A phantom employee is someone who’s on a company’s payroll but doesn’t actually work for the business. This can be a former employee who hasn’t yet been removed from the system, a friend of someone in the payroll department or someone who doesn’t actually exist. However, when a ghost employee is paid, the money is always intercepted by a real perpetrator.

How does it work? 

While it may be easier to hide payroll scams at organizations with multiple locations and offsite payroll departments, small businesses can be victims, too. All it takes is a dishonest employee who has access to the payroll system. These scams require three simple steps:

1. Put the phantom on the payroll. This can be as simple as adding a fictitious name to the payroll system or using the name of an employee who’s left the company. If the criminal doesn’t have access to the system, he or she might have to forge documents to create a fictitious account.

2. Create wage records. If the phantom employee is paid a regular salary, it may not be necessary to fabricate time sheets, logins and other records. Routine payments at regular intervals work to the criminal’s advantage. However, the perpetrator may have to falsify records for hourly phantom employees.

3. Collect the cash. Converting paychecks or direct deposits to cash may require more subterfuge than direct cash payments. For example, an employee may set up a falsified bank account for direct deposits. Check cashing is riskier and may lead to apprehension. But once the crook pockets the cash, the fraud trail goes cold.

What are the warning signs?

Potential red flags that signal a phantom employee could be haunting the company’s payroll system include:

• Missing or falsified employee files,
• Employees with overly vague (or no) job titles or descriptions,
• Multiple employees with the same mailing address or bank accounts for payroll deposits,
• Employees who don’t sign up for health care or retirement benefits or who fail to take paid time off, and
• Employees who list a post office box as their mailing address.

Under normal conditions, a sudden unexplained spike in employee turnover also could forewarn of phantom employees. However, many companies have been experiencing a phenomenon known as the “Great Resignation,” with employees leaving high-stress positions to achieve a better work-life balance. So, companies with high turnover should look for human resource-related causes before launching a fraud investigation. 

How can you protect payroll from ghosts?

Strong internal controls — such as managerial review — are a company’s first line of defense against phantom employees. Different supervisors might be assigned to approve payments to employees on a random basis, making it more difficult to hide a phantom employee. Supervisors should also be trained on how to scan payroll records for red flags, such as suspicious names and multiple employees with the same mailing address.

The payroll system also needs to be equipped with checks and balances. For instance, the head of a department should be required to verify any employees that are added or removed from the payroll system. Moreover, payroll records can be coordinated with personnel reviews. If an employee doesn’t show up for a review, further investigation is warranted. 

Evolving risks

Monitoring fraud risks is an ongoing process. The increasing prevalence of remote working arrangements and financial distress caused during the COVID-19 pandemic puts organizations at greater risk for payroll scams. 

When employees work remotely, people may not necessarily interact in person, providing opportunities to hide phantom employees. In addition, managers and payroll personnel who are struggling to make ends meet personally may be motivated to engage in dishonest behaviors. A forensic accounting expert can help clients assess their current risks and fortify their defenses against these scams. Please reach out if you have any questions.