By Joey N. Friedman, CPA, ABV, MAcc, MIB — President, Joey Friedman CPA PA. This article is published by Joey Friedman CPA PA, a Florida professional association. All forensic accounting, business valuation, expert witness, and litigation support services described herein are provided by Joey Friedman CPA PA. Mr. Friedman’s professional credentials and experience are exercised in his capacity as an officer, agent, and licensed CPA practicing under and on behalf of Joey Friedman CPA PA.
Quick Answer
Ghost employee detection identifies payroll fraud where a fictitious or terminated employee remains on the payroll, with paychecks routed to the perpetrator. A forensic CPA detects ghost employees by reviewing payroll registers for missing tax forms (W-4, I-9), addresses shared by multiple employees, direct-deposit accounts at the same bank or routing as the payroll clerk, employees with no benefits enrollment, paychecks that never produce returned mail, and unusual cluster patterns in hire dates or pay rates — then quantifying the total loss for prosecution or insurance recovery.
A ghost employee is one of the oldest payroll fraud schemes: a fictitious person on the payroll receiving wages that flow back to the perpetrator (typically an HR person, payroll administrator, or someone with payroll access). The scheme can run undetected for years and cost a business hundreds of thousands of dollars.
This article explains how ghost employee schemes work, what diagnostic patterns to watch for, and what to do when you suspect one.
How Ghost Employee Schemes Work
The typical pattern:
The perpetrator (often an HR or payroll administrator) creates a payroll record for a fictitious person — name, SSN, address, bank account for direct deposit
The fictitious employee “works” and gets paid each pay period
The wages are deposited to an account the perpetrator controls
The perpetrator pockets the money
Variations include:
Former employee continuation. An employee who left the company stays on the payroll. The departing employee may not even know; the perpetrator just keeps the active record.
Family member as ghost. A relative of the perpetrator is added to the payroll for work that’s not actually performed.
Real employee at inflated rate. An actual employee is paid more than their stated rate; the perpetrator takes the difference.
No-show “consultant” or “contractor.” A 1099 contractor relationship is created for services that aren’t actually rendered.
The schemes range from simple (one ghost, undetected) to elaborate (multiple ghosts, sophisticated cover-up).
Detection Patterns
Several patterns suggest possible ghost employee activity:
Payroll vs. HR Reconciliation Issues
- Employees on the payroll list who don’t appear in the HR active employee list
- Employees who appear on payroll but have no W-4 or I-9 on file
- Multiple employees sharing the same address, bank account, or SSN
- Employees with no manager assignment or no department
A reconciliation between the payroll database and the HR database often surfaces these patterns.
Direct Deposit Patterns
- Multiple employees deposited to the same bank account
- Deposit account in the name of someone other than the employee
- Bank routing/account number combinations that don’t match institutional patterns (e.g., all going to the same small bank)
- Sudden changes in deposit accounts without supporting documentation
Documentation Gaps
- Missing or incomplete personnel files for active employees
- No documentation of background check, drug test, or onboarding for employees on payroll
- W-2 mailing addresses that don’t match HR records
- W-4 dates that don’t match hire date claims
Performance and Activity Indicators
- “Employees” with no performance review history
- “Employees” with no email, phone extension, or system account
- “Employees” who never take time off
- “Employees” never seen in the workplace
- Department headcounts that don’t match physical reality
Detection-Resistant Records
- Personnel files that are conveniently missing
- Time records that don’t have signatures
- Time records that show uniform hours every period (real employees vary)
- “Employees” whose work product can’t be identified
How a Forensic Accountant Investigates
When ghost employee fraud is suspected, the forensic CPA’s investigation typically includes:
Step 1 — Payroll Master File Analysis
Extract the complete payroll master file: all employees, hire dates, termination dates, pay rates, departments, bank accounts, addresses, SSNs.
Run the file through diagnostic tests:
- Same SSN, different employee?
- Same address for multiple employees?
- Same bank account for multiple employees?
- Employees with no termination but no recent activity?
Step 2 — Cross-Reference to Independent Records
Compare the payroll list to independent records:
- HR active employee roster
- Door access / badge systems
- Email/system access logs
- Phone extension lists
- Workers’ compensation rosters
- Health insurance enrollment
- 401(k) plan enrollment
Discrepancies between payroll and these independent systems are diagnostic.
Step 3 — Physical Verification
For employees identified as suspicious, attempt to verify their existence:
- Contact at HR-listed phone number
- Email at HR-listed address
- Mail to HR-listed address (returned mail is diagnostic)
- Visit the work location (does anyone know them?)
Step 4 — Bank Account Tracing
For employees with suspect bank accounts, trace the destinations:
- Bank records (typically obtained via subpoena in litigation)
- ACH detail showing where direct deposits actually landed
- Cross-reference to the perpetrator’s personal accounts
Step 5 — Quantification
Once ghost employees are confirmed:
- Total wages paid to ghosts over the period of fraud
- Employer-side payroll taxes paid on ghost wages (recoverable)
- Benefits costs (health insurance, 401(k) match, etc.)
- The total loss to the business
Common Defenses
When a suspected ghost employee scheme is identified, the suspected perpetrator may raise defenses:
“That’s a real employee, I just don’t have the file handy.” Requires production of contemporaneous documentation. Inability to produce typical onboarding records is itself diagnostic.
“They worked offsite / remotely.” Even remote employees have email accounts, phone records, work product. Lack of digital footprint suggests no real work.
“I’m holding the records for them.” Holding W-2s, paystubs, or other records for an employee is unusual. The employee should have their own copies.
“They left the company; I just forgot to terminate them.” Requires evidence of actual employment during the period in question.
The defenses can be tested through the forensic CPA’s independent verification work.
Recovery and Response
Once a ghost employee scheme is confirmed:
Internal action: Terminate the perpetrator (with proper HR/legal coordination). Secure all financial systems. Change passwords and access controls.
Recovery: Pursue civil recovery from the perpetrator. Florida Statute § 717.118 and similar provisions allow recovery of misappropriated wages.
Criminal referral: Many ghost employee cases qualify for criminal prosecution (grand theft, organized fraud). Local law enforcement and state attorney coordinate.
Insurance claims: Most businesses have fidelity bond / employee dishonesty coverage. Forensic documentation supports the claim.
Internal control improvements: Address the weaknesses that allowed the scheme — typically inadequate segregation of duties in payroll/HR.
Prevention
Ghost employee fraud is preventable through:
- Segregation of duties. Different people in HR (hire/maintain records) vs. payroll (process payments) vs. accounting (match).
- Mandatory vacation policies. Force the perpetrator to step away from the role periodically.
- Independent verification of new hires. Onboarding documentation verification by someone other than the hiring HR person.
- Periodic cross-checks. Periodic comparison of payroll roster to HR roster to physical presence.
- Whistleblower hotline. Anonymous reporting channel for employees who notice anomalies.
- Background checks for HR/payroll staff. Higher diligence for people in fraud-risk roles.
Florida Context
Florida employment law and fraud framework includes:
- Florida theft statutes covering misappropriation of business funds
- Florida wage and hour requirements that produce records useful for fraud detection
- Florida unemployment compensation records that can corroborate or contradict employment claims
- Florida Department of Revenue records on payroll tax filings
A forensic CPA working Florida matters knows how to leverage these data sources.
Frequently Asked Questions
How long can ghost employee fraud go undetected?
Per ACFE data, the median duration is 12-24 months, but cases have run for 5-10+ years before detection. Length depends on internal controls, audit rigor, and turnover in the perpetrator’s role.
How much can a ghost employee scheme cost?
Highly variable. Single ghost at average wages: $40,000-$80,000/year. Multiple ghosts: $200,000-$500,000+/year. Schemes lasting 5-10 years can total millions.
Is ghost employee fraud common?
Yes. Per ACFE, payroll fraud (including ghost employees) accounts for substantial portion of occupational fraud cases.
Does insurance cover the loss?
Most fidelity bonds and employee dishonesty coverage include payroll fraud. Coverage depends on policy specifics, but the forensic CPA’s documented quantification supports the claim.
Can a small business afford this kind of investigation?
A focused ghost employee investigation may run $5,000-$15,000. For schemes that have cost the business hundreds of thousands, the investigation pays for itself through recovery (civil or insurance).
Does Joey Friedman CPA PA handle ghost employee investigations?
Yes. The firm regularly handles payroll fraud investigations for Florida businesses across small, mid-sized, and large companies.
How quickly can the investigation be completed?
A focused investigation (one suspected ghost, one perpetrator) typically 4-8 weeks. Complex multi-ghost schemes 3-6 months.
Working with a Forensic CPA on Ghost Employee Cases
If you suspect a ghost employee scheme in your business, the right early steps are: secure financial systems, preserve records, engage counsel, and engage a forensic CPA. Confronting the suspected perpetrator before completing the investigation typically backfires.
Joey Friedman CPA PA, through its President Joey N. Friedman, CPA, ABV, MAcc, MIB, provides forensic accounting services to Florida businesses facing suspected employee fraud, including ghost employee schemes. Contact the firm to discuss your specific situation.
About Joey Friedman CPA PA
Joey Friedman CPA PA is a Florida professional association providing forensic accounting, business valuation, expert witness, and litigation support services. The firm is led by Joey N. Friedman, CPA, ABV, MAcc, MIB, who serves as the firm’s President.
All services described in this article are provided by Joey Friedman CPA PA. Engagement letters and professional services are issued by the firm. Joey N. Friedman signs in his capacity as the firm’s President — as an officer and agent acting on behalf of Joey Friedman CPA PA, not in any personal or individual capacity. Mr. Friedman’s professional credentials — including CPA license, ABV (Accredited in Business Valuation, AICPA), and ACFE membership — are exercised under the firm.
To engage Joey Friedman CPA PA, contact the firm:
- Phone: 954-282-9615
- Contact form: Contact the Firm
Disclaimer: This article is for informational purposes only and does not constitute legal, accounting, or tax advice. Engagement of Joey Friedman CPA PA is subject to a written engagement letter executed between Joey Friedman CPA PA and the engaging party. No attorney-client or accountant-client relationship is created by reading this article.
Related coverage from Joey Friedman CPA PA
- Asset Misappropriation: A CPA’s Field Guide for Detection and Investigation
- Fraud Investigator: When You Need a Forensic CPA vs Other Investigators
- The Bank Deposit Method: Reconstructing Revenue When the Books Are Missing
About This Service
This article is part of Joey Friedman CPA PA’s broader practice in forensic accounting service overview. Visit the main service page for a complete overview of how we support attorneys, businesses, and individuals across Florida and nationally in financial disputes, litigation, and forensic engagements.