Payroll fraud is one of the most common – and most overlooked – forms of internal fraud. Unlike theft of inventory or falsified invoices, payroll fraud hides in plain sight within the routine processing of wages, salaries, and commissions.
The Association of Certified Fraud Examiners (ACFE) estimates that payroll fraud accounts for nearly 20% of all occupational fraud cases, with a median loss of over €100,000 per scheme. In Ireland, from small retail shops to multinational payroll operations, the patterns are consistent.
This article explains how payroll fraud is committed, how to detect it, and – most importantly – how to prevent it before you become a victim.
What Is Payroll Fraud?
Payroll fraud is the deliberate manipulation of an employer’s payroll system to cause unauthorised payments. It can be committed by employees, managers, payroll processors, or external parties.
There are three main categories:
- Ghost employee fraud – Paying a person who does not work for the organisation.
- Commission and bonus fraud – Inflating sales or performance metrics to trigger higher payments.
- Timesheet and attendance fraud – Claiming payment for hours not worked.
Ghost Employee Fraud – The Classic Scheme
How It Works
A ghost employee is a person on the payroll who does not actually work for the organisation. The fraudster adds the ghost, approves their timesheets, and diverts the wages to a bank account they control.
Common methods:
- Adding a fictitious person with a real bank account (often the fraudster’s own or a relative’s).
- Reactivating former employees after they have left.
- Creating duplicate records for an existing employee (e.g., John Smith and Jon Smyth).
- Keeping terminated employees on the payroll when HR is not notified.
Red Flags
- Payroll costs rising faster than headcount.
- Employees with identical or very similar names.
- Bank account numbers that do not match the normal pattern (e.g., a different bank).
- Payroll approver never questions additions or changes.
- The same person who adds employees also approves the payroll run (lack of segregation of duties).
Real Case Example (Ireland)
A retail chain with 300 employees saw payroll costs increase 15% year-on-year despite no headcount growth. A forensic investigation found that a payroll administrator had kept eight former employees active, diverting their salaries to accounts she controlled. Total loss: €189,000 over 22 months. The administrator was arrested and pleaded guilty.
(Full case study available on our Case Studies page.)
Commission and Bonus Fraud
How It Works
Employees in sales, procurement, or performance-based roles may manipulate metrics to inflate commissions or bonuses.
Common schemes:
- False sales – Recording a sale that later gets cancelled (after commission paid).
- Splitting orders – Dividing a large order into multiple smaller orders to exceed bonus thresholds.
- Fake refunds – Processing refunds to a personal account disguised as customer refunds.
- Procurement kickbacks – Selecting a vendor in return for a secret commission.
Red Flags
- Commissions paid on sales that were later reversed or refunded.
- Salesperson’s performance spikes dramatically near bonus thresholds.
- Customer complaints about unauthorised orders.
- Procurement decisions favouring one vendor without clear rationale.
- Salesperson lives beyond apparent means.
Timesheet and Attendance Fraud
How It Works
Employees claim payment for hours not actually worked. This is especially common in hourly or shift-based roles.
Variations:
- Buddy punching – One employee clocks in for another who is absent.
- Extended breaks – Claiming breaks as working time.
- Overtime inflation – Adding extra hours to timesheets before supervisor approval.
- Holiday pay fraud – Claiming holiday pay while working elsewhere.
Red Flags
- Employee consistently claims overtime that seems unnecessary.
- Productivity does not increase with reported hours.
- CCTV or access logs show employee entered building later than clock-in time.
- Employee refuses to take annual leave (fear that replacement will detect fraud).
How to Detect Payroll Fraud
Proactive Data Analytics
A forensic accountant or auditor can use simple data tests to identify anomalies:
| Test | What to look for |
|---|---|
| Duplicate employee records | Same national insurance/PPS number, same bank account, similar name |
| Bank account analysis | Multiple employees sharing the same bank account |
| Payroll vs HR records | Employees in payroll but not in HR system |
| Terminated employees still active | Pay flagged after termination date |
| Round-dollar salaries | Unusual for hourly payroll |
| Address anomalies | Multiple employees sharing same address (possible ghost scheme) |
Surprise Audits
- Unannounced distribution of pay slips (watch who comes forward).
- Physical verification of employees (all staff gather for a “team photo”).
- Review of access logs and CCTV against clock-in times.
Employee Hotlines
Anonymous reporting mechanisms (whistleblower hotlines) are highly effective. The ACFE finds that 43% of occupational fraud is detected by tip-offs – more than any other method.
How to Prevent Payroll Fraud – A Control Checklist
Segregation of Duties (Critical)
No single person should have end-to-end control over payroll. Separate these roles:
- HR – Authorises hires, terminations, and rate changes.
- Payroll processing – Enters data into system.
- Payroll approval – Reviews and signs off.
- Bank file authorisation – Releases payment file to bank.
- Bank reconciliation – Compares payroll total to bank debits.
System Controls
- Require two approvals for changes to master employee data.
- Log all changes (who, when, what) with audit trails.
- Automatically flag PPS numbers used more than once.
- Restrict access to payroll modules by role.
Process Controls
- Monthly reconciliation of payroll headcount to active HR headcount.
- Quarterly review of terminated employees still on payroll.
- Annual confirmation from each employee of their details (including bank account).
- Mandatory annual leave for payroll staff (fraudsters often never take leave).
Vendor Due Diligence (if payroll outsourced)
- Background checks on payroll bureau staff.
- Regular independent audits of the bureau.
- Direct confirmation of bank account changes with employees (e.g., text message verification).
What to Do If You Suspect Payroll Fraud
Do NOT
- Confront the suspected employee immediately.
- Allow them to access payroll systems or records.
- Discuss suspicions widely (may alert others).
DO
- Preserve evidence – Secure payroll records, system logs, and access history.
- Notify your solicitor – Legal advice is essential, especially regarding data protection and employment law.
- Engage a forensic accountant or certified fraud examiner – They will conduct a discreet review and determine if fraud exists.
- Follow your whistleblower policy – Protect anyone who reported the issue.
- Prepare for disciplinary or criminal proceedings – If fraud is confirmed, refer to An Garda Síochána as appropriate.
Legal Considerations in Ireland
Employment Law
- Summary dismissal may be possible for gross misconduct – but you must have evidence.
- Unlawful surveillance (e.g., secret CCTV in private spaces) can invalidate evidence.
- Data protection law (GDPR, Data Protection Act 2018) restricts how you collect employee data.
Criminal Law
- Payroll fraud may constitute theft (Criminal Justice (Theft and Fraud Offences) Act 2001).
- Forgery of timesheets or authorisations is a separate offence.
- An Garda Síochána have powers to seize records and make arrests.
Mandatory Reporting
- If you are a “designated person” under anti-money laundering legislation, some frauds must be reported to the Garda or Revenue.
Always take solicitor advice before taking action.