Ghost Employee Schemes
A ghost employee is a fictitious person created on the payroll system whose wages are diverted to a bank account controlled by the fraudster. Schemes typically require the perpetrator to have access to payroll processing and the ability to add or modify employee records.
Ghost employees may share bank account details with the fraudster, use addresses linked to the fraudster or their associates, or have national insurance numbers that fail validation checks.
Detection Methodology
Detection begins with reconciliation of payroll records against HR employee files. Every employee on the payroll should have a corresponding HR file with verified identity documents, signed contract, and confirmed bank details.
Red flags include: employees with no HR file; duplicate national insurance numbers; bank accounts linked to existing employees or the payroll administrator; employees added shortly after changes in payroll system access; and employees who never take holiday or receive performance reviews.
Data Analytics Approach
Forensic accountants use data analytics to analyse the complete payroll dataset - not just current employees. Analysis includes: trend analysis of headcount and payroll cost; comparison of payroll changes against HR onboarding records; bank account clustering (multiple employees sharing accounts); and analysis of who authorised payroll changes and when.
Digital forensics may complement accounting analysis by examining system access logs, identifying when ghost employees were created, and establishing the audit trail of modifications.
Quantification
Total loss is the sum of all payments to ghost employees or inflated wages, including employer national insurance and pension contributions improperly paid. Forensic accountants trace each payment through bank records and reconcile against the payroll system.
Where wage inflation rather than ghost employees is involved, the loss is the difference between actual pay and legitimate pay rates, calculated across the full period of manipulation.
Prevention Controls
Effective payroll fraud prevention requires segregation of duties - no single employee should control both payroll processing and employee record maintenance. Regular reconciliation of payroll against HR records, independent review of payroll changes, and automated alerts for new employee additions below approval thresholds all reduce opportunity.
Under the Failure to Prevent Fraud offence, inadequate payroll controls may form part of a prosecution case against the organisation.