Ghost Employees: Red Flags and How to Find Them on Your Payroll

The three species of ghost

The invented person.A name, a Social Security number (usually borrowed or fabricated), a bank account, and a salary. Nobody by that name has ever walked through your door. This takes the most nerve and the most access, so it's usually the work of whoever administers payroll.

The employee who never left.Someone quits or gets terminated, but the termination never reaches payroll. The deposits keep flowing — into a bank account that whoever “forgot” to process the paperwork has quietly redirected. This is the easiest ghost to create because the employee record is completely legitimate; only the end date is missing.

The no-show.A real, verifiable human — often a relative or friend of a manager — who's on the schedule and the payroll but never actually works. Hardest to catch with paperwork because the paperwork is genuine. Someone has to notice the person is never physically there.

How ghosts get on the books

A payroll ghost employee scheme, whichever of the three species is involved, needs the same one thing to survive. One condition shows up in nearly every case: a single person controls more than one link in the chain — adding employees, running payroll, and processing terminations. At big companies those are three departments. At a 30-person company they're often one office manager, which is exactly why the ACFE's 2026 study found payroll schemes in 13% of small-business fraud cases versus 8% at larger organizations.

The other risk multipliers: high-turnover hourly workforces (lots of onboarding and offboarding noise to hide in), multiple locations with local hiring authority, and businesses recently acquired or merged, where nobody's sure which roster is the real one.

Red flags worth acting on

How to detect ghost employees before they cost you a full year: watch for these on the payroll register, not just at hiring.

• Two employees sharing a bank account — the classic. Payroll systems rarely block it, and there is almost never an innocent explanation.
• Multiple employees at the same street address or phone number.
• Someone who's payroll-active but otherwise invisible: no PTO requests, no benefits elections, no expense reports, no login activity, ever.
• Withholding set up to maximize take-home pay — no health plan, no 401(k), minimal deductions. Ghosts don't need dental.
• Thin personnel files: missing I-9, unsigned W-4, a photocopied ID that's seen better days.
• Terminated employees who show up on the register after their end date.
• Returned W-2s or benefits mail marked undeliverable.
• A manager who can't describe what one of their own direct reports actually does.

One flag alone is usually an administrative mess, not a crime — payroll data is full of innocent weirdness. Two or more flags on the same name is a different story.

The DIY payroll fraud audit

You don't need forensic software for a first pass, and you don't need to hire anyone to learn how to audit payroll yourself — this is how to detect payroll fraud without software, using tools you already have. You need the payroll register, the HR roster, and a spreadsheet. One tip before you start: don't announce a fraud hunt. Call it payroll data hygiene, because if there is a ghost, the person who created it is probably on the distribution list.

1. Diff the payroll register against the HR roster. Every person being paid should exist in HR records with a start date and a manager. Anyone on the register but not the roster gets explained in writing, not verbally.
2. Dedupe bank accounts, addresses, and phone numbers across all employees. A spreadsheet pivot does this in ten minutes. Investigate every collision.
3. Reconcile headcount with the people who see faces. Send each manager their list of direct reports and ask them to confirm every name is a real, currently working person. Watch for hesitation.
4. Pull the paper for anyone flagged.I-9, W-4, offer letter, benefits enrollment. Invented ghosts have paperwork gaps; never-left ghosts have paperwork that stops abruptly. A missing or never-completed I-9 is the loudest of these, and it's doubly worth checking if you hire remotely — the remote I-9 process is narrower than most employers assume, so the gap is often real rather than misfiled.
5. Check the last 24 months of terminations against final pay dates. Anyone paid after their termination date is either a payroll error or your answer.
6. If doubt survives all that,the old-school move still works: distribute one pay period's checks (or pay stubs) in person, ID in hand. Ghosts don't show up to collect.

Prevention that actually sticks

Split the duties.The person who adds employees shouldn't run payroll, and whoever reconciles the bank statement should be a third person. Too small for three people? Then the owner reviews the payroll register every run — it takes fifteen minutes and removes the privacy every ghost scheme depends on.

Verify identity at onboarding. The invented-person ghost dies at the front door if new hires have to pass a real identity check. Identity verification tools like Persona do document-plus-selfie checks in minutes, and a standard background check confirms the person has an actual history. If you're onboarding contractors or vendors at real volume and already juggling more than one verification vendor, a business verification API like Alloy orchestrates them into one workflow instead of you hand-stitching several — overkill for occasional hiring, but the right layer once vendor sprawl becomes the actual problem.

Make terminations a checklist, not a memory.Every separation triggers: payroll end date, system access revoked, final check issued, manager confirms. The never-left ghost exists because offboarding lived in someone's head.

At scale, let software watch the register. Past a few hundred employees, manual dedupes stop being realistic. Anomaly detection tools flag shared accounts, post-termination payments, and rate oddities continuously instead of whenever someone remembers to look. Our rundown: the best ghost employee detection software.

What to do if an employee committed payroll fraud

Don't confront anyone, and don't fix the record yet — export it. Preserve the register, the bank details, and the change logs, then call your accountant and an attorney before the person who built the ghost learns you've seen it. The fuller version of that process is in how to detect payroll fraud, including when it's worth bringing in a certified fraud examiner.