Where detection actually comes from
Start with the least glamorous fact in fraud research: in the ACFE's 2026 study, 43% of occupational frauds were caught by a tip — more than internal audits and management reviews combined. Over half of those tips came from employees. People near the payroll notice weirdness long before the numbers confess to an auditor; the question is whether they have a safe way to say so.
So before buying anything or building a single spreadsheet: make sure someone who spots something off has a way to report it that isn't “confront the person who signs my timesheet.” Then add the data work below on top.
Red flags in the data
Pull the payroll register for the last few months and look for these patterns. None of them proves fraud — every one of them earns a follow-up question.
- Off-cycle and manual payments. Fraud loves the supplemental run, where one-off checks get less scrutiny.
- Rate changes that round-trip — a pay rate that jumps before a run and drops back after, or any rate change with no approval attached.
- Shared bank accounts or addresses between employees. (If this one hits, go straight to the ghost employee guide.)
- Overtime concentrated on one person — or one approver whose whole team somehow runs hot every period.
- Payments after termination dates, and terminated employees whose records were edited around their exit.
- Net pay outliers for the role. A line cook out-earning the sous chef is a story; make someone tell it.
- Withholding oddities — no benefits, no taxes, maximum take-home. Real employees have deductions.
Red flags in behavior
The ACFE's case files repeat the same character notes: the person who never takes a full week off (schemes need tending), the one who's territorial about payroll files and touchy when asked routine questions, the “only person who understands the system” — and, in a striking share of cases, someone visibly living beyond their income. One of these describes plenty of honest people. The combination, attached to payroll access, is worth your attention.
The five controls that matter
- Separate the duties. Adding employees, running payroll, and reconciling the bank account should be three people. If you only have one, the compensating control is simple and non-negotiable: the owner reviews the payroll register every single run. Fifteen minutes, and it removes the privacy every scheme depends on.
- Dual approval for bank-detail and rate changes. This single control kills deposit-diversion phishing and rate manipulation. Verify direct-deposit changes with the employee by phone or in person — never by replying to the email that requested the change. (Why: payroll diversion scams are built to survive email-only verification.)
- Mandatory vacation for whoever runs payroll. A full consecutive week, with someone else running the process. Schemes that need weekly tending surface fast when the tender is at the beach. Job rotation does the same thing if you have the headcount.
- Reconcile payroll to the bank monthly— by someone who doesn't run payroll. Total paid per the register should match total out of the account, and headcount paid should match headcount employed. Most long-running schemes would have died at month one of this.
- An anonymous tip channel people know exists.Given the 43% figure, this is the highest-yield control on the list. It can be as simple as a third-party hotline or form — what matters is that using it is safe and everyone's heard of it.
When software earns its keep
Under about twenty employees, honestly, controls plus an attentive owner beat anything you can buy. Past that, software covers the hours nobody has:
- Identity verification at onboarding stops invented employees at the door instead of hunting them later.
- Time clocks with photo or GPS verification make punch records mean something (details in the time theft guide).
- Anomaly detection reads every payroll line every run — the shared accounts, round-trip rates, and outliers above, without the spreadsheet. Worth it from a few hundred employees up, or sooner with multiple entities.
- Email security tuned for BEC catches the “please update my direct deposit” email before HR ever sees it.
The full market overview is in the best payroll fraud detection software guide.
If you find something
Resist the urge to confront. First, preserve: export the register, the change logs, the bank records — fraud evidence has a way of tidying itself up once a suspect knows you're looking. Second, call your CPA and an employment attorney; how you terminate and whether you involve police have consequences that outlast the fraud. For anything six figures or entangled (multiple people, multiple years), a certified fraud examiner is worth the fee. And check whether your business insurance includes crime or fidelity coverage — ideally before you need the answer.
New to the topic and want the full map first? Start with what is payroll fraud.