Using Analytics to Detect Fraud

The median loss in cases of occupational fraud investigated between January 2024 and September 2025 was $63,000, as reported in “Occupational Fraud 2026: A Report to the Nations,” prepared by the Association of Certified Fraud Examiners (ACFE). The study found that the median duration of payroll fraud schemes before being discovered was 13 months. On average, before payroll fraud was discovered, $4,800 was lost each month.

Also, according to the report, 13% of organizations with more than 100 employees experienced payroll fraud, while 8% of organizations with fewer than 100 employees experienced fraud. Payroll fraud occurs within industries at the following varied rates:

• Agriculture, forestry, fishing, and hunting—15%
• Banking and financial services—5%
• Construction—11%
• Education—21%
• Energy—8%
• Food service and hospitality—19%
• Government and public administration—15%
• Health care—11%
• Insurance—14%
• Manufacturing—8%
• Religious, charitable, or social services—10%
• Retail—7%
• Technology—9%
• Transportation and warehousing—4%

Fraud originates most commonly in the following eight departments, with varying frequencies:

1. Accounting—13%
2. Administrative support—16%
3. Customer service—4%
4. Executive/upper management—16%
5. Finance—7%
6. Operations—8%
7. Purchasing—1%
8. Sales—8%

Whether a domestic or international organization, payroll fraud is not only a significant expense but can also damage reputations. Fraudulent payroll activities aim to steal an organization’s funds or manipulate payroll records for personal gain.

 

Use Analytical Controls to Prevent Fraud Risk

Payroll professionals understand how vulnerable their organization may be to payroll fraud. Developing analytics and internal controls are the most effective way to proactively prevent fraudulent incidents.

While the analytics and controls are customized to each organization’s needs, the fraud detection process used by payroll professionals is generally the same across organizations. The following six steps are used to identify payroll fraud:

1. Identify potential threats. There is potential for any member of the HR, payroll, or management staff to create ghost (nonexistent) employees, alter pay rates, initiate bonuses and commissions, and change direct deposit information, thereby creating payroll fraud.
2. Determine how threats can be prevented or detected using analytics and internal controls. Using the list of potential threats, generate reports that show changes to an employee’s default payroll information by examining pay rate, bonus/commission, and direct deposit records. In addition to identifying the changes made, the report should specify which HR or payroll staff member made each change.
3. Establish a regular review schedule. Set a time each month to generate the analytic reports. Based on the data in the reports, verify that the supporting documentation exists to validate each change identified in the reports. Any change that cannot be validated must be investigated.
4. Re-evaluate for unresolved threats using reports or analytics. The data needs to be examined for potential fraud by identifying various scenarios. If there are potential fraudulent situations, they need to be addressed by going back to Step 2.
5. Repeat step 2, focusing only on unresolved threads. Do not start from scratch; use the previous plan but add extra layers of analysis to the plan.
6. Repeat steps 4 and 5 as many times as needed, until every potential fraudulent thread is addressed. 

Remember that fraud cannot be completely prevented, no matter how many analytic and control efforts are implemented. Ensuring the following guidelines are in effect helps to prevent domestic and global payroll fraud:

• Strong Internal Controls—Segregate duties, access controls, and regular audits
• Automated Systems—Use automated time and attendance, payroll software, and expense tools, and limit the number of manual entries or overrides
• Data Analytics—Analyze payroll data for unusual patterns or anomalies
• Employee Training—Educate payroll employees about fraud and its consequences
• Whistleblower Hotlines—Establish confidential reporting channels
• Regular Reviews—Review policies, procedures, and controls for weaknesses
• Due Diligence—Thoroughly vet third-party providers

 

How to Detect Payroll Fraud With Analytics

Data analytics can help detect anomalies, patterns, and fraud risk indicators within a data set. Analytics can be used to develop a theory or hypothesis about potential fraud.

One of the major benefits of analytics, as opposed to data sampling, is that an entire data set can be tested to confirm or deny a fraud theory or hypothesis. Then, once anomalies are identified, the data can be sampled or reviewed individually to further investigate potentially fraudulent activity.

However, detecting payroll fraud requires more than identifying anomalies. Professional judgment, along with the experience and intuition of a payroll professional, must be applied to the resulting analysis to determine whether fraudulent transactions exist within a dataset.

Typically, an analyst may test a hypothesis by reviewing a list of anomalies, auditing the transactions that stand out, and adjusting the test as required. Many anomalies will have reasonable explanations and cannot be automatically assumed to be fraud.

The following are common payroll fraud schemes:

• Falsifying time entries
• Falsification of wages
• Ghost employees

Let’s look at each of these fraud types and see how you can apply a few analytical tools to confirm or deny if fraudulent activity occurred.

 

Falsifying Time Entries

Falsifying timesheets or time clock entries is one of the easiest and most common types of payroll fraud. If employees punch in and out at the beginning and end of their shifts, they may buddy up with a co-worker who will punch in and out for them when they are not actually there.

That may mean punching in 30 minutes early because they are running late and do not want to “lose” any of their scheduled wages, or it may mean they are clocked in for an entire shift they did not work. Payroll employees can also inflate other employees’ hours on timesheets and transfer the excess pay to their own bank account.

This goes undetected when the employee whose time was inflated receives their expected net pay. To prevent and detect timesheet or time-and-attendance system fraud, strong internal controls must be in place. The following are examples of internal controls that may help identify timesheet fraud:

• Using a lock/approval timesheet system so that employees may not alter timesheet information after submission
• Ensuring proper manager’s approval before timesheets are sent to payroll
• Enforcing a time entry schedule for employees and managers to ensure timeliness
• Conducting audits using analytics periodically, comparing time of entry to work schedules
• Requiring a manager’s approval for any changes to employee pay rates or employee types

Aside from catching employees committing fraud, there are only a couple of ways to detect this type of fraud. The most effective—and most expensive—method to avoid time clock fraud is using biometric time clocks.

Alternatively, supervisors and payroll staff should know certain patterns to look out for. Managing the time and attendance process with analytics will help identify employees who are using the system to record hours they have not worked.

The following situations are examples of ways hours are recorded when not worked:

• Employees incorrectly record time worked by punching in and out incorrectly
• Manual entries are made
• Having another employee “buddy punch”
• Through other methods, employees may attempt to increase their pay by recording hours they have not worked

How can payroll analytics assist with monitoring these controls?

• Generate reports that highlight anomalies in time/pay records
• Generate reports identifying variances between an employee’s schedule and the time reported
• Compare payroll data to budget data to spot inconsistencies
• Use system alerts to notify the payroll department when hours or pay deviation tolerance levels are surpassed

 

Falsification of Wages

A payroll department employee who has access to pay wages outside of the time reported, or at a different pay rate, can falsify wages. To prevent and detect falsified wages, regular monitoring is necessary. Payroll wage monitoring can include the following:

• Reconciling the check register to records from the payroll system with each pay period
• Completing a review for ghost/phantom employees when using a third party to issue payments
• Ensuring there is segregation of duties within the department so the pay processor is not also the issuer of checks
• Doing a systematic management review of payments made to payroll staff

Payroll analytics can assist in preventing and detecting this type of fraud with the following controls:

• Payroll reports identifying differences between data sets (e.g., check register and payroll entries)
• Payroll analytics monitoring the payroll system’s activity by the payroll staff to detect situations where the segregation of duties controls have been breached
• Payroll analytics monitoring the payroll system’s activity by the payroll staff to detect entries made outside of normal working hours

 

Ghost Employees

Ghost or phantom employee schemes are perpetrated by payroll or HR employees who create a fictitious employee and provide invalid identity information, including SSN (or national ID), address, and phone number. Another method that payroll or HR staff may use to create phantom employees, rather than false identities, is to issue payments to employees who have terminated their employment and are no longer with the organization.

In this case, the employee’s termination may never be recorded in the human resource information system (HRIS) or human capital management (HCM) system. The payments to the terminated employee would instead be diverted to the fraud perpetrator.

A phantom employee may also be a real person, such as a friend or family member, who is not employed by the company, but who has been entered into the HRIS or HCM system by the payroll or HR employee, with the friend or family member sharing the payment with the payroll/HR employee or keeping it. Common characteristics of ghost employee schemes include the following:

• Names similar to actual employees to decrease the chances of detection
• Temporary or part-time employment classification
• “Employed” in a department with high turnover rates to make fraud more difficult to detect
• Limited documented job duties relative to other employees with similar job titles
• Remote work location, avoiding regular oversight

A ghost employee can occur in a couple of ways:

• A staff member enters a fictitious employee into the system, pays this fictitious employee for fictitious hours, and ensures they are the person who receives the paycheck, either by entering their own bank account information for the direct deposit file or by sending the check to their own address or post office box
• A staff member does not remove an employee who has resigned and updates their direct deposit and/or address to be their own

Numerous analytical tools, such as the following, can examine payroll data to identify patterns that may indicate potential ghost employees:

• Analyzing payroll payment destinations to determine whether multiple employees’ payments are being sent by direct deposit to the same bank account. Sorting the ACH file by bank routing number and account number will help identify multiple payments to a single account, which may indicate phantom employees.
• Analyzing payroll payment destinations to determine whether multiple employees’ checks are mailed to the same address
• Creating reports identifying entries made to both hire or termination data and pay data by the same user
• Developing a query to identify employees hired without proper authorization
• Requiring review of authorization for hire or termination information by an HR/payroll employee not authorized to enter hire or termination data
• Identifying and reviewing payments where net pay is greater than a set percentage of gross pay. A phantom employee’s net pay is often maximized by tax-withholding exemption status and minimal voluntary deductions.
• Comparing employee payments to systems tracking logons or badge entry access

Review the sidebar article, “Bust Ghosts With a Physical Payout,” below to learn some specific ways to stop this type of fraud.

In summary, understanding what payroll fraud is, knowing some of the most common types, and learning how to use analytics to prevent it from happening can be some of the best practices you can do for your organization. PayrollOrg has a three-part Payroll Analytics Series to help you learn such techniques for fraud detection and prevention.

 

Bust Ghosts With a Physical Payout

One method of preventing the processing of paychecks for phantom employees is the “physical payout” (or payoff). During a physical payout, paychecks and direct deposit statements are distributed at each location by the payroll department or internal audit staff. The physical payout has the internal auditor examine an employee’s company identification or other government identification, compare it to the employee’s information on the check or pay statement, and have the employee sign for the check/pay statement. To receive a paycheck, each employee must produce a photo ID. If the employee is not available or cannot provide documentation, the auditor will hold the check/pay statement until the employee can provide their documentation. Employees who fail to provide documentation are identified as potential phantom employees and require additional investigation. Physical payouts should be conducted with as little advance notice as possible to employees. However, by using analytics, a physical payout may be avoided while still identifying possible phantom employees in organizations with a significant percentage of employees paid through direct deposit or paycards. In these organizations, comparing an employee’s bank routing and account numbers, or the payroll card’s routing and account numbers, may identify deposits made for multiple employees into a single bank account.

---

Jim Medlock, CPP, serves as PayrollOrg’s President and works as a Payroll Compliance Educator with Medlock & Associates. A former Education Advisor for PayrollOrg, he is an active volunteer across numerous committees and groups, including the Ask an Expert Committee, Board of Contributing Writers, Board of Directors, Certification Item Development Task Force (CIDTF), CPO Forum Community, the Federal Issues and State and Local Topics Subcommittees of the Government Relations Task Force (GRTF), National Speakers Bureau, and the Best Practices Subcommittee of the Strategic Payroll Leadership Task Force (SPLTF). He has also been featured on PayrollOrg’s “PayTalk” Podcast®. Medlock received PayrollOrg’s Team Member Legend Award in 2018 and was honored as Payroll Man of the Year in 1991.

Mark Thornton, CPA, CPP, is the Payroll Tax Supervisor at Southern Company. He is a member of PayrollOrg’s Board of Directors and volunteers on PayrollOrg’s Finance and Audit Committee and National Speakers Bureau. He was also a guest on PayrollOrg’s “PayTalk” Podcast® and received PayrollOrg’s Meritorious Service Award in 2022. 

---

For more articles like this, read PAYTECH magazine (available in both printed and digital formats), free for PayrollOrg members!

PayrollOrg (PAYO), is the leader in payroll education, publications, and training. This nonprofit association conducts more than 300 payroll training conferences and seminars across the country each year and publishes a complete library of resource texts and newsletters. Representing more than 20,000 members, PAYO is the industry’s highly respected and collective voice in Washington, D.C. Get more information at www.payroll.org.

Not a member of PAYO? Check out the many benefits you get when you join!