Your Employee Never Existed. How a Ghost Payroll Scheme Can Hurt a Business

What Is a Ghost Employee?

A ghost employee is a payroll record that sends money or benefits to someone who is not legitimately earning that compensation. The record may belong to a completely invented worker. It may use a real person’s stolen identity. It may be a former employee who remained active after leaving.

That distinction matters. It can affect the company’s accounting, wage reporting, tax corrections, insurance claim, and response to the affected worker.

How Ghost Employee Payroll Fraud Hides in a Business

Ghost payroll usually depends on weak controls. One person may create an employee, enter bank information, approve payroll, and review the reports. Without independent review, a false record can look routine.

A terminated employee may remain active while someone changes the bank account and continues the payments. A duplicate profile can also send a second payment elsewhere.

Using an outside payroll provider does not, by itself, establish that everyone on the payroll performed services. The provider’s verification and fraud-monitoring responsibilities depend on its services and contract. The business still needs its own approval and review controls.

Payroll Fraud Warning Signs You Should Not Ignore

One unusual entry does not prove fraud, but it justifies a closer look.

Warning signs may include:

• An employee with no hiring file, supervisor, schedule, or work product
• Several employees using the same address or bank account without a clear reason
• Pay continuing after a documented termination date
• Duplicate Social Security numbers or employee profiles
• Unexpected bonuses, overtime, reimbursements, or manual checks
• Direct-deposit changes that were not independently verified
• Payroll costs rising while staffing levels remain unchanged
• Employee records created outside the normal hiring process
• Someone refusing to take vacation or share payroll duties

Look for patterns. A shared bank account may be legitimate for family members. A missing file may reflect poor administration. Verify the facts before calling the entry fraudulent.

Before You Confront Anyone, Secure the Records

An immediate confrontation may lead to deleted emails, altered logs, or moved funds. Get advice about the order of operations.

Preserve copies of:

• Payroll registers and employee master files
• Direct-deposit authorizations and change history
• User-access and approval logs
• Bank statements and canceled checks
• Time records, schedules, and work assignments
• Forms W-4, I-9, W-2, W-3, 941, and 940
• Federal and state payroll-tax deposit records
• Benefit enrollments and retirement contributions
• Emails, messages, and hiring approvals

Prevent another unauthorized payment when the facts support doing so. Restrict access, change compromised credentials, enable multifactor authentication, and verify administrator accounts.

The Loss May Be Larger Than the Direct Deposits

If a fake record received $2,000 every pay period, the business’s loss may exceed the cash deposited. The company may also have paid:

• Employer Social Security and Medicare taxes
• Federal and state unemployment taxes
• Health-insurance premiums
• Retirement-plan contributions
• Workers’ compensation premiums
• Reimbursements or other benefits

Create a pay-period-by-pay-period schedule. Separate gross pay, net deposits, employee withholdings, employer taxes, benefits, and reimbursements. Then reconcile that schedule to the bank account, payroll reports, and general ledger.

First determine what was paid, to whom, and why. Do not assume every amount can be recovered.

Review Forms 941 and Federal Tax Deposits

If the suspicious amounts were included in quarterly payroll, they may already appear on Forms 941. Federal tax deposits may also include income-tax withholding and both sides of Social Security and Medicare taxes connected to the record.

Compare each affected quarter’s payroll journal with Form 941, deposit confirmations, state wage reports, unemployment filings, and the general ledger.

Form 941-X corrects certain errors on a previously filed Form 941. That does not mean the business should immediately subtract every suspicious payment. The treatment can depend on whether services were performed, wages were paid, taxes were withheld, or a real employee’s payment was redirected.

Were Incorrect Forms W-2 Already Filed?

If year-end wage statements have not been filed, promptly investigate the questionable record before reporting it. An internal investigation does not automatically extend filing or furnishing deadlines. Coordinate with your payroll professional to meet those deadlines and correct errors when necessary.

If an incorrect Form W-2 was already filed, Forms W-2c and W-3c may be part of the correction process. The business must coordinate wage-statement corrections with any employment-tax corrections. The forms should tell one consistent story.

The answer is not always “erase the W-2.” If a real employee performed the work but the payment was stolen through a changed bank account, the wage and withholding facts may differ from a completely invented worker. If another person’s Social Security number was used, that person may also face an employment-related identity-theft problem.

Form 941-X Is Not an Automatic Solution

Form 941-X is a correction form, not a shortcut to recover stolen money. Filing an unsupported refund claim may create another problem.

Before filing, determine:

• Which quarters are affected
• Whether reported wages were wrong
• Whether tax was actually withheld
• Whether the company seeks an adjustment, refund, or abatement
• Whether employee repayment or consent rules matter
• Whether Forms W-2c and W-3c must also be filed
• Whether state returns require separate corrections
• Whether the correction or refund period remains open for each quarter

This is where a payroll-tax professional earns their fee. Do not guess your way through it.

Can the Business Deduct Money Lost Through Ghost Payroll?

The facts must establish theft under applicable state law, although a criminal conviction is not required. A qualifying theft loss is generally considered in the year it is discovered. Any portion covered by a claim with a reasonable prospect of recovery generally must wait until the outcome becomes reasonably certain. The amount may also depend on tax basis and reimbursements.

The business should separate genuine compensation from stolen funds, identify any prior deductions, and evaluate possible recovery before deciding how the loss belongs on a return. IRS Publication 547 explains federal theft-loss concepts, but the final treatment depends on the facts and entity type.

Is This Employee Theft or Business Identity Theft?

Internal theft and tax-related business identity theft are related but not identical.

If an authorized payroll employee stole money by creating a false worker, the company may be dealing primarily with internal fraud. If someone used the company’s name or Employer Identification Number to file tax returns or Forms W-2 that the business did not authorize, the IRS may treat that as possible business identity theft.

The IRS directs qualifying businesses to Form 14039-B, Business Identity Theft Affidavit, when someone appears to have used the business name or EIN to submit fraudulent returns or wage statements. Do not file it automatically for every internal theft. Confirm that the situation fits the form’s instructions.

Who Should the Business Contact?

Depending on the facts, the response team may include:

• Payroll provider: Preserve system logs, block unauthorized users, and explain correction procedures.
• Bank: Trace payments, protect accounts, and determine whether recovery options remain.
• CPA or payroll-tax professional: Reconcile payroll, tax deposits, wage statements, and deductions.
• Attorney: Advise on evidence, employee rights, privacy, termination, reporting, and legal exposure.
• Insurance carrier: Protect notice deadlines under crime, cyber, fidelity, or other coverage.
• Benefit administrators: Review health, retirement, and other payments tied to the record.
• Tax agencies: Correct affected filings or respond to unauthorized returns and notices.
• Law enforcement: Document suspected theft when counsel recommends reporting.

How to Prevent Another Ghost Employee

Basic separation can make fraud harder.

• Require one person to enter a new employee and another to approve the record.
• Verify direct-deposit changes through a trusted channel.
• Compare payroll rosters with HR files and department headcounts.
• Review terminated employees before every payroll.
• Limit administrator rights and review access logs.
• Require supporting records for bonuses, overtime, and manual checks.
• Reconcile payroll withdrawals to approved payroll reports.
• Have the owner or an independent manager review changes regularly.
• Require vacation or job rotation for payroll staff when practical.

The IRS recommends limiting access, using multifactor authentication, and verifying employee-information changes through a trusted channel. Keep employment-tax records for at least four years after the tax becomes due or is paid, whichever is later. Fraud-related records may need to be preserved longer based on applicable requirements and legal or insurance advice.

For more prevention guidance, read how to protect your business from payroll fraud.

Frequently Asked Questions

What to Do Next

Secure the records. Prevent another unauthorized payment. Build a schedule showing every affected pay period and reconcile it to the bank, payroll filings, wage statements, benefits, and general ledger.

Then bring the records to the right professionals before amending returns or confronting a suspected person. The employee may be a ghost, but the tax filings and missing money are real. What matters most is what you do next.

Disclaimer