The headline numbers
The most-quoted statistic in fraud — the one on every vendor homepage — is that organizations lose about 5% of revenue to fraud each year. It comes from the Association of Certified Fraud Examiners' Report to the Nations, and it's worth knowing what it actually is: an estimate made by the anti-fraud professionals the ACFE surveys, not a measurement. Nobody has audited the world's books. It's an expert-informed guess that has stayed stable across two decades of editions, which is exactly as much weight as it deserves.
The measured numbers are more interesting. The 2026 edition of the report — published May 2026 — analyzed 2,402 real fraud cases across 143 countries, together worth more than $3.4 billion in losses. The median case cost $104,000; the average was $1.46 million, dragged up by a small number of monsters (20% of cases topped $1 million). When you're sizing your own risk, plan around the median, not the average.
Payroll fraud, specifically
Payroll schemes — ghost employees, padded hours, falsified commissions — showed up in 227 of the 2,402 cases, right at 10%. That share has barely moved from edition to edition: about one occupational fraud case in ten runs through the payroll.
Case file · ACFE 2026 Report to the Nations
$63,000
median loss in a payroll fraud scheme, over a median 13 months before detection — bleeding roughly $4,800 a month the whole time.
Two details hide inside that median. First, the spread is wide: a quarter of payroll cases stayed under $18,000, and a quarter blew past $230,000. Second, the duration is improving — the 2024 edition had payroll schemes running a median 18 months before detection; in 2026 it's 13. Detection is getting faster across every scheme type (the all-scheme median fell to 12 months), which the ACFE credits partly to better data monitoring. The fraud that runs longest still costs the most, by a wide margin: schemes caught within six months had a median loss of $40,000, while schemes that survived five or more years ran past $1.1 million.
Small businesses take the harder hit
Organizations with fewer than 100 employees accounted for 22% of cases in the study and suffered the highest median loss of any size band: $126,000 — more than businesses with ten thousand employees. A six-figure fraud loss is an annoyance at an enterprise and an extinction event at a twelve-person company, so the same dollar figure lands very differently.
The scheme mix skews against small companies too. Set aside corruption and theft of physical assets, and every fraud type in the study was more common at organizations under 100 employees than at larger ones:
| Scheme type | <100 employees | 100+ employees |
|---|---|---|
| Billing schemes | 28% | 18% |
| Expense reimbursements | 19% | 10% |
| Check & payment tampering | 18% | 8% |
| Skimming | 17% | 6% |
| Payroll schemes | 13% | 8% |
| Cash on hand | 13% | 8% |
Share of each group's fraud cases involving that scheme type, ACFE 2026. The payroll line — 13% versus 8% — isn't about small companies hiring less honest people. It's structural: at a small company, one trusted person often controls hiring, payroll, and the bank account at once, which removes every natural checkpoint simultaneously. That's the whole mechanism behind ghost employee fraud, and it's why segregation of duties is the control auditors ask about first.
Which industries get hit
Payroll schemes aren't evenly distributed. They concentrate where workforces are hourly, dispersed, and tracked loosely — which is why construction tops this table every edition:
| Industry | Fraud cases involving payroll schemes |
|---|---|
| Construction | 23% |
| Education | 21% |
| Food service & hospitality | 19% |
| Government & public administration | 15% |
| Agriculture, forestry & fishing | 15% |
| Insurance | 14% |
| Health care | 11% |
Share of each industry's fraud cases that involved a payroll scheme, ACFE 2026. Nearly one construction fraud case in four touches payroll — field crews, per-diem pay, and paper timesheets are a durable combination.
How payroll fraud actually gets caught
Not, primarily, by software or by audits. 43% of frauds were detected by a tip, and more than half of those tips came from employees — the least glamorous and most consistent finding in fraud research. People near the payroll notice that a “coworker” never physically shows up long before the numbers confess to an auditor.
Prevention work measurably pays for itself. Organizations that trained both staff and managers to spot fraud had a median loss of $84,000 per case; organizations with no fraud training lost a median $150,000. Nearly half the difference in outcomes, from training that costs almost nothing.
Who commits it
Regular employees and managers each accounted for 41% of perpetrators, owners and executives for 16% — but rank multiplies damage. The median employee scheme cost $50,000 over 8 months. The median manager scheme: $125,000 over 14 months. Owners and executives: $475,000 over 23 months, stealing at $20,700 a month — more than three times the pace of staff-level fraud, with far more power to conceal it.
In 84% of cases, the perpetrator showed at least one behavioral red flag before being caught. Afterward: 68% were fired, and 54% of cases were referred to law enforcement — meaning nearly half of payroll fraud never sees a courtroom, usually settled quietly to avoid embarrassment or recovery costs. If you're on the other side of that decision, here's how reporting payroll fraud actually works.
Payroll diversion and BEC: the outside threat
Everything above is inside fraud. The outside version — a scammer emails HR pretending to be an employee and reroutes their direct deposit — is tracked by the FBI as a form of business email compromise. The FBI's 2025 Internet Crime Report counted $3.05 billion in BEC losses across 24,768 complaints — roughly $123,000 per reported incident — and 86% of those losses moved by wire or ACH, which is why they're so rarely recovered. Payroll diversion is one of the named variants. And since IC3 only counts incidents someone bothered to report to the FBI, the real total is higher by construction.
Time theft and buddy punching
The honest caveat first: most time-theft statistics trace back to industry groups and vendors with time clocks to sell, so treat them as directional. The figures cited most are Nucleus Research's estimate that buddy punching costs about 2.2% of gross payroll, and an American Payroll Association estimate that roughly three-quarters of U.S. businesses experience time theft in some form. Even discounted heavily, that's real money for any hourly workforce — run your own crew through the cost calculator rather than trusting anyone's percentage; the fixes are in our time theft guide.
How to read these numbers
One structural caveat applies to everything above: fraud statistics can only count fraud that got caught. The ACFE's data comes from cases investigated by certified fraud examiners — detected, investigated, serious enough to involve a professional. The scheme that's been quietly skimming a payroll for six years and counting is in nobody's dataset. So read every figure here as a floor, not a ceiling.
The practical takeaways survive the caveat just fine: payroll fraud is common enough to plan for (one case in ten), expensive enough to matter ($63,000 at the median, much worse if it runs), hits small companies hardest, and is caught by people more often than by software. The tooling that closes the gaps is what this site catalogs — start with the best payroll fraud detection software or the wider process view in how to detect payroll fraud.
Citing these statistics
Every figure on this page traces to a primary source, listed below. If you use these numbers in your own writing, cite the primary report — and if the context here helped, a link to this page is appreciated. We update this page as new editions publish.
- ACFE, Occupational Fraud 2026: A Report to the Nations (May 2026) — case counts, median losses, durations, industry and organization-size breakdowns.
- FBI IC3, 2025 Internet Crime Report (April 2026) — BEC and payroll diversion figures.
- Nucleus Research (buddy punching cost estimate) and the American Payroll Association (time theft prevalence) — industry estimates, widely cited, best treated as directional.