that always go to the same account.

We found, for instance, an employee who established numerous accounts in order to collect small payments many times over many months. Two-factor authentication and outside audits make it a lot tougher for anyone to move money under the radar.

Employee Complaints

Employee voices are among the best canaries in the coal mine, especially when it comes to detecting potential employee fraud. Folks on the ground catch what others miss—like a co-worker living beyond their means or someone consistently working 'over-time' that no one else observes. Complaints related to payroll processes need to be treated seriously and investigated promptly, not dismissed.

An anonymous complaint hotline can assist here. Not everyone dares to speak up, particularly if the suspect is powerful (think HR & Payroll). Document all complaints and resolutions. This assists in identifying patterns and demonstrates to all that you care about payroll integrity.

Establish trust so they know you want them to come forward and create written policies that will shield them with whistleblower protections. I have personally taken multiple anonymous calls to our free complaint hotline that identified costly problems.  It is effective when trusted.

Lifestyle Changes

Sometimes, payroll fraud manifests in ways that are entirely unrelated to numbers in a spreadsheet. Unexpected splurges, new cars or exotic vacations can be a tip off when the income level doesn’t match. It’s not about intruding into private lives, but about observing that something has changed without making sense.

If you observe a lidestyle transition wihout an accompanying compensation increase, it may be worth a look at your books. Comparing visible lifestyles to reported income sometimes uncovers deeper issues. Looking out for these red flags combined with integrity training marks very specific expectations for your conduct.

How to Safeguard Payroll

Payroll fraud is not just a hypothetical risk; it’s a real threat that companies of all sizes face. Sophisticated internal controls are the backbone of payroll security, crucial whether you employ five people or five thousand. While there’s no one-size-fits-all solution to prevent all fraud schemes, you can minimize risk by combining robust processes, transparent supervision, and modern technology.

Duty Segregation

Dividing separate payroll responsibilities is a simple yet frequently ignored measure in preventing payroll fraud schemes. The person who enters employee hours should not be the same person who approves payroll or who cuts checks as this can lead to significant fraud risk.

For instance, I had an employee who elected benefits but never had the deductions set up in the payroll.  The employee "never noticed" and because the same payroll accountant set up the benefit deductions as ran the payroll, no one caught it until a year went by.  At that point, it becomes a difficult decision:  Does the company eat $14,000 of benefit premiums or do you make an employee pay back the $14,000?  Which employee?  the one who made the 'mistake," or the one who 'never checked' their paystub? This company ended up losing the money to avoid seeming unfair.  Documenting each payroll step and assigning multiple spot-checks leaves less space for ambiguity and helps in identifying anomalies.

Small shifts went through for months until a big, mysterious bonus showed up on her personal check, highlighting the risks of insufficient oversight. That’s why dividing duties between a minimum of two people counts for so much. Check who does what at least semi-annually, particularly if you have a small team or if roles have changed, to combat employee fraud effectively.

Make it difficult for an individual to both perpetrate and conceal payroll fraud. Implementing robust internal audits.  Don't let friends check friends.  They can cover for each other instead of holding each other accountable.

Cross train employees on payroll and benefits and rotate them in and out to catch or prevent fraud. 

Regular Audits

Document straightforward processes and revise them as your company expands to ensure compliance and mitigate potential financial losses.  These are known as internal or financial controls.

Audits are not just for large companies. Even SMBs need to audit payroll quarterly. Internal audits assist in identifying mistakes and strange patterns, such as duplicate payments or unexpected wage increases. If you can, have an outside auditor come in once a year for a fresh look.

I’ve witnessed situations where an external set of eyes discovered a series of ‘mistakes’ by payroll processors. Design an audit trail into payroll. Most modern payroll systems do this automatically.  Every change from updating direct deposit info to changing tax codes is logged and can be reviewed at any time.

Accounting and Financial Managers should not simply sign off on payroll, but actually review what they’re approving.

PRO TIP:

Don’t simply audit the amounts; audit the detail. Implement audit recommendations. If you discover gaps, patch them up quick. Simple changes, such as a second signature for pay changes, can stop fraud before it starts.

Access Control

Restrict access to payroll information and editing. Protect payroll with secure payroll software that has encryption and two-factor authentication. Restrict access to only those who require it. I worked at a company where each manager had payroll access until someone swapped out a co-worker’s bank info and diverted the funds.

Thereafter, only HR and finance should access. Review access rights frequently. De-provision employees that leave or move roles. Educate your staff on how to recognize phishing and social engineering. New hires need to be introduced to security on day one.

The insider risk is real, so keep vigilant and systems close.

A Comprehensive Checklist to Prevent Payroll Fraud

• Use payroll software with encryption and auto-backups.
  • Not all payroll platforms are created equal. Encryption protects sensitive data from external breaches, while automated backups ensure that if records are tampered with or deleted, a clean version can be recovered.
  • Look for software that maintains an immutable audit log — one that records every change, who made it, and when, with no ability to quietly edit history.
• Require two-factor authentication (2FA) for all payroll access.
  • A stolen or guessed password alone should never be enough to access payroll systems.
  • Two-factor authentication adds a second verification layer — typically a code sent to a separate device — making unauthorized access dramatically harder.
  • This applies to remote access, admin portals, and benefit platforms, not just the primary payroll login.
• Segregate payroll duties among different staff members.
  • This is one of the most powerful fraud deterrents available — and one of the most commonly skipped. The person who sets up direct deposit should not be the same person who approves it. The person who enrolls benefits should not be the same person who reconciles carrier invoices. When one employee controls an entire process end to end, there is no internal check on their actions.
• Schedule regular internal audits — and periodic third-party audits.
  • Internal reviews catch drift and honest mistakes.
  • Independent third-party audits catch what internal teams are too close to see — or in some cases, are complicit in hiding.
  • Audits should include benefit enrollment records, deduction routing, active coverage rosters cross-referenced against current headcount, and FSA/HSA transaction histories.
• Review and update access permissions frequently — especially after role changes.
  • Access permissions accumulate quietly over time. An employee who was promoted, transferred, or terminated may retain system access long after it's appropriate.
  • Permission reviews should be triggered by any role change and conducted across all staff on a regular schedule regardless.
• Train employees on payroll security, fraud awareness, and how to report concerns.
  • The most sophisticated system controls are weakened by employees who don't understand why they matter.
  • Training should cover what constitutes a red flag, how payroll fraud typically unfolds, and how to report concerns without fear of retaliation. A well-informed team is one of the most cost-effective safeguards a company has.
• Reconcile payroll records against bank statements every pay period.
  • Every payroll run should be reconciled against the actual bank disbursement before the next cycle opens.
  • Discrepancies — even small ones — should be investigated immediately, not carried forward. Many long-running fraud schemes succeed simply because no one compared what the system said was paid against what the bank actually processed.
• Conduct dependent eligibility audits annually.
  • Employers sponsoring health benefits should periodically verify that every dependent enrolled in their plan actually qualifies for coverage.
  • Fictitious or ineligible dependents are a common and costly form of benefit fraud.
  • An eligibility audit requires employees to submit documentation — birth certificates, marriage licenses, proof of residency — and removes dependents who cannot be verified.
• Verify all new vendor and banking information independently.
  • Before processing any new direct deposit account, payroll vendor, or benefits carrier, verify the details through a channel entirely separate from the request itself.
  • Call a known number. Confirm in person. Never rely solely on an email or internal system change request to establish or update payment routing — this is one of the most common entry points for both internal fraud and external phishing attacks.
• Implement a confidential fraud reporting hotline.
  • Employees are often the first to notice something is wrong — but they need a safe, anonymous way to report it.
  • A dedicated fraud hotline or reporting portal, managed independently from HR and payroll leadership, dramatically increases the likelihood that suspicious activity gets flagged before it compounds. Studies consistently show that tips from employees are the number-one way occupational fraud is detected.
• Perform surprise payroll audits in addition to scheduled ones.
  • Scheduled audits are valuable, but a fraudulent employee who knows the audit calendar can clean up their tracks in advance.
  • Unannounced spot checks — on specific payroll runs, benefit deductions, or expense reimbursements — are far more likely to catch irregularities in the act.
• Monitor for common payroll fraud red flags on an ongoing basis.
  • Certain patterns consistently appear in payroll fraud cases: employees who never take vacation (and therefore never let anyone else access their work), payroll staff who resist oversight or process documentation, unusual spikes in overtime or benefit costs, multiple employees sharing the same bank account or address, and pay adjustments made just below approval thresholds.
  • These signals don't always mean fraud is occurring — but they always warrant a closer look.
• Establish a clear written payroll policy and review it annually.
  • A documented payroll policy — covering who is authorized to do what, what approval is required at each step, how errors are handled, and what constitutes a policy violation — creates a clear standard that is hard to quietly circumvent.
  • Policies should be reviewed and updated at least once a year, and any time the company changes payroll systems, adds headcount, or restructures its finance team.
• Work with a trusted, experienced payroll management partner.
  • Even well-run companies with strong internal controls benefit from professional oversight. A qualified payroll management service brings independent expertise, dedicated compliance monitoring, and the infrastructure to implement and maintain the controls listed here — without placing the entire burden on internal staff who may lack the time, training, or resources to manage it effectively on their own.

Can Payroll Outsourcing Secure Payroll?

An outsourced payroll firm is a specialist provider.  Business owners gain a genuine advantage in payroll security. Outsourcing payroll to a managed payroll with outside non-employee specialists reduces the risk that your own employees will cheat or engage in employee fraud by absconding with corporate funds. Partnering with a third-party payroll outsourcing firm that has checks and balances makes it difficult for insiders to circumvent the system, thus minimizing the chances of payroll fraud schemes.

We witness firsthand how simple it is for a trusted worker to sneak in extra hours or create a ghost employee. Once, a small business owner called me after his admin had been padding her hours for months before anyone noticed. With an outsourced provider, that risk disappears because your staff does not have the master keys to the entire payroll system.

How Can Outsourcing Secure Payroll? Examine their security policies. Leading vendors employ robust encryption, access limitations, and audit trails. Today, most payroll platforms utilize automated tracking to detect unusual modifications or access trends, but it takes dedicated controls, audits and know-how to utilize these features.  If you outsource your payroll, make sure these are practices the service provides. 

It’s savvy to compare the cost of outsourcing versus running payroll in-house. Every once in a while, the sticker looks higher initially, but the worth of secured payroll and reduced risk of malfeasance generally returns in spades. After all, the dollars saved from preventing a single fraud attempt can pay for years of such fees.

Most payroll outsourcing providers keep up with legal regulations and tax laws, which relieves stress for your HR or accounting team. When you handle payroll in-house, even a little slip can cause huge fines or lost trust. Managed Payroll programs pass that pressure to the pros.

Prevention is never a one-time event. Even with outsourcing, payroll fraud prevention requires continuous work. Month to month reviews for minor errors, quarterly reviews of user access, and annual process reviews identify workflow gaps.

These steps, performed by an outside payroll administration company, create a powerful firewall against fraud and significantly increase the difficulty for anyone to pilfer from you undetected, ultimately securing your organization’s financial integrity.

The Human Element of Fraud

Payroll fraud is more than lines on a ledger. It’s all about humans – real people who have access, who know and even have a reason. The human factor of fraud is often underestimated; too many entrepreneurs believe fraud occurs exclusively at large firms. In reality, payroll personnel can be your most valuable or riskiest resource. Payroll fraud schemes represent 15 percent of the occupational fraud for the U.S. Canada.

Even worse, executives and upper management account for 16 percent of them. The human with access is the one who can do the most damage. Experience tells me that it’s not always the “problem employee” you’d think. Sometimes it’s the silent, trustworthy insider who understands the system the best.

Training employees isn’t a checkbox. When you train on ethics and emphasize the burden of trust in payroll, you hit the right note. You have to let people know that payroll isn’t pushing buttons. It’s about managing every employee’s livelihood. In my years working with 5,000 to 10,000 staff companies, those with regular ethics training have fewer cases of fraud.

It’s not simply a matter of rules; it’s demonstrating why integrity is important and what’s at risk for all parties. Pin real scenarios. Demonstrate to them how just one “extra hour” on a timesheet can accumulate. Hourly-paying businesses are most vulnerable, as workers have more motivation to pad hours.

When to watch for red flags is essential. Payroll fraud schemes often go for 18 months before anyone detects them, sometimes at a cost of $2,800 per month. Carefully observe shifts in employee behavior. Is someone suddenly burning the midnight oil for no reason? Do they get defensive when asked about payroll? Upset or pressured employees occasionally justify fraud as revenge or a means to escape.

The best managers I know monitor not just the numbers, but the humans behind them. Culture is more important than most people think. A great culture can catch fraud in the act. When people are respected and valued, they don’t want to screw people over. Encourage open communication. Make it easy for people to question something if it feels wrong.

Incentivize reporting without retribution. Basic measures such as two-factor authentication on payroll access and third-party audits establish roadblocks for potential scammers. Artificial intelligence and machine learning are significant changes as well; deploy them to identify patterns faster. Fraudsters flourish in the silence of secrecy; illuminate every transaction.

Your Legal Recourse

Payroll fraud is not just a financial issue; it’s a threat to your business integrity and to the lives of people around you. If you suspect employee fraud, you must know the legal recourse and how to protect yourself and your company. During my time as an HR leader, I’ve witnessed tiny mistakes turn into huge legal nightmares and the devastation that can follow, which is life-altering for both the employer and the accused employee.

First, realize that payroll fraud, including ghost employee fraud, is a crime. Laws vary by location, but everywhere, stealing funds or tampering with records without permission is a crime. If you’re an owner or a manager, you better document everything. Keep original payroll reports, time cards, bank records, and any e-mails or texts that look fishy. This documentation is crucial for any investigation into payroll schemes.

Take, for instance, Florida, where the statute divides theft into petit theft and grand theft. If the amount is over $750, it’s classified as a felony. It’s tempting to panic and say the wrong thing, so don’t speak to your boss or investigators before consulting a lawyer. Collect evidence demonstrating your compliance, such as timesheets or emails documenting that you adhered to regulations. I once witnessed a payroll clerk blamed for a missing bonus but rescued by emails showing she followed the correct process.

Always consult a legal expert when dealing with payroll fraud cases, as they can become tangled fast. They can involve criminal, civil, and even wrongful termination claims. If you’re accused, hire a defense lawyer who knows the ins and outs of employee fraud. They understand the law, your rights, and how to construct a defense. You may have defenses such as mistaken identity or no intent to steal.

In one case, a client’s payroll manager was accused of shifting money, only to find out the system had auto-corrected a pay mistake. Good records and the right lawyer kept things fair and calm. For entrepreneurs, explore ways to recover lost capital. The law might even let you sue for what was taken. Courts can make the thief pay it back, but you need good records and evidence to support your claims.  Even when the cpurt finds for you, repayment is dependent upon the person being able to repay.

If the theft resulted in termination, see whether the termination was justified and lawful. Wrongful discharge is a genuine threat if you terminate without evidence or procedure. I’ve assisted clients (non-legal, HR-only guidance) in recouping losses and dodging lawsuits by maintaining the appropriate paper trail and adhering to legal procedures.

Your Bottom Line

Payroll theft seems obvious on the surface, yet it lurks in the open. A payroller can slip in fake hours or ghost workers. Every now and then, a trusted employee pulls some side deals or moves some numbers. One business owner I knew had a bookkeeper sneak in her own cousin on the payroll for months. That owner caught it by looking at payroll reports each week, not just at tax time. To prevent this, monitor records frequently, separate payroll duties, and employ external assistance if you’re uncertain. Trust is important, but oversight guards your ca$h. If you’re feeling adrift or pressed, drop a line to a true HR ace. We understand the hacks, and we understand how to prevent them.

Don't Wait for Fraud to Find You

If reading this made you think "we probably don't have all of this covered" — you're not alone. Most small and mid-sized businesses don't. The controls, audits, access reviews, and policy structures described in this article represent a significant amount of ongoing work, and most companies simply don't have the dedicated internal resources to do it all consistently.

That's exactly the gap that payroll fraud lives in.

At My Virtual HR Director, we work with business owners and managers every day who are running lean, trusting their people, and hoping for the best — until something goes wrong. We help you put the right systems, oversight, and safeguards in place before that happens, not after.

If you'd like a straightforward conversation about where your payroll process may be exposed, we'd be glad to take a look.

There's no obligation.  Our managed payroll system solves employee trust and theft issues.

👉 Schedule a free consultation with an expert

Or call us directly at (888) 694-7347 — we're real people and we pick up.