The short definition
Payroll fraud is the deliberate manipulation of a payroll system so that someone gets paid money they didn't earn. The someone is usually an insider — an employee inflating their hours, a manager approving pay for a person who doesn't exist, or the payroll administrator quietly adjusting their own rate. Increasingly it's also an outsider: a scammer who emails HR pretending to be an employee and asks to “update” their direct deposit details.
Two things separate fraud from an honest payroll mistake: intent and concealment. Errors are random, get caught, and get corrected. Fraud repeats, and someone is actively working to keep you from noticing.
The main schemes
Ghost employees.Payroll pays a person who doesn't work for you — a fabricated identity, a terminated employee who was never removed, or a real person (often a relative of whoever runs payroll) who never shows up. This one deserves its own deep dive, so we wrote one: the ghost employee guide.
Padded hours and buddy punching.The most common and the most socially tolerated: fifteen minutes shaved here, a friend punching you in before you arrive there. Individually trivial, in aggregate it's typically the most expensive line item on this list. Details and fixes in the time theft guide.
Pay-rate manipulation.Whoever has edit access to the payroll system bumps a rate — their own or an accomplice's — right before a pay run, and sometimes sets it back right after. On a register with fifty names, a rate that's briefly wrong is easy to miss and hard to reconstruct later.
Direct deposit diversion.The modern one. An email arrives at HR that looks like it's from a real employee: new bank, please update my details before Friday. The paycheck lands in a mule account and the actual employee finds out on payday. This is technically business email compromise rather than an inside job, but the money leaves through payroll all the same. There's a whole category of tools aimed at exactly this.
Commission and bonus gaming.Inflated sales figures, deals split or timed to hit accelerators, quotas gamed at quarter-end. Harder to spot in payroll data because the payment itself is legitimate — it's the underlying number that's cooked.
Adjacent, but worth knowing:expense reimbursement fraud runs through accounts payable rather than payroll, but it's the same instinct and often the same person. We cover those tools separately. Worker misclassification — treating employees as contractors to dodge taxes — also gets called “payroll fraud,” but that's employer-side fraud against the government, a different animal from everything above.
How common is it, really?
The best data comes from the Association of Certified Fraud Examiners, which studies a couple thousand occupational fraud cases every two years. In the 2026 Report to the Nations, payroll schemes showed up in about 10% of cases, with a median loss of $63,000 — and a median of 13 months before anyone caught on.
Case file · ACFE 2026 Report to the Nations
13 months
median lifespan of a payroll fraud scheme before detection. Median loss: $63,000.
The small-business angle is the uncomfortable part: payroll fraud turned up in 13% of cases at organizations under 100 employees, versus 8% at larger ones. That's not because small-business employees are less honest. It's because at a small company, one trusted person often controls hiring, payroll, and the bank account — which removes every natural checkpoint at once. Construction had it worst of any industry in the study, with payroll schemes in 23% of its fraud cases.
Who commits it
The profile that shows up over and over: a trusted, long-tenured person with payroll access and no one looking over their shoulder. That's precisely why the median scheme survives over a year — the person best positioned to catch it is the person doing it. Managers who approve their own team's time are the other recurring character, especially in hourly workforces.
The lesson isn't to trust nobody. It's that trust isn't a control. Good people handle bad months, and a payroll system with no second set of eyes is an open cash drawer.
Fraud or error? A quick test
- Errors are random. They scatter across employees and pay periods. Fraud clusters — same person, same account, same pattern.
- Errors surface on their own. An overpaid employee usually says something eventually; an underpaid one says something immediately. Fraud only surfaces when someone goes looking.
- Errors don't fight back.If the numbers get weird whenever a specific person is asked about them, that's not an error.
Is it a crime?
Yes — depending on the scheme and the amount, it gets prosecuted as theft, embezzlement, or wire fraud, and employees have gone to prison for it. In practice, though, a lot of cases end quietly: repayment, a resignation, and a reference-check time bomb for the next employer. Whether to involve law enforcement is a genuine decision with legal consequences either way, which is why the right first call after finding something is your attorney, not the suspect.
Where to go from here
If you suspect something now, start with how to detect payroll fraud — it covers the red flags and the five controls that close most of these holes. If you're shopping for software, the best payroll fraud detection software guide is the overview, and the category pages break the market down by the specific risk you're trying to cover.