Ghost Employee (a fake identity on a company’s payroll)
A ghost employee is a name on a payroll that does not correspond to a person doing work. It may be entirely fictitious, a former employee never removed after leaving, or a real person who does not work there. Wages are paid and diverted, usually to someone inside the organization who controls part of the payroll process. It is payroll fraud, and it is an identity failure before it is an accounting one.
| Category | Occupational fraud — asset misappropriation, payroll scheme |
| Three common forms | Fictitious person, terminated employee left active, real person who performs no work |
| Requires | Ability to add or maintain a payroll record, and control of where payment goes |
| Enabling weakness | No segregation of duties between hiring, payroll and payment approval |
| Typical duration | Long — the scheme produces a steady, unremarkable outflow |
| Where it concentrates | Large workforces, high turnover, seasonal or distributed hiring, remote onboarding |
| Primary detection signals | Duplicate bank details or addresses, missing deductions, no leave ever taken |
| Root prevention | Verifying identity at hire, and separating who can hire from who can pay |
How the scheme works
Three ingredients: a payroll record, a payment destination, and nobody comparing the two against reality. Whoever runs the scheme needs the ability to create or preserve an employee record and to set the account it pays into. Where one person or one team does both, the scheme is trivial. Where those duties are separated, it requires collusion — which is why segregation of duties is the standard control and why its absence is the standard finding.
The fictitious variant needs an identity plausible enough to survive onboarding. The terminated-employee variant needs nothing at all beyond the failure to deactivate a leaver, which is why offboarding discipline matters as much as hiring discipline. The third variant — a real person, often a relative, who is paid for work they do not perform — is the hardest to detect, because every document is genuine.
What makes ghost employees persistent rather than dramatic is that they look like ordinary payroll. There is no unusual transaction to flag. The money leaves on schedule, in an ordinary amount, to an ordinary account, every cycle, sometimes for years.
Detection signals
| Signal | Why it appears |
|---|---|
| Two employees sharing bank details | The fraudster routes the ghost’s wages to their own account |
| Duplicate or missing address, or a mail drop | A fictitious person has no real residence to record |
| No tax elections, benefits enrollment or deductions | Nobody completed the paperwork a real hire generates |
| An employee who never takes leave and never appears | There is nobody to take leave |
| Payments continuing past a termination date | The leaver record was never deactivated |
| Records created outside normal hiring workflow | The record bypassed the process that would have checked it |
Any one of these has innocent explanations — shared accounts between spouses, a new starter mid-cycle. The combination is what makes a case, which is why payroll analytics run these as a set rather than as individual rules.
Why ghost employees matter for identity verification
The fictitious variant is a synthetic identity problem in a different setting. Someone assembles a plausible person, gets them onto a system that pays money out monthly, and collects. The mechanics are the same as opening a fraudulent credit account — and payroll is generally the softer target, because hiring controls were designed around employment law and reference checks rather than around fraud.
Remote and distributed hiring has widened this. When nobody meets a new starter in person, the identity check is whatever the onboarding software does, and in many organizations that is a document uploaded as a photograph and glanced at by someone in HR. That is precisely the check that digital tampering defeats.
The control that closes the fictitious variant is verifying at hire that a real, correctly identified person is being added — an authenticated document plus a biometric comparison binding it to the applicant. That is what employee verification exists to do, and it also produces the evidence trail an audit needs later. Identity document verification at onboarding does not touch the third variant, where the person is real, but it removes the one that scales.
What controls can’t do
Identity verification does not stop the real-person variant. Where a genuine individual is paid for work they do not do, every document is authentic. That is a management and audit problem.
Payroll analytics run after the money has gone. Detection signals surface a scheme that has already been paying, often for several cycles.
Segregation of duties fails against collusion. Two people working together defeat the standard control, which is why periodic independent verification still matters.
Offboarding is the gap most often missed. A great deal of payroll fraud requires no fabricated identity at all — only a leaver who was never removed.
Frequently asked questions
What is a ghost employee?
A name on a payroll that does not correspond to someone doing work. It can be a fabricated person, an employee who left but was never removed from the system, or a real individual who is paid without performing any work. Wages are collected by whoever controls the payment destination.
How are ghost employees detected?
Through payroll analytics looking for combinations of signals: duplicate bank account details or addresses across employees, records with no tax elections or benefits enrollment, employees who never take leave, and payments continuing after a termination date. Individually these have innocent explanations; together they build a case.
How can ghost employees be prevented?
By separating the duties of hiring, maintaining payroll records and approving payments, by verifying identity at hire so a fabricated person cannot be onboarded, and by disciplined offboarding so leavers are deactivated promptly. Periodic independent payroll audits catch what the preventive controls miss.
Is a ghost employee the same as payroll fraud?
It is one type of payroll fraud. Others include falsified hours, inflated commissions and unauthorized bonus payments. What distinguishes the ghost employee scheme is that the payee does not exist or does not work there, which makes it an identity problem as well as a financial control problem.
Related reading
- Synthetic identity fraud — the same fabricated-person technique, applied to credit rather than payroll
- First-party fraud — the insider dimension, where the fraudster is inside the organization
- Identity fraud — the broader category these schemes sit within
- How biometric KYC enables secure onboarding — the verification pattern that closes the fabricated-hire route
