What Is Payroll Fraud? A Small Business Guide

Payroll fraud at a small company almost never looks like a heist. It looks like a trusted person who has been with you for years, who handles payroll because nobody else wants to, who never takes a vacation, and who is quietly taking a few hundred dollars a cycle from a business that has no realistic way of noticing.

That description is not dramatic license. It is a summary of what the data says, and it points at the structural fact behind this topic: what makes payroll fraud possible at a small business is the same thing that makes a small business work, which is that you trust one person to just handle it. You cannot fix that by trusting less. You fix it with a handful of controls.

This guide covers what payroll fraud is, how common it actually is with the numbers cited properly, the schemes you will realistically encounter, the employer-side version where the business is the offender, external diversion scams, red flags, how to build segregation of duties without three people, and what to do if you find something. Employee records, role-based access, and a clean offboarding trail are what I built FirstHR for.

The Short Answer

Payroll fraud is any scheme in which someone manipulates a company's payroll for financial gain. Most commonly an employee causes the employer to issue payments through false claims: a ghost employee added to the register, hours that were never worked, or a pay rate altered before a run. It can also be committed by the employer against workers or tax authorities.

The practical version for an owner: if one person can add someone to payroll, change a bank account, and process the run without anyone reviewing it, you have the conditions for this. Whether anything is happening is a separate question from whether it could.

What Payroll Fraud Is

The useful definition is narrower than the phrase suggests, and it comes from the people who study this for a living.

Three directions are worth keeping distinct, because the defenses differ completely. Insider fraud is an employee taking money from the business. Employer-side fraud is the business taking from workers or the tax authorities. External fraud is a stranger tricking your payroll process from outside.

Most guides on this topic cover only the first. All three are covered below, because a small business owner is realistically exposed to all three and only the first one is about trusting the wrong person.

How Common It Actually Is

The authoritative dataset is the Association of Certified Fraud Examiners' biennial study of occupational fraud, which in its 2026 edition analyzed 2,402 cases across 143 countries. Here is what it reports, cited carefully, because several of the figures circulating online are the wrong statistic.

The duration figure is the one to sit with. Thirteen months is roughly twenty-eight biweekly payroll runs during which nothing looked wrong enough for anyone to check. That is not a story about inattentive owners; it is a story about a process that repeats so regularly that variation stops being visible.

Why Small Businesses Get Hit Harder

Small organizations are not incidentally more exposed to this. They are structurally more exposed, for reasons that follow directly from being small.

The first is headcount. Textbook internal control assumes you can split a process across enough people that no one person completes a transaction alone. At twelve employees you cannot do that without making payroll somebody's second job, so the person who prepares the run also approves it, and the control that would catch the problem does not exist.

The second is that formal controls are rare at this size. Per the ACFE, only 24% of organizations with fewer than 100 employees have an established whistleblowing mechanism, against 85% of larger ones, and a hotline is something most small businesses have never considered because it sounds like corporate apparatus.

The third reason is the one nobody says out loud. At a small company the person handling payroll is usually someone you like and trust, often one of your earliest hires, so building a control around them feels like an accusation.

That feeling is the actual vulnerability. The way past it is to frame controls as something applied to the process rather than to the person, which is both more comfortable and more accurate.

The Schemes You Will Actually See

There is a long taxonomy of payroll fraud types and most of it is irrelevant to a business with twenty people. Four schemes account for nearly everything a small employer will encounter.

Notice the pattern in the control column: every one of them is a review performed by someone who cannot also execute the transaction. That is the entire theory of internal control, and at small scale it reduces to a single question you can ask about any payroll change: who saw this besides the person who did it?

Two more schemes are worth naming briefly. Expense reimbursement fraud, which is inflated or duplicated claims, sits adjacent to payroll and is caught by the same review habit. And unrepaid payroll advances, where money goes out as an advance and quietly never comes back, which is caught by tracking advances as receivables rather than as a payroll line.

Timesheet padding is worth separating from outright fraud in your own thinking, because most of it is not criminal. Rounding up, a long lunch recorded as worked, or a coworker covering a late arrival sit on a spectrum that the time theft guide works through. The controls are the same; the response should not be.

When the Employer Is the One Committing It

Payroll fraud is not only something done to businesses. A meaningful share of it is done by them, and a small business owner can drift into it without ever deciding to.

Misclassification deserves a caveat that competing articles skip. It is frequently a genuine mistake rather than fraud, because the legal test is unclear and has been moving.

The federal picture in particular has shifted repeatedly. A 2024 rule took effect in March of that year, and the Department of Labor announced in 2025 that it would stop applying it in its own investigations and revert to an earlier economic reality framework.

The Department went further in February 2026, publishing a proposal to rescind and replace the 2024 rule, with comments closing on April 28. A final rule has not been published, so the standard an employer is measured against still depends on who is doing the measuring.

Two practical implications follow. First, an employer acting in good faith under an unsettled test is in a different position from one deliberately mislabeling staff to dodge overtime. Second, the 2024 rule can still matter in private litigation regardless of federal enforcement posture, and several states apply their own stricter tests.

Payroll Diversion From Outside

The third direction is a stranger, and it is the one a small business is least prepared for. Payroll diversion is a business email compromise scheme where a criminal impersonates an employee and asks you to update their direct deposit details.

The defense costs nothing and works completely: bank detail changes never happen by email. Either the employee changes them themselves through an authenticated self-service portal, or you call them back on the number already in their record, not one supplied in the request. Write that rule down and tell the team it exists, so nobody feels awkward enforcing it against a message that appears to come from a colleague.

Related and worth mentioning to whoever handles your filings: the W-2 phishing scam, where someone impersonating an executive asks for copies of employee W-2 forms. The IRS publishes reporting instructions for W-2 data theft, and the same rule applies: bulk employee data does not leave the company because an email asked for it.

Red Flags Worth Checking

Most of these take minutes to check and none of them proves anything on its own. They are prompts to look more closely, not conclusions.

The first row is the one experienced fraud examiners weight most heavily, and it is counterintuitive because the behavior looks like dedication. Continuous schemes usually require ongoing maintenance, which means the person cannot be away while someone else covers their work. Mandatory time off is a genuine control disguised as a benefit.

Controls When You Do Not Have Three People

Every guide tells you to implement segregation of duties. Almost none of them acknowledges that the textbook version needs three people and you may have one. Here is what it actually looks like depending on how many people you have to work with.

The load-bearing control at every size is the bank statement. If the owner personally opens the bank statement, unopened, before anyone else handles it, a large category of schemes becomes very difficult to sustain, because the money has to leave the account and the account is visible. It takes five minutes a month.

The second one is access. When someone leaves, their access to payroll and employee records should end on their last day, not whenever someone remembers. Ghost employees frequently start as real employees whose records were never closed, and a clean offboarding checklist eliminates that category entirely.

The Detection Method That Works Best

If you implement one thing from this article, make it this one, because the data on it is not close.

For a company of twenty people this does not require a hotline vendor. It requires a stated route that is not the person's own manager, and a written commitment that using it is safe. A monitored email address that goes to the owner, mentioned in the handbook and once a year out loud, covers most of the value.

What makes it work is not the channel but the credibility. People notice things long before controls do, and they say nothing when they are unsure whether raising it will be held against them. The channel is easy; being visibly the kind of employer where using it is fine is the actual work.

Building the Controls

For a small business, this is the whole program. It is an afternoon to set up and about twenty minutes a cycle to run.

Worth being explicit about what this program is not: it is not an accusation, and it is not a sign you hired badly. Controls are what allow you to delegate payroll to one person without that arrangement depending entirely on character. They make the trust safe rather than replacing it.

Most of these controls also do double duty on the compliance side, since the same records that catch a ghost employee are the ones you need when anyone asks about your filings or your wage records.

A control nobody records is a control nobody can show ran, and after a year of identical runs your memory of whether you reconciled the register in March is worth nothing.

One line per payroll run and one line per periodic check turns the program above into something you can look back across. The pattern you are watching for is not a single dramatic entry, it is a column that stops being filled in.

What to Do If You Suspect Fraud

The instinct is to ask the person directly. Resist it for a day or two, because what you do in the first hours largely determines whether you can prove anything later.

The reason to secure records first is practical rather than adversarial. Once someone knows they are suspected, access can be used, logs can be altered, and the window closes. Preserving the evidence costs an hour and preserves every option, including the option of concluding you were wrong.

Do the preserving against a written list, because the first hours are exactly when an anxious person forgets which exports they already ran and starts writing down opinions instead of dates. Fill this in as you go, keep it to what you did and when, and it becomes the document an attorney or an insurer can actually work from.

Where you take it next depends on what you found. Suspected tax fraud goes to the IRS on Form 3949-A, the information referral for reporting suspected tax law violations. Diversion scams and embezzlement go elsewhere, and the routes below sort that out.

The Legal Consequences

Payroll fraud is prosecuted, and the consequences run in both directions depending on who committed it.

For an insider, the conduct can be charged as embezzlement, wire fraud, identity theft, or tax offenses, depending on the mechanics and the amounts. Federal prosecutions of payroll embezzlement at small businesses routinely result in prison sentences measured in years plus full restitution, and the fact that the amount taken per cycle was modest does not change the analysis when the total is substantial.

For an employer, misclassification and wage theft carry back wages, back taxes, FICA, liquidated damages, and civil penalties. Withheld payroll taxes are treated especially seriously because that money was the employees' to begin with.

The IRS calls those withholdings trust fund taxes, and the trust fund recovery penalty reaches any person responsible for paying them who willfully fails to do so, personally, for the full unpaid amount. That liability does not stop at the company, and it survives the company. Payroll tax is the one area where the corporate wrapper is thinnest.

None of this is a substitute for advice on your specific facts. It is here so that the stakes are clear in both directions: this is not a bookkeeping irregularity, and treating it as one is how a manageable problem becomes an unmanageable one.

Where Employers Get This Wrong

Six patterns, and the first two are responsible for most of what actually goes wrong at small companies.

The first is the one to address today, because it is the belief that prevents all the others from being fixed. Controls are not an assessment of anyone's character. They are what makes it possible for a business to run payroll through one trusted person without that being a bet, and the person in that seat generally wants them more than the owner expects.

Frequently Asked Questions