# Ghost Employee Fraud in Payroll Bank Debits

- Author: PreciseBankFlow (https://precisebankflow.com)
- Published: 2026-10-17
- Category: Embezzlement and fraud schemes
- Canonical: https://precisebankflow.com/blog/ghost-employee-fraud

> How ghost employee fraud shows in payroll: shared bank accounts, no tax withholding changes, no time off and pay continuing after termination.
Ghost employee fraud is paying wages to a person who does not work for the business, either an invented worker or a former one left on the payroll. The money usually lands in an account the fraudster controls. It shows up as two payees sharing one deposit account, records that never change, and pay that continues after someone has left.

## What makes a ghost employee on the payroll?

A ghost employee is any payroll record that draws pay without a person doing the work behind it. There are two common kinds. One is a fictitious worker, created from scratch with a made-up or borrowed identity. The other is a real person who has left, or never started, whose record stays active and keeps being paid.

The two kinds need different access. Creating a fictitious worker means someone can add a record to the payroll system and also supply the bank details for it. Keeping a departed worker on pay only needs someone to skip a termination step and then change the deposit account, or simply collect the paper check. In small businesses the same office manager often does all of this, which is why the scheme survives for years.

A ghost record also needs a way to look ordinary. Fraudsters tend to copy the pay rate and job title of a real role, assign the ghost to a large department where nobody counts heads, and keep the amount modest. A ghost paid like a junior warehouse worker draws far less attention than one paid like a manager.

Ghost pay is one of several schemes that take money after it has been recorded in the books. Others happen earlier: [skimming takes cash before it is ever recorded](/blog/skimming-fraud), so it leaves no entry at all, while a ghost employee leaves a full trail of payroll entries that look legitimate. Paper paychecks add a second route, because a check can be issued to a real employee and then altered or endorsed by someone else, a problem covered in the post on [how check tampering changes payees and amounts](/blog/check-tampering).

## Shared bank accounts behind ghost employee pay

A shared deposit account is the strongest single sign of a ghost employee. Each real worker normally has their own bank account. When two payroll records send net pay to the same routing and account number, one of them may be a ghost, and the other record often belongs to the person collecting the money.

Sorting the direct deposit file by account number takes minutes and finds most of these. Export every active record with its deposit details, sort by routing number and then account number, and look for any account that appears more than once. A household with two employees can share an account for innocent reasons, so each match is a question, not a finding.

### Other shared details worth matching

The deposit account is not the only field a fraudster reuses. People running a ghost have to give it an address, a phone number and an identity number, and inventing all of them convincingly is hard. Match these fields across the employee master file:

- **Home address**, including the same street with a different unit number.
- **Phone number and personal email**, which payroll portals often require.
- **Tax identification number**, which should never repeat.
- **Emergency contact**, which a ghost sometimes shares with its creator.

Then match the same fields against people in payroll, HR and finance. A ghost's address that matches the payroll clerk's home is far more serious than two warehouse workers who live in the same apartment block.

### When the money goes by paper check

When a ghost is paid by check instead of direct deposit, the shared-account test moves to the back of the check. Pull the images of paid payroll checks and read the endorsements and deposit stamps. A run of payroll checks for different payees all deposited into one account, or all cashed at the same branch by the same person, is the paper version of a shared deposit account.

## Ghost employee records with no withholding, leave or changes

A ghost employee record tends to stay frozen because nobody real is living behind it. Genuine workers change their tax withholding, book holidays, take sick days, update addresses and enroll in benefits. A record that shows none of these over a year or more is not proof of fraud, but it deserves a closer look.

The idea is simple: a real employee creates small administrative noise, and a ghost creates none. Test for that silence across a full year:

- **Withholding elections** that were set once at hire and never touched.
- **No paid time off taken**, and no sick leave, for a full year.
- **No benefits enrollment**, such as health cover or a retirement plan, when most of the department has one.
- **No expense claims, training records or system logins** linked to the person.
- **No manager sign-off on timesheets**, or sign-off by the same person every pay period regardless of department.

Each of these has an innocent explanation on its own. A worker might decline benefits, or simply never take holiday. Combine them, and a record that misses four or five ordinary signs of life is much harder to explain away.

### An example test table

The table below is an example of a reviewer's test sheet for six payroll records. The names, numbers and outcomes are illustrative.

| Record | Deposit account | Withholding changed | Leave taken | Leaving date | Result |
| --- | --- | --- | --- | --- | --- |
| E-1042 | Own account | Yes, March | 9 days | None | Clear |
| E-1077 | Shared with E-1121 | No | 0 days | None | Investigate |
| E-1121 | Shared with E-1077 | Yes, January | 12 days | None | Investigate as the likely collector |
| E-1135 | Own account | No | 0 days | None | Ask the manager to confirm the person |
| E-1150 | Own account | No | 0 days | 2026-02-28 | Investigate: paid after leaving |
| E-1163 | Own account | Yes, June | 4 days | None | Clear |

Read the table by row, then by pattern. E-1077 fails every test and shares an account with E-1121, which points to E-1121 as the person to understand. E-1135 fails the quiet-record tests but has its own account, so the next step is a manager confirming they know the person, not an accusation.

## Terminated workers still paid as ghost employees

A terminated worker becomes a ghost employee when their leaving date is recorded in HR but their payroll record stays active. Finding this means comparing two lists that rarely sit in the same system: the HR leavers list with exit dates, and the payroll register showing who was paid in each run after those dates.

The test is a date comparison. For each leaver, find the last payroll run that included them and compare it with their leaving date. One final run after leaving is normal, since it pays out the last period and any owed holiday. Pay in the second or third run after leaving needs an explanation.

Watch for a particular sequence. The leaver's deposit account changes shortly after their exit date, then the pay continues. That pattern suggests someone inside the business redirected the money, because the departed worker had no reason to update their bank details after leaving. A change to deposit details on any inactive or soon-to-leave record should go to a second person for approval.

Seasonal and temporary staff are an easy place to hide this. Records for summer workers are often left open for next year, and a record that is open can be paid. Closing those records at the end of each season, or at least setting them to inactive, removes the opportunity.

## Tracing ghost employee pay from payroll register to bank debit

Tracing ghost employee pay means proving that the payroll register and the bank statement tell the same story. The register lists who should be paid and how much. The bank shows what actually left the account. When the two totals agree for each run, the next question is whether the register itself contains a ghost.

Payroll usually leaves the bank in a few large debits: one for net pay to the payroll provider or the direct deposit batch, one or more for tax deposits, and separate debits for any paper checks. Each run on the register should tie to these debits on the statement.

### Step list for tying a payroll run to the bank

1. **Take the payroll register for one run** and note the total net pay, total tax withheld and number of people paid.
2. **Find the net pay debit on the bank statement** for that run date and confirm it equals the register's net total, less any paper checks.
3. **List the paper checks from that run** and confirm each one clears the bank for the amount on the register.
4. **Find the tax deposit debits** and compare them with the withheld amounts plus the employer share.
5. **Count heads**: compare the number paid with HR's headcount for the same date.
6. **Repeat for every run in the period**, including off-cycle runs, which are a favorite place to add a one-off ghost payment.
7. **Record any run that does not tie** and the size of the difference.

A payroll debit that is larger than the register total suggests that a payment went out without being recorded. A register that ties to the bank but has more people than HR expects suggests the ghost was recorded properly and simply should not exist.

Off-cycle runs deserve extra attention. A manual payroll run outside the normal schedule, approved by the same person who prepares payroll, is an easy way to send a single large payment to a ghost record and then deactivate it. When you reconcile the payroll bank account at the end of the year, the [year-end bank reconciliation checklist](/blog/year-end-bank-reconciliation) is a natural point to list every off-cycle run and confirm each one was approved.

For statements that arrive as PDFs, [PreciseBankFlow](/get-started) reads each debit line, checks that the statement foots from opening to closing balance, and flags duplicate debits and gaps in check numbers, so the payroll debits are ready to tie to the register.

## When does an odd payroll record not mean a ghost employee?

An odd payroll record often has an ordinary cause. Family members who work for the same business may share an account, long-serving staff may never change their withholding, and some people simply do not take leave. A ghost employee review should rule these out with evidence before anyone is accused.

Common innocent explanations include:

- **Couples or relatives on the same payroll** who bank together. Confirm with HR that both people are known and working.
- **Workers who were paid late** after leaving, because a final commission or bonus was settled in a later run.
- **Payroll provider changes**, which can make a record look newly created when it was only migrated.
- **Remote or field staff** with no office login and no visible manager, who are real but rarely seen.

### When not to escalate yet

Do not escalate on one weak sign. A record with no leave and no withholding change, but its own bank account, a manager who can describe the person and timesheets that match the work, is almost certainly real. Escalate when several signs line up, especially a shared account combined with a quiet record, or pay that continued after leaving with changed bank details.

When the signs do line up, keep the review quiet. Do not change the record, do not ask the payroll clerk about it and do not contact the deposit bank. Copy the payroll register, the master file history and the bank statements first, and then take advice on next steps. A record changed in a hurry can destroy the audit trail that shows who created it.