To prevent payroll fraud, build internal controls that stop any single person from running the whole payroll process end to end: separate the duties, verify every employee is real, require documented approval for pay changes, audit the register on a regular and surprise basis, force payroll staff to take consecutive time off, and lock the system down with multi-factor authentication and role-based access. Most schemes run for about 12 months before anyone notices, and they thrive where one employee controls too much of the pipeline.{1Association of Certified Fraud Examiners. Occupational Fraud 2024 – A Report to the Nations} The controls below target the specific weaknesses fraudsters exploit.
Split Payroll Duties Across Separate People
The single most effective structural defense is making sure no one person can create an employee record, process a payment, and reconcile the bank account. When all three powers sit with the same person, fabricating a ghost employee and collecting their paycheck becomes trivially easy. Split the work: HR staff add and maintain personnel records, a separate payroll clerk processes payments based on those records, and a third person handles bank reconciliation without access to either HR files or payroll processing.
That third role is where most organizations cut corners, and it’s exactly where fraud hides. The reconciler’s job is to compare what left the bank account against what the payroll system says should have left. If that person also runs payroll, they can simply paper over discrepancies. Keep the reconciler completely walled off from the other two functions. The same logic applies to distributing physical checks or authorizing direct deposit batches. Whoever releases funds should sit outside the payroll department.
Outsourcing When Staff Is Too Small to Segregate
A five-person office can’t realistically split payroll across three employees. In that situation, outsourcing to a reputable payroll provider is the most practical way to build in segregation. The outside firm handles processing and tax filings, while someone internal retains oversight of employee records and reviews the provider’s reports. This isn’t a set-it-and-forget-it solution. You still need to review payroll registers each cycle, reconcile the totals, and verify that the provider’s output matches your own HR data.
Verify Every Employee on the Payroll Is Real
Ghost employees are the bread and butter of payroll fraud. Someone in payroll or HR invents a worker, assigns them a bank account the fraudster controls, and collects a paycheck every cycle. The defense is straightforward: verify that every person on the payroll actually exists and actually works for you.
Start by cross-referencing Social Security numbers, addresses, and bank account details across your entire employee roster. Duplicate bank accounts or mailing addresses across different employee records are a red flag worth investigating immediately. Every new hire should have a properly completed Form I-9 on file, which requires examining identity and work authorization documents within three business days of the start date.{2U.S. Citizenship and Immigration Services. Form I-9 Employment Eligibility Verification} Cross-check Form W-4 data as well.
Use the Social Security Number Verification Service
The Social Security Administration offers employers a free tool called the Social Security Number Verification Service (SSNVS) that lets you confirm whether employee names match their Social Security numbers against SSA records.{3Social Security Administration. The Social Security Number Verification Service} You can verify up to 10 names and SSNs online with immediate results, or upload a file of up to 250,000 records overnight. Registration goes through the SSA’s Business Services Online portal, and the agency mails an activation code to your business address as a security step.
One boundary to note: SSNVS can only be used for wage reporting purposes, meaning you verify current or former employees for W-2 accuracy. It is not a pre-hire screening tool. For employment eligibility verification at the hiring stage, E-Verify serves that function and can flag identity discrepancies before someone ever makes it onto the payroll.
Keep the Roster Current
Verification isn’t a one-time event. Payroll administrators should regularly compare the active employee list in the payroll software against the physical or digital records held by HR. Terminated employees need to be removed from the payroll system on or before their final paycheck. A former employee lingering in the system is how many ghost-employee schemes begin. Discrepancies in birth dates, tax identification numbers, or addresses between the two systems should trigger an immediate inquiry.
Require Documented Approval for Every Pay Change
Every change to an employee’s compensation, whether a raise, a bonus, an overtime adjustment, or a shift in tax withholdings, needs a documented approval from someone other than the payroll processor making the change. This sounds obvious, but in practice it’s the control most often skipped when things get busy. A payroll clerk who can unilaterally bump a pay rate without a supervisor’s sign-off has the power to inflate their own salary or funnel extra money to an accomplice.
Build a formal workflow: the requesting manager submits the change with a reason and effective date, a supervisor or department head approves it with a signature, and only then does the payroll processor enter it into the system. Standardized forms, whether paper or digital, should capture the specific dollar amount, the justification, and who authorized it. These documents stay in the employee’s personnel file permanently. If you ever need to pursue legal action for embezzlement, that paper trail is your evidence.
Digital signatures are legally valid for these authorizations under the federal E-SIGN Act, so there’s no need to chase down physical ink signatures. The signer must affirmatively consent to using electronic records. Most modern payroll and HR platforms have built-in approval workflows that satisfy this standard.
Federal regulations require employers to preserve payroll records, including hourly rates, hours worked, and wages paid, for at least three years from the last date of entry.{4eCFR. 29 CFR Part 516 – Records to Be Kept by Employers} That three-year floor is a minimum. If you suspect fraud may have occurred, keep everything until the matter is fully resolved.
Audit the Payroll Register on a Schedule and Without Warning
Segregation of duties and approval workflows are preventive controls. Audits are your detective control. They catch what the other safeguards missed. An independent reviewer, someone who doesn’t process payroll or manage HR records, should examine the payroll register regularly for patterns that don’t look right.
What to look for:
- Sudden overtime spikes for specific employees, especially when their department didn’t report increased workload.
- Any payment to an employee whose termination date has passed.
- Paychecks in suspiciously round numbers, which often indicate manual entries rather than calculated wages.
- Manual checks that bypass the normal electronic processing workflow. These are a classic vehicle for unauthorized payments.
- Two payments for the same amount to the same employee in one cycle, or payments to different employees routed to the same bank account.
Compare total payroll expenditure against the prior period. Significant jumps that don’t correspond to new hires or approved raises deserve investigation. The goal is to catch small diversions before they compound into six-figure losses over months or years.
Add Unannounced Audits
Scheduled audits are useful, but a fraudster who knows the audit happens every January can clean up their tracks in December. Unannounced audits, conducted at random intervals, are far harder to prepare for. Even one surprise review per year sends a strong message that the books are being watched. Conducting an audit after a major change like a merger, acquisition, or rapid hiring wave is also good practice, since those transitions create exactly the kind of chaos fraudsters exploit.
For businesses that lack the internal expertise to conduct a thorough payroll audit, hiring an outside CPA or forensic accountant is worth the cost. The real value of an outside auditor is that they have no relationships or loyalties within your organization, so they have no reason to overlook oddities.
Require Payroll Staff to Take Consecutive Time Off
Many payroll fraud schemes require the perpetrator to be at their desk every day, manually adjusting entries, rerouting deposits, or covering up discrepancies before anyone notices. Forcing payroll staff to take consecutive time off disrupts that cycle. When a substitute steps in and can’t reconcile an account, or notices manual entries that don’t make sense, the scheme tends to unravel quickly.
The FDIC has endorsed mandatory vacation policies since 1995, recommending that employees in sensitive positions be absent for an uninterrupted period of at least two consecutive weeks.{5FDIC. Vacation Policies} That two-week minimum isn’t arbitrary. Shorter absences often aren’t long enough for a replacement to dig into the details and spot problems. The Washington State Auditor’s Office has echoed this approach, noting that many fraud cases only come to light after employees go on vacation and colleagues take over their duties.{6Office of the Washington State Auditor. Mandated Vacations – Good for Staff and Even Better for Your Internal Controls}
This policy only works if the substitute actually does the job. Having another person “cover” while the primary clerk continues to handle tasks remotely defeats the purpose entirely. During the mandatory absence, the substitute should have full system access and the primary employee should have none.
Lock Down the Payroll System Digitally
Modern payroll fraud doesn’t require forging checks or stuffing envelopes. Most of it happens through a login screen. If your payroll software is protected only by a username and password, a compromised credential gives a bad actor the keys to the entire system. Multi-factor authentication, which requires a second verification step like a code from an authenticator app on the user’s phone, should be mandatory for every account that touches payroll data. The National Institute of Standards and Technology considers multi-factor authentication the baseline for any system requiring high confidence in user identity.{7NIST. NIST Special Publication 800-63-4}
Beyond authentication, implement role-based access so that each user can only see and modify what their job requires. The payroll processor doesn’t need access to bank reconciliation tools. The HR administrator doesn’t need the ability to authorize payment runs. These restrictions mirror the physical segregation of duties described earlier, applied to the digital environment.
Every payroll system should maintain a detailed audit log that tracks who logged in, what they changed, and when. Pay rate modifications, new direct deposit entries, manual payment overrides, and changes to tax withholding settings should all generate a timestamped record tied to a specific user. Review these logs regularly. If someone edited a direct deposit routing number at 11 p.m. on a Friday, that’s worth a conversation even if the change turns out to be legitimate.
Give Employees a Safe Way to Report Suspicions
According to the Association of Certified Fraud Examiners, tips are responsible for detecting 43% of all occupational fraud cases, more than management review, internal audits, and every other detection method combined.{1Association of Certified Fraud Examiners. Occupational Fraud 2024 – A Report to the Nations} An organization without a clear, trusted way for employees to report suspicious activity is essentially turning off its most effective alarm system.
An anonymous hotline or online reporting portal lowers the barrier significantly. Employees who suspect a colleague is manipulating payroll are far more likely to speak up when they don’t have to put their name on the report. The U.S. Department of Labor recommends offering multiple reporting channels so that everyone sees at least one option they trust, and making anonymous submissions available as a default feature.{8Whistleblowers.gov (U.S. Department of Labor). Best Practices for Protecting Whistleblowers and Preventing and Addressing Retaliation}
Setting up the channel is the easy part. Culture is harder. If employees believe that reporting leads to retaliation, or that reports disappear into a void, the hotline is decoration. Respond to every report with a genuine investigation, protect the reporter’s confidentiality, and make clear through policy and practice that retaliation will not be tolerated. For publicly traded companies and their subsidiaries, the Sarbanes-Oxley Act provides federal legal protection to employees who report financial fraud, including payroll manipulation that involves bank fraud or wire fraud.{9Occupational Safety and Health Administration (OSHA). Filing Whistleblower Complaints Under the Sarbanes-Oxley Act} Employees covered by that law who face retaliation can file a complaint with OSHA within 180 days and may be entitled to reinstatement, back pay, and compensation for damages.