Payroll Fraud (2026): Types, Ghost Employees, a Detection Checklist and the Controls That Work

TL;DR

• Payroll fraud is any scheme that makes a company pay wages, commission or other compensation it does not owe, such as pay to ghost employees, pay to people who have left, hours never worked or commission on deals that were later cancelled.
• The ACFE's Occupational Fraud 2026 report found payroll schemes in 10% of cases, with a median loss of $63,000 and a median of 13 months before detection.
• You find payroll fraud by matching payroll against other records: the HRIS, time and badge data, bank details, the CRM and the contracts behind each payment. The checklist below covers each test.
• Sentra joins what payroll, the HRIS and the CRM say with what people said in email, chat and meetings, and raises a payment that no longer matches reality to its owner with the evidence. A named person approves before anything goes out.

What payroll fraud is

Payroll fraud is a scheme in which someone causes a company to pay compensation it does not owe, usually by falsifying who is employed, how much they worked or what they earned. The Association of Certified Fraud Examiners defines a payroll scheme as a fraudulent disbursement in which an employee makes false claims for compensation, for example claiming overtime for hours not worked or adding ghost employees to the payroll.

The ACFE's 2026 study covered 2,402 cases from 143 countries. Its payroll figures give a sense of scale.

The per-month figure is the useful one for a CFO. A scheme that keeps running costs more every pay period, so the value of a control is mostly in how soon it fires.

This guide also covers two leaks that are not always fraud but drain payroll the same way: pay that continues after someone leaves through a process gap, and contractor payments that continue after the work ended. Strictly, the ACFE counts false vendor invoices as billing schemes rather than payroll. Finance teams usually review both together, because the detection method is the same.

Types of payroll fraud

Lano and The Undercover Recruiter describe the same core patterns. Ghost employees, falsified hours and commission fraud appear in both.

Ghost employees

A ghost employee is someone on the payroll who does not work for the company. The ghost is either invented, or a real person, often a former employee, whose pay continues into an account the fraudster controls. Ghosts survive because payroll checks that each payment matches a record in payroll, and the fraudster controls that record.

The strongest test is outside payroll. A real employee leaves traces: an HRIS record with a manager, badge entries, logins, calendar invitations, messages, expense claims. A ghost has a payroll record and little else. Pull the list of everyone paid in the last pay run, then flag anyone with no activity in any other system over the last 60 days. Most flags will be explainable, such as parental leave or long-term sick leave. The ones that are not deserve a direct conversation with the listed manager.

Paying people who have left

This leak often starts without intent. HR records a termination date, but the payroll stop depends on someone sending a form, and the form is late or never sent. In some cases a person inside the process notices and redirects the continuing pay. The test is simple: no payment should be dated after the HRIS termination date, other than final pay and items the law requires. Our employee offboarding checklist puts the payroll stop under payroll's last-day tasks.

Commission on cancelled deals

Sales commission is usually paid when a deal closes, and the deal can unwind later. A customer cancels in the first month, a contract is refunded, or the invoice is never paid. If the commission plan has a clawback clause but nobody checks deal status after payment, the commission stays paid. Sometimes this is deliberate, such as deals pulled into a quarter and cancelled after the payout. Often the cancellation was agreed by email between the account manager and the customer, and the CRM was updated weeks later or not at all.

Payroll fraud detection checklist

Run these tests on every pay run where you can automate them, and quarterly where you cannot. PayrollOrg describes several of the same analytics.

Every pay run

• Every person paid has an active HRIS record, or a termination date after the pay period.
• No payment, other than final pay, is dated after a termination date.
• Hours or pay above a set tolerance, such as overtime over 20% of base hours, are flagged for review.
• Payroll total is reconciled to the payroll register and to budget by department.
• Bank detail changes made since the last run were verified with the employee through a known channel.

Monthly

• Direct deposits are grouped by bank account and by mailing address. Two unrelated employees sharing one is a flag.
• Rate changes, new hires and terminations entered by the same user are reviewed by someone else.
• Commission lines are matched to CRM deal status and cash collected. Deals cancelled, refunded or unpaid within the clawback window are flagged.
• Contractor invoices are matched to active projects and to the end dates their owners confirmed.

Quarterly

• Everyone paid is matched to activity in other systems: badge, login, calendar or expense records.
• Recorded hours are compared with schedules and access logs for a sample of hourly staff.
• Payroll system changes made outside working hours are reviewed.
• Each manager confirms the list of people paid in their team.

Payroll fraud controls

The ACFE found that a lack of internal controls was the primary weakness in 33% of all cases, override of existing controls in 19% and lack of management review in 18%. Those three accounted for 70% of the frauds in the 2026 study. The controls below target each one.

• Separate the duties. The person who adds an employee or changes a rate should not be the person who runs or approves the pay run. Our guide to segregation of duties has a matrix for payroll and procure-to-pay.
• Make the HRIS the trigger. Payroll starts and stops from HRIS events, not from forms that someone must remember to send.
• Verify bank changes out of band. Confirm any change through a phone number or channel already on file, never one given in the request.
• Have managers confirm their team. A quarterly list of who was paid, sent to each manager to sign off, finds ghosts quickly because the manager knows who works for them.
• Write clawback into commission plans and check it. A clawback clause only works if someone matches paid commission to deal status after payment.
• Give contractors an end date that finance can see. The project owner records when the work ends, and accounts payable checks each invoice against it.
• Review and monitor, with some surprise. The ACFE found that management review, proactive data monitoring and analysis, a code of conduct and surprise audits were associated with the largest reductions in both losses and time to detection.

Worked example: three leaks in one quarter

The figures are illustrative. A 600-person company runs payroll twice a month. In one quarter, three things happen.

A warehouse supervisor leaves on 31 March. HR records the termination in the HRIS. The payroll stop form is sent to the wrong inbox, and the supervisor's salary of $2,500 per pay period continues. By the end of June, six extra payments have gone out, a total of $15,000.

A data contractor's project ends in April. The project lead writes to her manager: "The migration is done, we won't need him after this month." The contractor's purchase order runs to December, and his $9,000 monthly invoice keeps being approved because it matches the purchase order. May and June cost $18,000.

An account executive closes a $120,000 annual deal in March and receives 10% commission, $12,000. In May, the customer emails the account executive to cancel within the 60-day termination window in their contract. The CRM still shows the deal as closed-won. The plan has a 90-day clawback clause, but nobody checks deal status after payout, so the $12,000 stays paid.

The total for the quarter is $45,000. Each record looked correct in its own system. The leaver was terminated in the HRIS, the contractor's invoices matched the purchase order and the deal was closed-won in the CRM. In each case the fact that changed the answer sat somewhere payroll and accounts payable do not look: a misrouted form, an email to a manager, an email from a customer.

Common mistakes

• Testing payroll only against payroll. A ghost employee's payroll records are consistent with each other. The test has to use another system.
• Relying on forms to stop pay. If payroll waits for a form, every late form is a payment that should not happen.
• Treating clawback as automatic. The clause exists, but nothing enforces it unless someone matches commission to deal status.
• Approving invoices against the purchase order alone. A purchase order shows the maximum the company agreed to pay, not that the work is still happening.
• Assuming every overpayment is fraud. Many are process errors. Recover the money, fix the trigger and keep the accusation for the cases the evidence supports.
• Waiting for the annual audit. At a median $4,800 a month, a payroll scheme found at the 13-month median has already cost about $63,000.

How Sentra catches this automatically

Payroll leaks last because the fact that stops a payment often sits outside the system that makes it. The HRIS has the termination. The CRM has the deal. The email that says the work ended, or that the customer cancelled, sits in someone's inbox.

Sentra joins what the systems of record say with what people said. It reads the HRIS, ERP and CRM alongside email, chat, meetings and documents, and works out what is true now and since when. When a project lead writes that a contractor is no longer needed, Sentra records the date that became true and checks later invoices against it. When a customer's cancellation email arrives, Sentra checks the deal's status in the CRM and the commission paid on it. When the HRIS shows a termination, Sentra checks the pay runs that follow.

When a payment no longer matches reality, Sentra raises it to the person who can stop it, such as the payroll lead, the controller or the head of sales operations, with the evidence: the payment, the record and the message that changed the answer. A named person approves each finding before it reaches anyone else. Every claim cites its source, and permissions follow the source, so pay data and HR conversations stay visible only to people who could already see them. Sentra replaces none of your systems. Your HRIS, payroll and ERP stay the record. Sentra holds SOC 2 Type II and ISO 27001 certifications and runs in the cloud, in an isolated VPC or air-gapped on premises.

The same join catches neighboring leaks, such as revenue leakage from unbilled work and contract compliance gaps. To see it run against your own payroll, contractor and commission records, book a demo.

How to start

• Start with leavers. Pull a year of terminations from the HRIS and check every payment dated after each one. It takes an afternoon and is the most likely place to find money.
• Then commissions. Match a year of commission payments to the current status of each deal in the CRM and to cash collected.
• Then contractors. List active contractor purchase orders and ask each project owner to confirm the work is still running.
• Then automate the per-run tests in the checklist above, and send the quarterly team list to every manager.

FAQ