Skip to main content
Integrity Path
Category: Financial and Accounting Fraud

Ghost Employee Scheme

Also known as: Ghost Employee Fraud, Ghost Employee, Ghost Fraud
Simply put

A ghost employee scheme is a type of payroll fraud in which someone adds a fake or non-existent person to a company's payroll and collects that person's wages or benefits. Because the 'ghost' does not actually work for the organization, the payments are diverted to the person running the scheme. It is generally carried out by an insider who has access to the payroll system.

Formal definition

A ghost employee scheme is a form of internal occupational payroll fraud in which a fictitious or inactive individual is entered into or retained on an organization's payroll system so that salary, wages, or benefit payments can be issued and diverted for fraudulent gain. The scheme is typically perpetrated by an individual with payroll access who creates or maintains the ghost record and redirects the resulting disbursements. As an occupational fraud typology, it falls within the misconduct that compliance monitoring, payroll auditing, and segregation-of-duties controls are intended to detect and deter; the underlying acts may also constitute criminal offenses depending on jurisdiction, and specific legal characterization should be confirmed with qualified counsel. This entry is educational and not a substitute for professional advice.

Why it matters

Ghost employee schemes represent a form of internal occupational payroll fraud that directly drains organizational funds while remaining difficult to detect, because the fraudulent payments are embedded within legitimate, recurring payroll disbursements. Unlike one-time theft, a ghost record can generate improper payments across many pay cycles until controls or an audit surface the discrepancy. For compliance and audit teams, the scheme is a practical illustration of why payroll processes require dedicated monitoring rather than being assumed trustworthy simply because they are routine.

The scheme also sits at the intersection of compliance and ethics. On the compliance side, it typically requires adherence to internal payroll controls and, depending on jurisdiction, may constitute a criminal offense; the specific legal characterization should be confirmed with qualified counsel. On the ethics side, it depends on an insider abusing entrusted access and the trust placed in payroll functions. Because it is generally carried out by an individual with payroll system access, it underscores the importance of segregation of duties and independent verification as controls intended to deter and detect misconduct.

Addressing ghost employee risk is one component of a broader compliance and anti-fraud program, not a standalone solution. Detection controls, payroll auditing, and access management may support prevention and early identification, but their effectiveness depends on implementation, oversight, and the surrounding control environment. No single control guarantees prevention of this fraud.

Who it's relevant to

Compliance Officers and Ethics Program Managers
Ghost employee schemes are a concrete example of internal occupational fraud that anti-fraud and compliance programs are designed to address. Program managers should understand the scheme as one payroll fraud typology among many, and ensure it is reflected in fraud risk assessments, training on insider misconduct, and reporting channels rather than treated as fully mitigated by any single control.
Internal Audit and Monitoring Teams
Because the fraud is embedded in recurring payroll payments, it is primarily surfaced through monitoring and auditing functions. Audit teams are typically responsible for testing payroll records against verified personnel data and evaluating whether segregation-of-duties controls over payroll access and disbursement are operating as intended.
Payroll and Human Resources Functions
Payroll and HR staff administer the systems in which ghost records are created or retained, which makes them both a control point and, given the required system access, a locus of risk. Clear procedures for adding, verifying, and removing employee records, along with independent review, are relevant to reducing the opportunity for this scheme.
Legal and Investigations Teams
The underlying acts of a ghost employee scheme may constitute criminal offenses depending on jurisdiction, so legal and investigations teams are relevant when a suspected scheme is identified. Specific legal characterization and response should be determined with qualified counsel, as this glossary entry is educational and not a substitute for professional advice.

Inside Ghost Employee Scheme

Fictitious or Improper Payee
The core element is a name on the payroll that does not correspond to a legitimately employed, actively working individual. This may be a wholly invented person, a former employee who was never removed after termination, or a real person who does not perform work for the organization.
Diversion of Payroll Funds
Wages, and potentially associated benefits or reimbursements, are directed to a bank account, address, or payment instrument controlled by the perpetrator or an accomplice rather than to a bona fide worker.
Control Failure or Collusion
The scheme typically depends on a breakdown in segregation of duties, where one individual can both create or modify payroll records and authorize or receive disbursements, or on collusion between staff in HR, payroll, and supervisory roles.
Falsified Supporting Records
Time sheets, attendance records, onboarding documentation, or approval authorizations may be fabricated or manipulated to make the payment appear legitimate and to survive routine review.
Classification as Occupational Fraud
A ghost employee scheme is a form of payroll fraud and asset misappropriation. It is primarily a compliance and internal-control matter involving violation of law and policy with defined consequences, though it also implicates ethical failures in the individuals involved.

Common questions

Answers to the questions practitioners most commonly ask about Ghost Employee Scheme.

Is a ghost employee scheme the same as a payroll error or an accidental overpayment?
No. A ghost employee scheme is a deliberate fraud in which a person who does not work for or provide value to the organization is placed on the payroll so that someone can misappropriate the associated wages. A payroll error or accidental overpayment lacks the intentional, concealed diversion of funds that defines the scheme. Distinguishing the two matters because they call for different responses: process correction and controls remediation for errors, versus investigation, potential disciplinary action, and possible referral to legal counsel or authorities for fraud. Whether specific conduct meets the legal threshold for fraud is a determination that requires qualified legal advice.
Does having a code of conduct or anti-fraud training mean an organization is protected against ghost employee schemes?
No single component prevents or provides legal protection against ghost employee schemes. Training and a code of conduct are individual elements that may support awareness and set expectations, but they are distinct from the monitoring, auditing, segregation of duties, and payroll controls that address this specific risk. A ghost employee scheme is generally detected and deterred through a combination of controls rather than any one measure. Effectiveness depends on how those controls are designed, implemented, and maintained in context.
Which controls are commonly associated with reducing ghost employee risk?
Controls generally regarded as relevant include segregation of duties so that no single person can both add an employee to the payroll and approve payments, periodic reconciliation of payroll records against human resources records, independent verification of new hires and terminations, and review of payroll for anomalies such as duplicate bank accounts or missing identifying information. These are illustrative rather than exhaustive, and their suitability depends on the organization's size, structure, and risk profile. This entry is educational and not a substitute for professional advice on control design.
How does segregation of duties apply to the payroll process?
Segregation of duties is intended to divide payroll responsibilities so that the tasks of adding or changing employee records, authorizing payments, and reconciling accounts are performed by different individuals. The purpose is to reduce the opportunity for one person to create and conceal a fictitious employee. In smaller organizations where full separation is impractical, compensating controls such as independent review or management oversight are commonly used as an alternative. Implementation should be assessed against the organization's specific circumstances.
What role can a whistleblower channel play in detecting a ghost employee scheme?
A whistleblower or reporting channel is a distinct program component that may provide a route for employees or third parties to report suspected payroll fraud, including ghost employee schemes. It is one detection mechanism among several and is not a substitute for monitoring, auditing, or preventive payroll controls. Its usefulness depends on factors such as accessibility, protection against retaliation, and how reports are handled and investigated.
How can payroll and human resources records support detection of ghost employees?
Periodic reconciliation between payroll records and independently maintained human resources records is a practice generally used to identify individuals who appear on the payroll but cannot be verified as active, legitimate employees. Reviewing records for indicators such as shared bank account details, absent or inconsistent identifying information, or employees with no corresponding work history may support detection. These reviews are intended to surface anomalies for further inquiry rather than to conclusively establish fraud, which requires investigation and, where appropriate, legal counsel.

Common misconceptions

A ghost employee is always a completely fabricated, non-existent person.
Ghost employees can also be real individuals who no longer work for the organization (for example, terminated staff left on payroll) or real people who are enrolled but perform no actual work. The defining feature is that payroll funds flow to a payee not entitled to them, not that the person is imaginary.
Anti-fraud training on its own will prevent ghost employee schemes.
Training is one component of a broader control environment and is intended to raise awareness and support detection, but it does not by itself prevent the scheme. Prevention generally depends on structural controls such as segregation of duties, payroll reconciliations, and monitoring, and no single measure guarantees prevention.
This is purely an ethics issue about individual dishonesty.
While it involves unethical conduct, a ghost employee scheme is chiefly a compliance and internal-control failure. It typically breaches law and internal policy and points to weaknesses in controls, so remediation must address systems and processes, not only individual values.

Best practices

Enforce segregation of duties so that the ability to add or change payroll records is separated from the authority to approve payments and from the receipt of disbursements.
Perform periodic payroll reconciliations and independent reviews, comparing active employee lists against HR records, identity documentation, and confirmed work performed.
Promptly remove terminated employees from payroll systems and reconcile termination records with the active payroll to prevent lingering payments to former staff.
Monitor for red flags such as duplicate bank accounts or addresses across employees, payments to accounts controlled by payroll or HR staff, and employees with no benefit deductions or tax withholdings.
Maintain accessible reporting channels for employees to report suspected payroll irregularities, recognizing that such channels are one part of a larger compliance program rather than a complete control.
Provide role-specific awareness training to payroll, HR, and supervisory personnel on recognizing and escalating indicators, while coordinating investigations with qualified legal counsel where potential violations of law arise.