A “ghost employee” is a person listed in a company’s payroll system who does not actually work for the organization. In some cases, the employee is completely fictitious; in others, it may be a former employee who was never removed from payroll or a real person whose identity is misused. The fraud typically occurs when someone with access to payroll or human resources records creates or keeps an unauthorized employee profile and redirects the paycheck to an account they control.

Ghost employee schemes are especially risky because they can continue quietly for months or years. Each payroll cycle creates another improper payment, and the total loss can grow through wages, payroll taxes, benefits, overtime, and insurance costs. The scheme also weakens trust in payroll data, budget reporting, and internal controls.

Common warning signs

• Employees with missing or incomplete onboarding documents, tax forms, or identification records.
• Multiple employees sharing the same address, phone number, bank account, or direct-deposit details.
• Payroll payments continuing after an employee’s termination date.
• Employees who receive pay but have no time records, supervisor approval, benefits activity, email account, badge access, or work output.
• Unusual patterns in hire dates, pay rates, overtime, or manual payroll adjustments.

How to protect against ghost employees

The best defense is a strong payroll control environment. Companies should separate duties so that no one person can create an employee, approve time, change bank information, and process payroll without review. HR and payroll records should be reconciled regularly, especially after terminations, transfers, and leaves of absence. Managers should certify active employee lists each pay period or at least monthly, confirming that every person being paid is actually working in their department.

Regular audits are also essential. Payroll reports should be reviewed for duplicate bank accounts, duplicate addresses, missing documentation, inactive employees, and payments without approved hours. Access to payroll systems should be limited by role, monitored through audit trails, and promptly removed when employees change jobs or leave the company. Where appropriate, organizations can also use identity verification, electronic timekeeping, badge data, and exception reporting to detect inconsistencies before losses become significant.

Ultimately, preventing ghost employees requires more than software. It depends on clear ownership, routine review, ethical leadership, and a culture where payroll irregularities are questioned early. By combining segregation of duties, clean employee records, periodic audits, and timely termination controls, businesses can greatly reduce the risk of paying people who do not exist—or who no longer work there.