What Is Payroll Fraud? A Small Business Guide
What payroll fraud is, the schemes that hit small businesses, the red flags to watch, how to build controls on a small team, and what to do if you find it.
What Is Payroll Fraud?
The schemes, the red flags, and how to build real controls when one person handles everything
Payroll fraud at a small company almost never looks like a heist. It looks like a trusted person who has been with you for years, who handles payroll because nobody else wants to, who never takes a holiday, and who is quietly taking a few hundred dollars a cycle from a business that has no realistic way of noticing.
That description is not dramatic license. It is a summary of what the data says, and it points at the uncomfortable structural fact behind this whole topic: the thing that makes payroll fraud possible at a small business is the same thing that makes a small business work, which is that you trust one person to just handle it. You cannot fix that by trusting less. You fix it with a handful of controls that take about an hour to set up.
This guide covers what payroll fraud is, how common it actually is with the numbers cited properly, the schemes you will realistically encounter, the employer-side version where the business is the offender, external diversion scams, red flags, how to build segregation of duties when you do not have three people to segregate, and what to do if you find something. Employee records, role-based access, and a clean offboarding trail are what I built FirstHR for. This is general information rather than legal advice.
The Short Answer
Payroll fraud is any scheme in which someone manipulates a company's payroll for financial gain. Most commonly an employee causes the employer to issue payments through false claims: a ghost employee added to the register, hours that were never worked, or a pay rate altered before a run. It can also be committed by the employer against workers or tax authorities.
The practical version for an owner: if one person can add someone to payroll, change a bank account, and process the run without anyone reviewing it, you have the conditions for this. Whether anything is happening is a separate question from whether it could.
What Payroll Fraud Is
The useful definition is narrower than the phrase suggests, and it comes from the people who study this for a living.
Three directions are worth keeping distinct, because the defenses differ completely. Insider fraud is an employee taking money from the business. Employer-side fraud is the business taking from workers or the tax authorities. External fraud is a stranger tricking your payroll process from outside.
Most guides on this topic cover only the first. All three are covered below, because a small business owner is realistically exposed to all three and only the first one is about trusting the wrong person.
How Common It Actually Is
The authoritative dataset is the Association of Certified Fraud Examiners' biennial study of occupational fraud. Here is what the 2024 edition says, cited carefully, because several of the figures circulating online are the wrong statistic.
| Figure | Value | What it actually means |
|---|---|---|
| Payroll share of all cases | 10% | 190 of the 1,921 cases studied were payroll schemes |
| Median loss per payroll case | $50,000 | The midpoint. Half of cases lost less, half lost more |
| Median duration before detection | 18 months | Payroll ties for the longest-running scheme types |
| Overall median duration | 12 months | Payroll runs six months longer than fraud in general |
| Median loss, organizations under 100 people | $141,000 | Across all fraud types. Second highest of any size band |
| Median loss, caught within six months | $30,000 | Versus $250,000 for schemes lasting two to three years |
| Share detected by a tip | 43% | More than three times the next method, internal audit at 14% |
The duration figure is the one to sit with. Eighteen months is roughly thirty-nine biweekly payroll runs during which nothing looked wrong enough for anyone to check. That is not a story about inattentive owners; it is a story about a process that repeats so regularly that variation stops being visible.
Why Small Businesses Get Hit Harder
Small organizations are not incidentally more exposed to this. They are structurally more exposed, for reasons that follow directly from being small.
The first is headcount. Textbook internal control assumes you can split a process across enough people that no one person completes a transaction alone. At twelve employees you cannot do that without making payroll somebody's second job, so the person who prepares the run also approves it, and the control that would catch the problem does not exist.
The second is that formal controls are rare at this size. The ACFE data shows small organizations are markedly less likely to have anti-fraud mechanisms in place than large ones, and a reporting hotline in particular is something most small businesses have never considered because it sounds like corporate apparatus.
The third reason is the one nobody says out loud. At a small company the person handling payroll is usually someone you like and trust, often one of your earliest hires. Building a control around them feels like an accusation. That feeling is the actual vulnerability, and the way past it is to frame controls as something applied to the process rather than to the person, which is both more comfortable and more accurate.
The Schemes You Will Actually See
There is a long taxonomy of payroll fraud types and most of it is irrelevant to a business with twenty people. Four schemes account for nearly everything a small employer will encounter.
Notice the pattern in the control column: every one of them is a review performed by someone who cannot also execute the transaction. That is the entire theory of internal control, and at small scale it reduces to a single question you can ask about any payroll change: who saw this besides the person who did it?
Two more schemes are worth naming briefly. Expense reimbursement fraud, which is inflated or duplicated claims, sits adjacent to payroll and is caught by the same review habit. And unrepaid payroll advances, where money goes out as an advance and quietly never comes back, which is caught by tracking advances as receivables rather than as a payroll line.
Timesheet padding is worth separating from outright fraud in your own thinking, because most of it is not criminal. Rounding up, a long lunch recorded as worked, or a coworker covering a late arrival sit on a spectrum that the time theft guide works through. The controls are the same; the response should not be.
When the Employer Is the One Committing It
Payroll fraud is not only something done to businesses. A meaningful share of it is done by them, and a small business owner can drift into it without ever deciding to.
| Employer-side conduct | What it looks like | The exposure |
|---|---|---|
| Off-the-books wages | Paying cash to avoid payroll taxes and workers compensation premiums | Back taxes, penalties, and criminal exposure for tax offenses |
| Withholding not remitted | Taxes deducted from employee pay that never reach the authorities | Among the most serious. Personal liability for owners and officers |
| Knowing misclassification | Treating employees as 1099 contractors to avoid overtime, taxes, and benefits | Back wages, back taxes, liquidated damages, and civil penalties |
| Time record manipulation | Editing timesheets to erase overtime, or automatic break deductions never taken | Wage and hour claims, often as a group across the whole workforce |
Misclassification deserves a caveat that competing articles skip. It is frequently a genuine mistake rather than fraud, because the legal test is genuinely unclear and has been changing. The federal picture in particular has moved repeatedly: a 2024 rule took effect in March of that year, the Department of Labor announced in 2025 that it would stop enforcing it and revert to an earlier economic reality framework, and in February 2026 it proposed formally rescinding and replacing it, with the comment period closing in April 2026.
Two practical implications follow. First, an employer acting in good faith under an unsettled test is in a different position from one deliberately mislabeling staff to dodge overtime. Second, the 2024 rule can still matter in private litigation regardless of federal enforcement posture, and several states apply their own stricter tests. The misclassification guide covers where that stands in more detail.
Payroll Diversion From Outside
The third direction is a stranger, and it is the one growing fastest. Payroll diversion is a business email compromise scheme where a criminal impersonates an employee and asks you to update their direct deposit details.
The defense costs nothing and works completely: bank detail changes never happen by email. Either the employee changes them themselves through an authenticated self-service portal, or you call them back on the number already in their record, not one supplied in the request. Write that rule down and tell the team it exists, so nobody feels awkward enforcing it against a message that appears to come from a colleague.
Related and worth mentioning to whoever handles your filings: the W-2 phishing scam, where someone impersonating an executive asks for copies of employee W-2 forms. The same rule applies, which is that bulk employee data does not leave the company because an email asked for it.
Red Flags Worth Checking
Most of these take minutes to check and none of them proves anything on its own. They are prompts to look more closely, not conclusions.
| Red flag | Why it matters | How to check it |
|---|---|---|
| An employee who never takes time off | Ongoing schemes usually need the person present to keep them hidden | Review PTO usage across the team once a quarter |
| Two employees sharing a bank account | The classic ghost employee signature | Sort the payroll register by account number and look for duplicates |
| A name nobody in operations recognizes | The other classic signature | Read the register aloud with a manager who knows the actual team |
| Pay that does not match the offer letter | Rate manipulation, or an approved change nobody recorded | Spot-check three employee records against their signed documents |
| Overtime that does not match output | Timesheet padding | Compare overtime hours to production, deliveries, or client hours |
| Payroll totals drifting up without hires | Any of the above, quietly compounding | Track total payroll per head, per cycle, on one line |
| Resistance to anyone else touching payroll | The person may simply be territorial. Or not | Rotate the review, not the job. Someone else reads the register |
| Pay continuing after someone left | Termination that never reached the payroll system | Reconcile terminations against the register at every run |
The first row is the one experienced fraud examiners weight most heavily, and it is counterintuitive because the behavior looks like dedication. Continuous schemes usually require ongoing maintenance, which means the person cannot be away while someone else covers their work. Mandatory time off is a genuine control disguised as a benefit.
Controls When You Do Not Have Three People
Every guide tells you to implement segregation of duties. Almost none of them acknowledges that the textbook version needs three people and you may have one. Here is what it actually looks like at each size.
The load-bearing control at every size is the bank statement. If the owner personally opens the bank statement, unopened, before anyone else handles it, a large category of schemes becomes very difficult to sustain, because the money has to leave the account and the account is visible. It takes five minutes a month.
The second one is access. When someone leaves, their access to payroll and employee records should end on their last day, not whenever someone remembers. Ghost employees frequently start as real employees whose records were never closed, and a clean offboarding checklist eliminates that category entirely.
The Detection Method That Works Best
If you implement one thing from this article, make it this one, because the data on it is not close.
For a company of twenty people this does not require a hotline vendor. It requires a stated route that is not the person's own manager, and a written commitment that using it is safe. A monitored email address that goes to the owner, mentioned in the handbook and once a year out loud, covers most of the value.
What makes it work is not the channel but the credibility. People notice things long before controls do, and they say nothing when they are unsure whether raising it will be held against them. The channel is easy; being visibly the kind of employer where using it is fine is the actual work.
Building the Controls
For a business with five to fifty people, this is the whole program. It is an afternoon to set up and about twenty minutes a cycle to run.
Worth being explicit about what this program is not: it is not an accusation, and it is not a sign you hired badly. Controls are what allow you to delegate payroll to one person without that arrangement depending entirely on character. They make the trust safe rather than replacing it.
Most of these controls also do double duty on the compliance side, since the same records that catch a ghost employee are the ones you need when anyone asks about your filings or your wage records. The broader obligations sit in the payroll compliance guide.
What to Do If You Suspect Fraud
The instinct is to ask the person directly. Resist it for a day or two, because what you do in the first hours largely determines whether you can prove anything later.
The reason to secure records first is practical rather than adversarial. Once someone knows they are suspected, access can be used, logs can be altered, and the window closes. Preserving the evidence costs an hour and preserves every option, including the option of concluding you were wrong.
The Legal Consequences
Payroll fraud is prosecuted, and the consequences run in both directions depending on who committed it.
For an insider, the conduct can be charged as embezzlement, wire fraud, identity theft, or tax offenses, depending on the mechanics and the amounts. Federal prosecutions of payroll embezzlement at small businesses routinely result in prison sentences measured in years plus full restitution, and the fact that the amount taken per cycle was modest does not change the analysis when the total is substantial.
For an employer, misclassification and wage theft carry back wages, back taxes, FICA, liquidated damages, and civil penalties. Failure to remit withheld payroll taxes is treated especially seriously because that money was the employees' to begin with, and it can produce personal liability for owners and officers rather than stopping at the company.
None of this is a substitute for advice on your specific facts. It is here so that the stakes are clear in both directions: this is not a bookkeeping irregularity, and treating it as one is how a manageable problem becomes an unmanageable one.
Where Employers Get This Wrong
Six patterns, and the first two are responsible for most of what actually goes wrong at small companies.
The first is the one to address today, because it is the belief that prevents all the others from being fixed. Controls are not an assessment of anyone's character. They are what makes it possible for a business to run payroll through one trusted person without that being a bet, and the person in that seat generally wants them more than the owner expects.
Frequently Asked Questions
What is payroll fraud?
Payroll fraud is any scheme in which someone manipulates a company's payroll system for financial gain. It usually means an employee causing the employer to issue a payment through false claims for compensation, such as adding a ghost employee, recording hours that were not worked, or altering a pay rate. It can also run the other way, with the employer defrauding workers or tax authorities through misclassification or unreported wages, and it can come from outside the company entirely through payroll diversion scams.
How common is payroll fraud?
More common than most owners assume, and disproportionately so at small companies. In the Association of Certified Fraud Examiners' 2024 study of 1,921 occupational fraud cases, payroll schemes accounted for 10 percent of all cases with a median loss of $50,000 per case. Organizations with fewer than 100 employees suffered a median loss of $141,000 across all fraud types, the second highest of any size category. Small firms are hit harder because they have fewer people, fewer checks, and far less likely to have formal anti-fraud controls.
What is a ghost employee?
A ghost employee is a person on the payroll who does not actually work for the company. They may be entirely fictitious, or a real former employee whose record was never deactivated after they left. Whoever set up the scheme redirects the pay to an account they control. The tell-tale signs are a name nobody in operations recognizes, a direct deposit account shared with another employee, an employee who never takes time off and has no benefits enrollment, and pay continuing after a termination date.
How do you detect payroll fraud?
The single most effective mechanism is a way for employees to report concerns. Per the ACFE's 2024 report, 43 percent of occupational frauds were detected by a tip, more than three times the next most common method, with internal audit at 14 percent and management review at 13 percent. Beyond that, reconcile the payroll register against your actual roster every cycle, review a report of all changes to rates and bank details, have the owner personally open the bank statement, and look for employees who never take time off.
Is payroll fraud a crime?
Yes. Depending on the conduct it can be charged as embezzlement, wire fraud, identity theft, or tax offenses, and federal prosecutions of payroll embezzlement regularly result in prison sentences plus full restitution. On the employer side, wage theft and misclassification carry back wages, back taxes, liquidated damages, and civil penalties, with willful violations exposing owners and officers to criminal fines and personal liability. Which route applies depends heavily on facts, amounts, and whether tax authorities were defrauded, so this is a situation for actual legal advice.
How long does payroll fraud usually go undetected?
Longer than almost any other scheme type. The ACFE found payroll schemes typically lasted 18 months before detection, compared with an overall median of 12 months across all occupational fraud. That duration matters enormously because losses compound: frauds caught within the first six months had a median loss of $30,000, while those running two to three years reached $250,000. Payroll fraud lasts because payroll is repetitive, the amounts per cycle are small, and nobody reviews a register that looks the same every fortnight.
How do you prevent payroll fraud in a small business?
Separate preparation from approval, even if that means the owner personally approves every run. Reconcile the payroll register against the actual roster each cycle. Require written approval for any change to a pay rate, bank detail, or employee record, from someone who cannot process payroll. Deactivate access on the termination date rather than at month end. Have the owner personally open the bank statement. And give employees a way to raise concerns, because tips detect more fraud than every other method combined.
What is payroll diversion fraud?
Payroll diversion is an external scam in which a criminal impersonates an employee by email and asks payroll or HR to redirect their direct deposit to a new account. It is a variant of business email compromise. The FBI's Internet Crime Complaint Center reported over a thousand complaints of this scheme in an eighteen-month window with more than $8 million in losses, and an average loss around $7,900 per complaint. The defense is simple: never change bank details based on an email, and require an authenticated self-service change or a callback to a known number.
Can an employer commit payroll fraud?
Yes, and it is a meaningful share of the problem. Employer-side payroll fraud includes paying wages off the books to avoid payroll taxes, misclassifying employees as independent contractors to avoid overtime, taxes, and benefits, withholding payroll taxes from employees and never remitting them, and manipulating time records to erase overtime. Note that misclassification is not always fraud: it is often a genuine mistake about a genuinely unclear test. It becomes fraud when the classification is knowingly wrong and used to avoid obligations.
What should you do if you suspect payroll fraud?
Preserve the evidence before you do anything else. Export payroll registers, timesheets, change logs, and bank records for the full period, because access can be revoked or records altered once someone knows they are suspected. Then talk to an attorney and, if the amounts are material, a forensic accountant, before confronting anyone. Do not accuse someone based on a suspicion you have not documented. Depending on the conduct, reporting routes include IRS Form 3949-A for tax fraud, ic3.gov for diversion scams, and local law enforcement for embezzlement.