How to Report Payroll Fraud: Who to Call, in What Order

If you're an employee reporting your employer

Match the reporting channel to what's actually happening — they're handled by different agencies:

• Paid under the table, taxes withheld but never sent in, or misclassified as a contractor:that's the IRS's department. File Form 3949-A — there's now an online version, and you can file anonymously. Anonymous tips are acted on less often than documented ones, so specifics help: dates, amounts, how you know.
• Missing wages or unpaid overtime:that's wage theft, not tax fraud — file with the U.S. Department of Labor's Wage and Hour Division or your state labor department. State deadlines for wage claims can be short; don't sit on it.
• If the numbers are largeand you have solid documentation, the IRS also runs a separate whistleblower award program (Form 211) that can pay a share of what's recovered. Different process, longer game, worth a conversation with a whistleblower attorney rather than a solo filing.

Two practical notes. Keep copies of everything — pay stubs, schedules, texts about hours — somewhere that isn't a work device. And know that retaliation for good-faith wage and tax complaints is itself illegal; document any sudden schedule cuts or write-ups that follow your report.

If you're an owner who just found fraud

The order of operations matters more than any single step, and the most common instinct — confront the person immediately — is the one that does the most damage. In order:

1. Preserve first, quietly.Export the payroll register, bank statements, time records, and system audit logs before anyone knows you're looking. Evidence that lives in a system the suspect administers has a way of tidying itself up.
2. If money just moved, call the bank now. This is the step where hours count. For redirected deposits and fraudulent transfers, the practical recovery window is roughly 24–72 hours before funds hop beyond reach.
3. File at ic3.gov the same dayif email compromise was involved — a scammer posing as an employee rerouting a direct deposit, a fake vendor, a spoofed executive. The FBI's Recovery Asset Team works with banks to freeze funds through its kill-chain process (formally for domestic wires of $50,000+), and it reports recovering funds in roughly two-thirds of cases that arrive within the 72-hour window.
4. File a police report even if you doubt anything comes of it — your insurer will require one, and a prosecutor someday might.
5. Notify your insurer promptly.Employee dishonesty and crime policies carry notice deadlines, and late notice is a classic reason claims die. (What those policies do and don't cover is its own subject.)
6. Call an employment lawyer before confronting or firing. Termination, repayment arrangements, and what you say in the exit conversation all have legal consequences. Lawyers also generally warn against trading a no-prosecution promise for repayment — it can complicate both the insurance claim and any later criminal case.

One ugly wrinkle worth knowing early: if the fraud involved payroll taxes withheld from employees but never remitted, the IRS still expects that money from the business — being a victim doesn't erase trust-fund tax liability. Get your CPA into the room the same week as the lawyer.

Deciding whether to prosecute

The honest case for referring it: quiet settlements are why the same person can do this at three companies in a row — the next employer calls references and hears “left to pursue other opportunities.” The honest case against: prosecution is slow, recovery through restitution is unreliable, and small-dollar cases don't always get a prosecutor's attention. What shouldn't drive the decision is embarrassment — payroll fraud happens at one company in ten, and the pattern that enabled it (one person holding too many keys) is the most ordinary story in the fraud statistics.

Afterward

Every reporting path above is about a fraud that already ran its course — the median scheme gets 13 months before this page becomes relevant. Once the immediate fire is out, the follow-up that actually changes the odds next time is structural: run the payroll audit checklist to find anything else, split the duties so no one person can repeat it, and consider detection software if payroll has outgrown eyeball review. For the email-compromise variant specifically, the fixes live in email & BEC security.