Payroll fraud may not be the stuff of horror movies, but it’s enough to keep payroll professionals awake at night—especially during this season of spooky year-end activities. As Halloween descends, two “ghostly” schemes continue to haunt payroll systems: phantom employees and phantom employers. These deceptive practices exploit weak controls and digital cracks, quietly draining funds and creating serious compliance risks.
Ghost employee schemes involve fictitious or reactivated workers inserted into payroll to divert wages, while ghost employer schemes center on businesses issuing Forms W‑2 without paying employment taxes. Both are drawing heightened federal scrutiny. In April 2024, the Treasury Inspector General for Tax Administration (TIGTA) reported that IRS Criminal Investigation identified 354 ghost employer leads between June 2018 and May 2023, signaling the need for stronger detection tactics, masterfile governance, and compliance coordination.
How Ghost Employee Schemes Work
Fraudsters typically exploit payroll or HR system access to create fictitious workers or reactivate terminated employees, routing wages to accounts they control. Some schemes manipulate legitimate profiles—padding hours, bonuses, or overtime—while keeping pay levels and patterns ordinary so entries blend into routine reports.
Common Red Flags and Likely Perpetrators
Phantom employees often lack onboarding documentation, supervisor linkages, or time-off activity. Their pay is steady and unremarkable, and benefit elections may be missing. Perpetrators are usually insiders—payroll or HR staff, bookkeepers, or managers with timekeeping authority—acting alone or in collusion.
Data Elements Frequently Abused
Investigations routinely uncover:
- Duplicate bank routing/account numbers across “different” employees
- Reused home addresses, phone numbers, or emails
- Invalid or repeated Social Security numbers
- Out-of-sequence employee IDs
- Records with unusually low or no tax withholding and missing benefits elections
Where Payroll Analytics Makes the Difference
Modern payroll analytics can turn raw data into powerful fraud detection tools. By automating anomaly detection and running continuous duplicate-value tests, payroll teams can identify suspicious patterns before losses occur. Key analytics-driven tactics include:
- Duplicate Data Scans: Flag repeated SSNs, bank accounts, addresses, and emails across employee records.
- Outlier Analysis: Detect unusual pay spikes, overtime anomalies, or profiles with no benefits and low withholding.
- Cross-System Matching: Join HRIS, timekeeping, and payroll tables to spot active payroll records without corresponding time entries or manager relationships.
- Trend Monitoring: Apply statistical models like Benford’s Law to identify irregular distributions in payroll amounts.
These analytics can be embedded into dashboards for real-time alerts, helping payroll leaders move from reactive investigations to proactive prevention.
When Physical Verification Still Matters
Direct deposit is standard, but targeted in-person distribution can expose phantom employees after analytics flag anomalies. Requiring employees to present ID for a paper check—managed outside payroll—often surfaces undeliverable or unclaimed items tied to non-existent workers. Use this selectively (e.g., before year-end or post-reorg) and reconcile all leftovers.
Federal Scrutiny of Ghost Employers
Ghost employers issue Forms W‑2 but fail to file employment tax returns or make federal deposits. TIGTA’s April 2024 audit found:
- 354 leads identified by IRS CI (2018–2023)
- 33 successful prosecutions, averaging $1.3 million in restitution
- IRS researchers flagged 162,000 potential ghost employers, estimating $1.7 billion in liability
The IRS formalized its Ghost Employer Project in 2020 to systematize identification and referrals, but TIGTA urged stronger civil enforcement and better tracking.
Recent Case Highlights
- Illinois (December 2024): A scheduler fabricated multiple ghost workers and falsified timesheets, costing over $100,000.
- Massachusetts (February 2024): A retail manager falsified timecards and diverted wages using unactivated payroll cards, defrauding the employer and evading taxes.
- Massachusetts (June 2024): A Takeda employee embezzled $2.3 million by submitting fake invoices for a sham consulting firm with fabricated blog posts and a fake website.
- Massachusetts (September 2024): An employee inflated payroll and diverted vendor payments, stealing $440,000 across two employers.
- Wisconsin (September 2024): A city employee embezzled $350,000 through unauthorized asset sales, illustrating insider risk.
Controls Payroll Teams Should Consider Implementing
1. Access and Segregation: Separate hiring/terminations from payroll masterfile maintenance; require dual approval for adds/changes; rotate sensitive duties.
2. Analytics-Driven Monitoring: Deploy dashboards that run duplicate-value tests, anomaly detection, and cross-system reconciliations continuously—not just at year-end.
3. Bank and Payment Controls: Require secondary review for bank-account changes; use positive pay and alerts; conduct targeted physical distributions when anomalies surface.
4. Filing Reconciliations: Match W‑2s to Forms 941 and federal deposits; investigate mismatches promptly; document escalation criteria for internal audit or authorities.
Why This Is Front-of-Mind for Payroll Leaders
At PayrollOrg’s Payroll Leaders Conference (Las Vegas, Sept. 2025), sessions spotlighted analytics as a cornerstone of fraud detection. Candace White, CPP, emphasized the importance of identifying ghost employees and using payroll analytics as a tool to help combat this type of scam—reinforcing TIGTA’s call for stronger compliance tracking.
Bottom Line
Ghost employee and ghost employer fraud exploit weak access controls and siloed data. By tightening governance, embedding analytics into daily processes, using physical verification when risk signals appear, and rigorously reconciling filings to deposits, payroll teams can materially reduce exposure—and stay ahead as federal enforcement ramps up.
Take your tax and accounting research to the next level with Checkpoint Edge and CoCounsel. Get instant access to AI-assisted research, expert-approved answers, and cutting-edge tools like Advisory Maps and State Charts. Try it today and transform the way you work! Subscribe now and discover a smarter way to find answers.
