The three species of ghost
The invented person.A name, a Social Security number (usually borrowed or fabricated), a bank account, and a salary. Nobody by that name has ever walked through your door. This takes the most nerve and the most access, so it's usually the work of whoever administers payroll.
The employee who never left.Someone quits or gets terminated, but the termination never reaches payroll. The deposits keep flowing — into a bank account that whoever “forgot” to process the paperwork has quietly redirected. This is the easiest ghost to create because the employee record is completely legitimate; only the end date is missing.
The no-show.A real, verifiable human — often a relative or friend of a manager — who's on the schedule and the payroll but never actually works. Hardest to catch with paperwork because the paperwork is genuine. Someone has to notice the person is never physically there.
How ghosts get on the books
One condition shows up in nearly every case: a single person controls more than one link in the chain — adding employees, running payroll, and processing terminations. At big companies those are three departments. At a 30-person company they're often one office manager, which is exactly why the ACFE's 2026 study found payroll schemes in 13% of small-business fraud cases versus 8% at larger organizations.
The other risk multipliers: high-turnover hourly workforces (lots of onboarding and offboarding noise to hide in), multiple locations with local hiring authority, and businesses recently acquired or merged, where nobody's sure which roster is the real one.
Red flags worth acting on
- Two employees sharing a bank account — the classic. Payroll systems rarely block it, and there is almost never an innocent explanation.
- Multiple employees at the same street address or phone number.
- Someone who's payroll-active but otherwise invisible: no PTO requests, no benefits elections, no expense reports, no login activity, ever.
- Withholding set up to maximize take-home pay — no health plan, no 401(k), minimal deductions. Ghosts don't need dental.
- Thin personnel files: missing I-9, unsigned W-4, a photocopied ID that's seen better days.
- Terminated employees who show up on the register after their end date.
- Returned W-2s or benefits mail marked undeliverable.
- A manager who can't describe what one of their own direct reports actually does.
One flag alone is usually an administrative mess, not a crime — payroll data is full of innocent weirdness. Two or more flags on the same name is a different story.
The audit you can run this week
You don't need forensic software for a first pass. You need the payroll register, the HR roster, and a spreadsheet. One tip before you start: don't announce a fraud hunt. Call it payroll data hygiene, because if there is a ghost, the person who created it is probably on the distribution list.
- Diff the payroll register against the HR roster. Every person being paid should exist in HR records with a start date and a manager. Anyone on the register but not the roster gets explained in writing, not verbally.
- Dedupe bank accounts, addresses, and phone numbers across all employees. A spreadsheet pivot does this in ten minutes. Investigate every collision.
- Reconcile headcount with the people who see faces. Send each manager their list of direct reports and ask them to confirm every name is a real, currently working person. Watch for hesitation.
- Pull the paper for anyone flagged. I-9, W-4, offer letter, benefits enrollment. Invented ghosts have paperwork gaps; never-left ghosts have paperwork that stops abruptly.
- Check the last 24 months of terminations against final pay dates. Anyone paid after their termination date is either a payroll error or your answer.
- If doubt survives all that,the old-school move still works: distribute one pay period's checks (or pay stubs) in person, ID in hand. Ghosts don't show up to collect.
Prevention that actually sticks
Split the duties.The person who adds employees shouldn't run payroll, and whoever reconciles the bank statement should be a third person. Too small for three people? Then the owner reviews the payroll register every run — it takes fifteen minutes and removes the privacy every ghost scheme depends on.
Verify identity at onboarding. The invented-person ghost dies at the front door if new hires have to pass a real identity check. Identity verification tools like Persona do document-plus-selfie checks in minutes, and a standard background check confirms the person has an actual history.
Make terminations a checklist, not a memory.Every separation triggers: payroll end date, system access revoked, final check issued, manager confirms. The never-left ghost exists because offboarding lived in someone's head.
At scale, let software watch the register. Past a few hundred employees, manual dedupes stop being realistic. Anomaly detection tools flag shared accounts, post-termination payments, and rate oddities continuously instead of whenever someone remembers to look. Our rundown: the best ghost employee detection software.
If you find one
Don't confront anyone, and don't fix the record yet — export it. Preserve the register, the bank details, and the change logs, then call your accountant and an attorney before the person who built the ghost learns you've seen it. The wider playbook is in how to detect payroll fraud, including when it's worth bringing in a certified fraud examiner.