Payroll Fraud Schemes

Where This Topic Sits in the CFE Body of Knowledge
Payroll fraud schemes are a sub-category of fraudulent disbursements, which in turn fall under asset misappropriation on the ACFE Fraud Tree (Occupational Fraud and Abuse Classification System). Fraudulent disbursements are schemes in which an employee causes the organization to pay out money for a dishonest purpose while making the payment appear legitimate. The five fraudulent disbursement categories are billing schemes, payroll schemes, expense reimbursement schemes, check and payment tampering, and register disbursements. Payroll schemes are the second of these and are tested within the Financial Transactions and Fraud Schemes section of the CFE Exam.

Why Payroll Fraud Schemes Are Important
Payroll is typically one of the largest recurring expenses of any organization, often the single largest cash outflow for service-based and government entities. That makes it a natural target. According to the ACFE Report to the Nations, payroll schemes appear in roughly 9 to 10 percent of asset misappropriation cases and carry a median loss of approximately $50,000, with a typical duration of about two years before detection. Payroll frauds are also attractive to perpetrators because:
• Payroll runs on a regular, predictable cycle, so a fraud can be repeated every pay period with little additional effort.
• Payroll data is often held by a small number of trusted employees, which weakens segregation of duties.
• Payroll expense fluctuates naturally (overtime, bonuses, seasonal staffing), so inflated amounts blend into normal variance.
• Payments are frequently made by direct deposit, removing the physical check that once had to be intercepted.
For the CFE candidate, payroll schemes are important because the exam expects you to recognize the scheme type from a fact pattern, identify the specific red flags, name the detection procedure most likely to uncover it, and select the internal control that would have prevented it. Understanding payroll fraud also reinforces the broader logic of the Fraud Tree: the perpetrator is an insider who is authorized to interact with the payroll system and abuses that access.

What a Payroll Fraud Scheme Is
The ACFE Fraud Examiners Manual defines payroll schemes as frauds in which an employee causes his or her employer to issue a payment by making false claims for compensation. The key word is compensation. The fraudulent disbursement is disguised as wages, salary, overtime, commission or a similar payroll item. This distinguishes payroll schemes from billing schemes (where the false claim is disguised as a payment to a vendor) and from expense reimbursement schemes (where the false claim is disguised as a business expense incurred by the employee).

The Fraud Tree divides payroll schemes into three principal types:
1. Ghost employee schemes – paying someone who does not actually work for the organization.
2. Falsified hours and salary schemes (falsified wages) – a real employee is paid for more hours than worked, or at a higher rate than authorized.
3. Commission schemes – a salesperson inflates the sales or commission rate on which commissions are calculated.
Older ACFE materials also listed workers' compensation schemes (faking an injury to collect benefits) under payroll. Current materials treat these primarily as insurance fraud, but you should recognize the term if it appears.

How Payroll Fraud Works: Scheme by Scheme

1. Ghost Employee Schemes
A ghost employee is a person on the payroll who does not actually work for the victim organization. The ghost may be entirely fictitious, or may be a real person who is not legitimately employed, such as a relative or friend of the perpetrator, a former employee who was never removed from the system, or a deceased employee whose pay continues to be issued. For a ghost employee scheme to succeed, the ACFE identifies four steps that must all occur:
Step 1 – Adding the ghost to the payroll. The perpetrator usually has hiring authority or access to personnel and payroll master files. A common variation is keeping a terminated employee on the payroll rather than creating a new record, because this avoids the scrutiny of a new hire.
Step 2 – Collecting timekeeping or salary information. If the ghost is hourly, someone must submit timecards and obtain approval, often by forging a supervisor's signature or because the perpetrator is the supervisor. Salaried ghosts are much easier because no time data is needed, which is why salaried positions are preferred by fraudsters.
Step 3 – Issuing the paycheck. Once the ghost exists in the master file and has hours or a salary, the payroll system generates the payment automatically along with the legitimate payroll.
Step 4 – Delivering the paycheck. The perpetrator must obtain the check or direct deposit. With physical checks, the perpetrator often controls distribution or has the check mailed to an address he controls. With direct deposit, the ghost's bank account is one the perpetrator or an accomplice controls, which is why duplicate bank account numbers are a classic red flag.
Ghost employee schemes are most commonly perpetrated by payroll clerks, human resources personnel, or managers with authority to hire and approve payroll, and they can run for years when payroll is never reconciled to an independent personnel file.

2. Falsified Hours and Salary Schemes
In these schemes a genuine employee is overcompensated. The most common method for hourly employees is overstating hours worked. For salaried employees, the method is an unauthorized increase in the pay rate. The ACFE describes several ways hours are falsified:
• Forging a supervisor's signature on a timecard that shows inflated hours.
• Collusion with a supervisor, who approves inflated hours in exchange for a share of the excess pay.
• Rubber-stamp supervisors, who approve timecards without review, allowing employees to inflate hours without any forgery.
• Poor custody procedures, where the employee alters a timecard after it has been approved but before it reaches payroll, or where timecards are left unsecured.
• Time clock manipulation, including 'buddy punching' (a co-worker clocks in for an absent employee) and altering electronic time records.
• Falsified pay rates, where an employee with access to the payroll master file increases his own hourly rate or salary, or a manager grants an unauthorized raise to a colluding subordinate.
Because the employee is real and the paycheck goes to the right person, these schemes often escape notice; only the amount is wrong. They tend to be smaller per period than ghost schemes but are extremely common.

3. Commission Schemes
Commission is compensation calculated as a percentage of sales. Two variables drive it: the amount of sales and the commission rate. A commission scheme manipulates one or both:
• Fictitious sales – the salesperson records sales that never occurred, often to fake customers. The organization pays commission on revenue it will never collect, and the fictitious receivables are later written off or hidden.
• Inflated sales – real sales are overstated in amount, or sales are recorded before they are complete (for example, recording a tentative order as final) to accelerate commission.
• Claiming another salesperson's sales or altering the sales records so credit is misassigned.
• Overstated commission rate – the salesperson, or a payroll employee acting in collusion, changes the rate in the system.
Commission schemes are unusual because the perpetrator is usually in sales rather than accounting, and they frequently leave a trail in accounts receivable: high write-offs, uncollected accounts, and customer complaints about products never ordered.

Red Flags of Payroll Fraud
The exam frequently presents a fact pattern and asks which indicator points to payroll fraud. Memorize the following:
Ghost employee red flags: employees with no withholding taxes, no insurance, or no voluntary deductions; employees who never take vacation or sick leave; duplicate names, addresses, Social Security numbers or bank account numbers; employees with no telephone extension, no email account, no performance evaluation, or no personnel file; paychecks with dual endorsements; employees whose pay continues after the termination date in HR records; a higher number of paychecks than employees on the headcount report; payroll that is never reconciled to the personnel department's records.
Falsified hours and salary red flags: overtime consistently concentrated on a few employees; overtime paid during periods of low production or to employees who do not normally work overtime; timecards signed by the employee rather than a supervisor; unusually high labor cost relative to budget or output; pay rate changes with no authorization form; employees who always clock in and out at exactly the same time or in pairs; a supervisor who refuses to let anyone else approve timecards.
Commission scheme red flags: a salesperson whose commission rises while collections fall; a high ratio of commissions to collected revenue; unusual concentrations of sales to new or unknown customers; sales recorded at period end and reversed afterward; large write-offs or credit memos tied to one salesperson; customer complaints about unordered shipments; commission rates that differ from the approved schedule.

Detection Methods
CFE questions distinguish between detecting a scheme already underway and preventing one. Key detection techniques are:
• Independent payroll distribution (sometimes called a 'payroll parade' or surprise distribution). Paychecks are handed out in person by someone outside payroll, and every employee must present identification. Unclaimed checks identify ghosts. For direct deposit, the equivalent is requiring every employee to confirm identity and bank account details in person.
• Analysis of payroll data using data analytics: search for duplicate SSNs, addresses, bank accounts; employees with no deductions; employees over a certain age or with invalid SSN ranges; post-termination payments; pay dates outside the normal cycle; round-dollar amounts.
• Reconciliation of payroll to personnel records. Every person paid must match an active personnel file maintained by HR, and every termination in HR must correspond to removal from payroll.
• Analysis of deductions. Ghosts often have minimal or no deductions because the perpetrator wants the maximum net pay and does not want benefit elections that would require paperwork.
• Overtime trend analysis. Compare overtime by employee, department and period against production, revenue or budget. Investigate outliers.
• Review of pay rate changes. Compare the current payroll master file to a prior period and investigate every change against authorized personnel action forms.
• Commission verification. Recalculate commissions from the approved rate schedule; compare commissions to collected (not just booked) sales; confirm sales directly with customers; analyze write-offs and credit memos by salesperson.
• Horizontal and vertical analysis of payroll expense as a percentage of revenue or against prior periods, and a comparison of budgeted to actual labor cost.
• Physical observation of employees on site and comparison to the payroll register.

Preventive Controls
• Segregation of duties. The functions of hiring (HR adding an employee to the master file), timekeeping and approval of hours, payroll processing, signing or releasing payments, and distributing paychecks should be performed by different people. No single person should be able to add an employee and also approve or distribute that employee's pay.
• Personnel department controls. HR, not payroll, should add new employees, process terminations and authorize pay rate changes, and these actions should require supporting documentation and management approval.
• Supervisory review of time records with sign-off before timecards are sent to payroll, and secure custody of approved timecards so they cannot be altered afterward.
• Automated time and attendance systems with biometric or badge controls to prevent buddy punching, and system edits that flag excessive hours.
• Approval limits for overtime and exception reports for overtime above thresholds.
• Independent review of the payroll register by someone outside payroll before payments are released, including comparison of headcount to the prior period.
• Commission controls: pay commission only on collected sales or after a delay allowing returns, require customer verification for new accounts, and have someone other than the salesperson approve sales credits and write-offs.
• Periodic surprise audits of payroll by internal audit.

How to Answer CFE Exam Questions on Payroll Fraud Schemes
CFE questions in this area are usually one of five kinds: classification, mechanics, red flags, detection, and prevention. Here is how to approach each.

Classification questions give you a scenario and ask what type of scheme it is. Ask yourself: Is the false payment disguised as compensation? If yes, it is a payroll scheme. Then ask: Does the person being paid actually work there? If not, it is a ghost employee scheme. If the person is real but the hours or rate are wrong, it is a falsified hours and salary scheme. If the amount depends on sales, it is a commission scheme. Be careful with distractors: a fake vendor invoice is a billing scheme even if the vendor is a relative of a payroll clerk; a false mileage claim is an expense reimbursement scheme even though it is paid alongside payroll; a stolen paycheck that is forged and cashed is check tampering, not a payroll scheme, because no false claim for compensation was made.

Mechanics questions test the four steps of a ghost employee scheme or the methods of falsifying hours. Remember that the ghost scheme is more likely to succeed with a salaried ghost (no timekeeping needed), with a former employee kept on payroll (no new hire scrutiny), and when the perpetrator controls distribution. Remember that falsified hours most often involve forging a supervisor's approval, colluding with a supervisor, or exploiting a rubber-stamp supervisor.

Red flag questions ask which fact is the strongest indicator. Prefer the answer that is specific to payroll fraud (no deductions, duplicate bank accounts, no vacation taken, overtime inconsistent with production) over general indicators (employee living beyond means) unless the question clearly asks about behavioral red flags.

Detection questions ask which procedure is most likely to uncover a given scheme. Match the scheme to its signature test: ghost employees are found by independent paycheck distribution and reconciling payroll to personnel files; falsified hours are found by overtime analysis and timecard review; commission schemes are found by comparing commissions to collections and confirming sales with customers. If the question says 'most effective' or 'best', choose the procedure that directly tests the attribute the fraud falsifies.

Prevention questions ask which control would have prevented the fraud. The answer is almost always some form of segregation of duties or independent authorization. Identify which incompatible duties the perpetrator combined and choose the option that separates them. For ghosts, separate HR hiring from payroll processing and from distribution. For falsified hours, require supervisory approval and secure custody of approved time records. For pay rate fraud, require HR authorization of rate changes with an independent review of master file changes. For commissions, require independent verification of sales and tie commissions to collections.

Exam Tips: Answering Questions on Payroll Fraud Schemes
• Know the three current sub-types cold: ghost employee, falsified wages (hours and salary), and commission schemes. If workers' compensation appears, recognize it as a legacy payroll classification now generally treated as insurance fraud.
• Memorize the four steps of a ghost employee scheme: add the ghost, collect timekeeping information, issue the paycheck, deliver the paycheck. Exam questions often ask which step is most difficult or which control interrupts which step. Delivery is where distribution controls work; adding the ghost is where HR segregation works.
• Salaried ghosts are easier than hourly ghosts because no timecard is needed. Expect a question on this.
• Terminated employees left on the payroll are the most common form of ghost. The control is prompt communication of terminations from HR to payroll and reconciliation of the two.
• 'No deductions' is a classic ghost indicator. If a question lists an employee with no taxes withheld, no benefits and no vacation taken, think ghost.
• Duplicate direct deposit account numbers are the modern equivalent of dual-endorsed checks. Both indicate one person receiving multiple employees' pay.
• Independent paycheck distribution is the textbook detection method for ghosts. If it is an answer choice in a ghost employee question, it is very likely correct.
• Rubber-stamp supervisor is the ACFE's term for a manager who approves timecards without review. Recognize it as a cause of falsified hours, and recognize that the control is genuine supervisory review, not merely a signature.
• Overtime analysis is the signature detection test for falsified hours. Compare overtime to production, budget and prior periods.
• Commission schemes are about two variables: sales amount and commission rate. If sales are fictitious, look to accounts receivable (uncollected accounts, write-offs). If the rate is wrong, look to the payroll master file.
• Pay commissions on collections, not bookings, is the key preventive control for commission fraud.
• Segregation of duties is the default prevention answer. When unsure, pick the option that separates adding employees (HR) from processing payroll from approving time from distributing pay.
• Distinguish payroll from neighboring schemes. Vendor payment = billing; employee business expense = expense reimbursement; forged or intercepted check = check tampering; false compensation claim = payroll. The exam loves these distinctions.
• Read for the word 'most'. Many answer choices are plausible controls or tests; the correct one is the one aimed precisely at the falsified attribute in the question.
• Watch for collusion. If the scenario involves a supervisor and subordinate working together, remember that collusion defeats normal segregation of duties, so the best answer may be an independent review, data analytics or surprise audit rather than a routine approval control.
• Apply the Fraud Triangle when asked why. Payroll clerks and HR staff with unsupervised system access have opportunity; questions about root cause typically point to weak oversight rather than to pressure or rationalization alone.

Summary
Payroll fraud schemes are fraudulent disbursements disguised as compensation. They take three forms: ghost employees (paying someone who does not work there), falsified hours and salary (paying a real employee too much), and commission schemes (inflating the sales or rate on which commission is based). They persist because payroll is large, repetitive and controlled by few people. Detection relies on reconciling payroll to independent personnel records, independent paycheck distribution, data analytics for duplicates and missing deductions, overtime and pay rate trend analysis, and verification of sales behind commissions. Prevention relies on strict segregation of duties among hiring, timekeeping, processing and distribution, with HR as the gatekeeper for additions, terminations and rate changes. On the exam, classify the scheme by asking whether the false claim is for compensation and whether the payee is real, match each scheme to its signature red flag and detection test, and default to segregation of duties for prevention questions.