Payroll is supposed to be predictable. You know roughly what the monthly run should look like, who has joined, who has left, and where pressure points sit. So when wage costs keep creeping upward, headcount reports don't match what managers say on the ground, or the same departments always seem to need manual adjustments, it creates a very specific kind of anxiety. It's the feeling that money is leaving the business and no one can properly explain why.
For many UK business owners, the first instinct is to dismiss it. You tell yourself it's overtime, seasonal churn, payroll timing, or a software quirk. You might also worry that calling in outside help will be expensive, disruptive, or embarrassing if the issue turns out to be nothing. Those objections are understandable. They're also exactly why ghost employee fraud can continue for far too long.
The good news is that this problem leaves traces. More importantly, it can be investigated quietly, contained quickly, and prevented properly if you approach it with discipline rather than panic.
That Sinking Feeling When Payroll Numbers Don't Add Up
You see it in practice when a finance director reviews payroll against operational output and something feels wrong. Labour costs rise, yet the business isn't obviously busier. Managers insist they're short-staffed. HR records look untidy after a run of new starters and leavers. Nobody can point to one dramatic error, but the numbers won't sit still.
That's the danger zone for ghost employee fraud. It thrives in noise, handovers, and rushed admin. In sectors where people join and leave frequently, weak process discipline gives a dishonest insider room to hide false records or keep former staff active on payroll.
UK-specific data shows that 62% of UK SMEs lack formal payroll audit protocols, making them more vulnerable to weak controls and seasonal hiring gaps, and 1 in 5 payroll frauds occurs in high-turnover sectors like retail and logistics according to Papaya Global's overview of ghost employee fraud detection and strategies. If you run a warehouse operation, retailer, care provider, hospitality group, or any business with rolling recruitment, that should get your attention.
Why the problem hides in plain sight
Many SMEs still process payroll through repeatable routines that feel efficient because they're familiar. Files move on set dates. Variances get checked at a high level. Exceptions are pushed through quickly so no one misses pay day. If your team relies on scheduled payroll runs, it helps to understand what is a batch process, because fraud often slips into exactly those repetitive workflows where people assume the prior checks were done somewhere else.
A ghost employee doesn't need a dramatic system breach. One fabricated profile, or one leaver left active, can be enough.
Practical rule: If payroll cost growth and actual staffing reality no longer match, treat that as a control issue first and an admin issue second.
Common objections that keep owners stuck
Business owners usually hesitate for three reasons:
- “It's probably just poor admin.” Sometimes it is. But poor admin is also what hides fraud.
- “I don't want to accuse anyone unfairly.” You don't need to accuse anyone. You need to verify records.
- “An investigation will unsettle the team.” A discreet review can be tightly contained and far less disruptive than months of continuing losses.
The worst move is doing nothing while hoping the next pay run somehow looks cleaner.
Unmasking the Invisible Thief in Your Company
A ghost employee is either a person who doesn't exist at all, or a real person who no longer works for you but still receives pay. The effect is similar to a phantom subscription continually draining your business account. The payment looks routine, it sits among legitimate charges, and unless someone reconciles the detail properly, it keeps running.
In payroll fraud, the “subscription” is a false salary, wage, overtime payment, or benefits trail. The money usually goes to the fraudster or an accomplice. Most often, the person behind it sits inside the business with enough access to create, amend, or protect payroll data.
The two versions I see most often
The first is the fabricated employee. Someone creates a false record with enough supporting data to survive routine checks. That record may be linked to a bank account controlled by the perpetrator.
The second is the dormant leaver. A genuine employee resigns, is dismissed, or finishes temporary work, but someone keeps them on payroll. Because the name once belonged there, this version can be harder to spot at a glance.
If you want a broader HR lens on insider theft risk, HR risk of employee theft is a useful companion read because payroll fraud rarely appears in isolation from wider control weaknesses.
How the scheme actually operates
Ghost employee fraud doesn't survive on cleverness alone. It survives because one person can often do too much. They may influence onboarding, payroll amendments, timesheets, and payment approval. Even where software such as SAP or another ERP system is in place, poor segregation of duties defeats the benefit of the platform.
Typical mechanics include:
- Creating or retaining a payroll record with incomplete HR scrutiny
- Routing wages to a controlled or duplicate bank account
- Avoiding review by exploiting rushed payroll deadlines
- Using system access to amend records after checks or before payment release
Fraud in payroll usually looks ordinary until someone compares systems that were never meant to disagree.
Why owners underestimate the scale
A single ghost employee can become a long-running drain. A forensic audit of a UK retail firm found that ghost employees generated fraudulent payments on every pay cycle, and one ghost earning £38,000 annually could cost the organisation over £1,500,000 over a decade if undetected, as described in this worked discussion of ghost payroll fraud.
That's why this issue isn't a minor payroll clean-up. It's internal theft wearing an administrative disguise.
Recognising the Red Flags of Ghost Employee Fraud
Most owners don't spot ghost employee fraud because of one dramatic clue. They spot it because several small inconsistencies start pointing in the same direction. One odd bank detail means little on its own. The same oddity appearing alongside weak HR files and operational confusion means far more.
This checklist helps you assess risk without jumping to conclusions.
Payroll record warning signs
Start with the payroll file itself. Ghosts often leave awkward traces because fraudulent records are built to get paid, not to withstand scrutiny.
- Duplicate bank details. If two employee records share the same account information, that needs immediate explanation.
- Sudden amendment patterns. Repeated changes to address, bank, or pay data just before payroll cut-off can signal manipulation.
- Unusual overtime or pay behaviour. A record that always seems to attract adjustments deserves closer review.
- Manual overrides. The more often a person appears in exception handling, the more carefully you should inspect them.
HR file and people record concerns
A genuine employee leaves a trail. They were recruited, onboarded, managed, and known.
By contrast, ghost records often sit in shallow files. You may find incomplete personal information, missing documentation, no meaningful manager interaction, or no evidence of ordinary employment administration such as leave records, appraisals, or line management notes.
A useful broader checklist sits in this guide on the hidden signs of corporate fraud and when to call a fraud investigation service. Payroll issues often emerge alongside wider anomalies.
If no one in operations can confidently say who the employee is, where they work, and who supervises them, payroll should stop treating the record as routine.
Later in your review, it can help to watch how investigators discuss behavioural and record-based indicators in practice:
Operational clues managers often miss
Managers don't usually think in fraud terms. They think in staffing, shift cover, and output. That's why their observations matter.
Look for patterns such as:
| Area | What you might hear | Why it matters |
|---|---|---|
| Staffing | “We’re always short, despite payroll saying the role is covered” | The person may exist only in records |
| Supervision | “I’ve never actually met them” | Ghosts avoid normal reporting lines |
| Leave | “That employee never seems to take holiday” | Fraudsters often avoid handover scrutiny |
| Admin | “The file is still being updated” | Perpetual incompleteness can hide fiction |
One red flag is not the conclusion
Don't accuse. Verify.
A duplicate bank account can have an innocent explanation. A missing address field can be bad admin. But when data issues, weak oversight, and unexplained labour cost pressure all appear together, the probability of a deliberate scheme rises sharply.
How to Launch a Discreet Forensic Investigation
Once suspicion exists, the first priority is control. Not confrontation. If you alert the wrong person too early, they may alter records, delete audit trails, or shape staff explanations before you've preserved evidence.
A proper response is quiet, limited, and methodical.
Step one is to preserve the evidence
Don't start with an open email asking managers whether anyone has concerns about payroll. Don't ask payroll staff to “have a quick look” if one of them may be involved. Ring-fence access instead. Secure payroll reports, HR records, user permissions, and change logs before anyone knows the review's focus.
Then define a narrow review group. Usually that means senior leadership, legal advisers where needed, and the forensic team.
Step two is to test the records against each other
The most effective early work is cross-matching systems that should agree. Payroll, HR, onboarding records, leaver records, timesheets, departmental rosters, and bank payment data should all support the same reality.
In the UK, ghost employee fraud detection often requires a missing data analytics report that searches for blank street addresses or duplicate bank account numbers. That method identified 12 phantom profiles in a single logistics company audit, according to Audimation's worked example on ghost employee fraud schemes.
That's why broad suspicion needs narrow testing. You're not looking for every anomaly in the business. You're looking for the specific records that shouldn't exist or shouldn't still be paid.
Step three is to map access and approvals
After identifying suspicious records, examine who could create them, alter them, approve them, and release payment. In practice, ghost employee fraud often depends on access overlap rather than one single falsified form.
Useful tests include:
- User access review. Who had permissions in payroll and HR systems?
- Approval chain testing. Were hires, amendments, and payments approved independently?
- Leaver process review. Did terminated staff come off payroll promptly?
- Bank detail analysis. Were changes properly authorised and evidenced?
If you need a fuller picture of the process professionals use, this explanation of forensic accounting for detecting fraud gives a clear overview of how evidence-led reviews are structured.
Evidence point: The first useful question isn't “Who did it?” It's “Which records could only exist because controls failed?”
Step four is to decide on escalation
Not every discrepancy becomes a disciplinary or legal matter. Some reviews end with control remediation. Others uncover theft, collusion, or wider manipulation.
That decision should rest on evidence, not instinct. If losses appear deliberate, document every finding carefully. If the issue is weak process rather than fraud, fix the process without creating unnecessary drama. The discipline lies in knowing the difference.
Building Your Defences to Prevent Future Payroll Fraud
The businesses that prevent ghost employee fraud best are not always the biggest or most advanced. They're usually the ones that accept a simple truth. Payroll control is not bureaucracy. It's asset protection.
That matters because prevention has to be built into the workflow, not added as an afterthought when something already looks wrong.
Start with role separation
The clearest safeguard is making sure one person can't create, maintain, and pay the payroll. ACFE guidance for UK organisations says payroll teams should enforce a minimum of two people in the top-level payroll team to stop a single individual controlling creation and payment of payroll, and that control reduced fraud incidence by 35% in surveyed mid-market firms according to Moorepay's discussion of payroll fraud prevention.
That principle sounds basic because it is basic. It also works.
A practical split often looks like this:
- HR controls onboarding and offboarding
- Payroll processes approved inputs
- Finance or senior management approves release
- Independent review checks exceptions and amendments
Tighten the points where ghosts enter
Ghosts usually enter at moments of organisational distraction. New starters arrive quickly. Temporary labour gets extended. Leavers aren't removed promptly. Managers send late approvals. Payroll staff patch the gaps to keep the cycle moving.
You close that risk by hardening those transitions.
Consider these controls:
- Strict onboarding evidence. No employee enters payroll until identity, contract, manager approval, and banking evidence are complete.
- Immediate leaver removal. Resignations, dismissals, and end-of-contract dates must feed straight into payroll cut-off controls.
- Mandatory holiday cover. Fraud often relies on one person staying close to the process at all times.
- Exception reporting. Force review of duplicate bank accounts, incomplete addresses, and unusual changes.
If your hiring process needs stronger verification, it helps to understand how investigators discover digital footprints online when checking whether a person and their background are consistent with the records submitted.
Audit little and often
Annual review is better than none, but it isn't enough on its own. Ghost employee fraud feeds on long gaps between checks. Shorter, targeted audits catch strange records earlier and make concealment harder.
A good internal discipline includes reconciliations between HR and payroll, periodic line manager confirmations, and exception testing on data fields fraudsters often neglect. This internal audit checklist for fraud prevention is a useful reference point when designing those routines.
Controls work best when they're hard to bypass and easy to prove. If a process exists only in someone's memory, it doesn't really exist.
Why Hesitation Costs More Than Expert Help
By the time most owners seriously consider outside forensic help, they've already spent weeks trying to explain away the issue internally. They don't want cost. They don't want disruption. They don't want to find out that someone trusted has been stealing from the business.
All of that is human. None of it reduces the loss.
According to a 2024 ACFE study, the median financial loss from payroll fraud is $50,000 per case, while occupational fraud costs businesses 5% of annual revenue, as noted in Fraud.net's summary of ghost employee fraud. On that basis alone, the cost of a professional investigation is often minor compared with the financial exposure of letting a scheme continue.
The wrong comparison
Owners often compare an investigation fee with doing nothing this month. That's the wrong comparison.
The comparison is this:
| Option | Short-term feeling | Likely consequence |
|---|---|---|
| Delay action | Less immediate discomfort | More time for losses, evidence erosion, and internal speculation |
| Run an amateur review | Feels cheaper | Higher risk of missed evidence or tipping off the wrong person |
| Use a structured forensic investigation | Controlled disruption | Clearer facts, stronger documentation, faster containment |
What expert help changes
A forensic accountant brings discipline to a situation that usually feels messy and personal. The work isn't just checking payroll entries. It's preserving evidence, isolating control failures, quantifying loss, and setting out findings in a way that management, insurers, lawyers, regulators, or a court can rely on if needed.
That matters even when the final answer is reassuring. If there is no fraud, you want a documented basis for that conclusion. If there is fraud, you want the evidence gathered properly from the outset.
The fear of what you might uncover often keeps owners frozen. In practice, uncertainty usually causes more damage than the answer.
The best investigations don't create theatre. They create clarity.
From Crisis to Control Our Client Outcomes
The strongest outcomes usually come from decisive, calm action. Not panic. Not blame. Just a controlled review that establishes what happened, what it cost, and how the business regains control.
One UK logistics client came in with a familiar problem. Payroll felt too high, branch managers disputed headcount, and no one trusted the reports. The review focused on data reconciliation, access rights, and leaver controls. The immediate result was clarity. Management could identify suspect records, tighten approvals, and restore confidence in payroll reporting.
A retailer faced a different version of the same pressure. Rapid staff turnover had left HR and payroll out of step. The issue wasn't just whether false records existed. It was whether the business could prove who should and should not have been paid. A forensic review rebuilt the audit trail, isolated weak control points, and gave leadership a practical remediation plan.
A third client, in a service-led business, feared that even raising concerns would destabilise the team. The answer was a discreet, evidence-led review with a very small internal circle. That approach protected the investigation, reduced gossip, and helped decision-makers act on facts rather than suspicion.
The pattern is consistent. Businesses feel overwhelmed at the start, then regain control once someone independent tests the records properly and sets out a clear way forward.
If payroll costs don't make sense, or you suspect ghost employee fraud but need a discreet, evidence-led response, speak with Lighthouse Consultants. Their London-based forensic accounting team helps UK businesses investigate fraud, quantify losses, strengthen controls, and move from suspicion to certainty through a structured process that starts with a free, confidential discovery call.
