Somewhere in your payroll system right now, there might be someone who doesn't exist.
Not a typo. Not a duplicate record you'll clean up eventually. A fully-formed "employee," complete with a bank account, a tax withholding election, and a direct deposit that lands every pay period — created by someone who has access to your payroll software and knows you're not looking closely enough. Fraud examiners call this a ghost employee scheme, and it's quietly one of the most expensive blind spots in small business finance.
The numbers are bigger than most owners expect. Ghost employee schemes cost U.S. businesses an estimated $400 billion a year in aggregate losses, and payroll fraud specifically is roughly twice as likely to hit a small business as a large one, according to the Association of Certified Fraud Examiners' Report to the Nations. The reason isn't that small businesses are targeted more often — it's that they have fewer people touching payroll, which means less separation between the person who can add an employee and the person who can pay one.
What a Ghost Employee Scheme Actually Looks Like
A "ghost" isn't always a wholly invented person. In practice, fraud examiners see three common patterns:
- The fabricated employee. Someone with HR or payroll system access creates a new employee record — name, Social Security number (sometimes real, sometimes recycled), bank account — and routes a paycheck to it every cycle.
- The reactivated employee. A worker who quit or was terminated stays "active" in the payroll system. Their direct deposit keeps running, and the insider who kept the record open collects it — often by simply not updating the routing number before the exit was fully processed.
- The commission-splitting real employee. A genuine employee stays on payroll but is paid for hours they didn't work, buffered by a manager who's in on the arrangement and takes a cut.
All three share the same root cause: one person has enough unchecked authority over payroll to both create the opportunity and hide the evidence. The median ghost employee scheme runs for 18 to 30 months before anyone notices, because the paycheck looks completely normal from the outside — it clears, it reconciles against the bank feed, and unless someone is checking headcount against actual bodies in the building, nothing looks wrong.
Real cases show how far this can go. A decade-long ghost employee scheme in Florida drained more than $146 million from a single organization before it was caught. On the smaller end, an Illinois nursing facility lost $103,000 to a single insider who invented fictitious workers — a loss that, for a business that size, can be the difference between a good year and a very bad one. IRS Criminal Investigation has separately flagged over 160,000 potential ghost employer cases nationwide, with 33 completed prosecutions averaging $1.3 million in restitution each.
The Warning Signs That Actually Show Up in Your Books
You don't need forensic accounting software to catch most of this. You need to know what to look for in data you already have.
- Duplicate bank account or routing numbers across "different" employees. Legitimate coworkers essentially never share a direct deposit account.
- Duplicate or invalid Social Security numbers, or numbers that don't match the name on file.
- Shared addresses, phone numbers, or emergency contacts between an employee record and payroll or HR staff.
- Tax withholding that never changes — no life events, no adjustments, no W-4 updates, year after year.
- Missing onboarding paperwork — no I-9, no benefits election, no performance review, ever.
- Headcount on payroll that exceeds the number of people anyone in the office can actually name.
- Unusually smooth, unchanging pay — real employees have overtime, sick days, and PTO. A ghost's paycheck is suspiciously identical every period.
Individually, any one of these could be a data-entry error. Together, especially clustered around a single employee or a single manager's team, they're the pattern examiners look for first.
Controls That Catch This Before It Costs You $100,000
The good news: the fixes here are structural, not exotic, and most are within reach of a business with a handful of employees.
Separate who can create payroll from who can approve it. This is the single highest-leverage control. The person who adds a new employee to the system should not be the same person who authorizes that employee's first paycheck. In a business too small to split this across two employees, the owner or a partner should personally approve every new hire entered into payroll — no exceptions, no "I'll review it later."
Verify bank account details independently. Before a new employee's direct deposit goes live, confirm the account belongs to who it says it does — a quick call to the person using contact information you already had on file (not information supplied with the new account request) closes off the most common fabrication vector.
Run a real, in-person headcount reconciliation quarterly, not annually. Match the payroll register against people you can actually verify are working — badge swipes, timesheets, a manager who knows every name on their team. Annual audits leave 12 months of runway for a scheme to grow; quarterly checks cut that window dramatically.
Watch for duplicate identifiers automatically. Most payroll platforms, including QuickBooks Online Payroll, Gusto, and ADP, let you export the full employee roster with bank details and SSNs. A simple spreadsheet check for duplicate values across those columns takes ten minutes and catches the most common ghost employee signature.
Do unscheduled spot-checks. A scheme built around evading a known quarterly audit date can plan around it. An occasional surprise reconciliation — pulling the payroll register the same week you happen to be reviewing something else — removes that predictability.
None of this requires new software. It requires deciding that payroll approval isn't something to delegate away entirely, even in a business where you trust everyone on staff. Fraud examiners consistently find that the absence of basic segregation of duties — not malicious intent from most employees — is what turns an isolated bad actor into a $100,000+ loss.
Why This Connects to Your Books, Not Just Your HR System
Ghost employee fraud is fundamentally a bookkeeping problem as much as an HR one. A scheme that runs for two years does so because nobody is reconciling payroll expense against a headcount they can independently verify — the transactions themselves look completely legitimate in the ledger. The fraud isn't hidden in a clever accounting entry; it's hidden in the assumption that if the numbers tie out, nobody needs to ask who actually received the money.
This is exactly the kind of gap that plain-text, version-controlled accounting is built to close. When every payroll transaction is a line in a ledger you can query, diff, and audit yourself — rather than a black box inside a payroll vendor's dashboard — it's far easier to run the duplicate-account check, flag an employee whose withholding has never changed, or compare headcount against payroll expense trend over time. You're not waiting for an annual audit to surface an anomaly that's been quietly compounding for a year and a half.
Keep Your Payroll Records Auditable From Day One
Ghost employee fraud thrives in systems nobody can easily inspect. Beancount.io gives you plain-text accounting that's fully transparent and version-controlled, so every payroll entry is traceable, queryable, and yours to audit — no vendor lock-in, no black box. Get started for free and see why developers and finance-minded business owners are moving their books to plain text.