Payroll Fraud Investigation: How Employers Uncover and Prove It

A payroll fraud investigation starts with one rule: preserve the records before anyone knows you are looking. Export the payroll registers, timesheets, change logs and bank records, limit who can edit them, and only then work out who benefited and how. Done in that order, you keep evidence that can support HR action, a civil claim or a police referral. Done in the reverse order, the person responsible often gets to tidy up first.

This guide is for owners and finance managers who suspect that money is leaving through payroll. It covers the schemes to look for, the evidence that matters, the legal limits on watching staff, and the point where outside help pays for itself. Because we are asked about it regularly, it also explains how the same record-tracing and surveillance skills apply when our work moves from the office to finding missing children.

Pi melbourne

Investigate Suspected Payroll Fraud

Pi Melbourne conducts corporate fraud inquiries, using customized investigations to address specific client concerns and gather expert evidence.

Explore investigative services

TL;DR

Payroll fraud means manipulating pay records to take money you are not owed: ghost employees, padded hours, altered rates, diverted direct deposits and unremitted payroll taxes.
Tips detect 43% of fraud cases, while automated monitoring detects 3%. A safe reporting channel beats another software license.
Secure records first, keep the disciplinary and criminal tracks separate, and check privacy rules before you put anyone under surveillance.
Delay is expensive. Cases found by law enforcement run longer and cost far more than cases found internally.
We run corporate fraud inquiries and also locate missing persons and recover children, using the same disciplined evidence methods.

What counts as payroll fraud
Warning signs worth checking first
How payroll fraud is usually found
The first 72 hours: a step-by-step response
Evidence that stands up
Watching staff lawfully
Internal action or a police report?
When to hire a private investigator
Our perspective
From payroll files to finding missing children
Working with us on a payroll inquiry
Preventing the next case
FAQ
Sources

What counts as payroll fraud

Payroll fraud is the deliberate manipulation of payroll records to obtain money from an employer. It rarely looks dramatic. It looks like a slightly high total, an employee nobody remembers hiring, or a bank account that appears on two pay records.

The common schemes are:

Ghost employees. A fictitious or departed person stays on the payroll and the pay goes to an account someone controls.
Timesheet padding. Real employees, or the people approving their time, claim hours that were not worked.
Rate and commission manipulation. Someone with system access raises a pay rate, a bonus or a commission calculation.
Diverted direct deposits. Banking details are changed so a legitimate employee’s pay lands elsewhere, often after a phishing email to the payroll team.
Tax and withholding fraud. Withheld employment taxes are not passed on. In the United States, 26 U.S.C. § 7202 can apply where the failure is willful and there was a legal duty to remit.

Payroll fraud is not a single federal offense. The same set of facts can lead to wire fraud, tax or false-record charges depending on what happened, which is another reason to document carefully before you accuse anyone.

Warning signs worth checking first

No single sign proves anything. A cluster of them justifies a closer look.

Employees on the roster who no manager can place, or who never take leave, never appear in meetings and never submit expenses.
Two or more employees sharing a bank account, address or tax identification number.
Overtime that is consistently high for one team or one approver, with no matching workload.
Payroll changes made outside normal hours, or by a user who does not usually make them.
Total payroll cost that drifts away from headcount and budget without a clear reason.
A payroll employee who resists vacations, handovers or audits.
Employees reporting that pay or tax forms do not match what they expected.

Washington’s State Auditor makes the same point in its guidance on payroll risks: strong internal controls with enough monitoring are the best defense, and that means someone other than the person who processes payroll reviewing it.

How payroll fraud is usually found

Most owners assume software or an audit will catch it. The data says otherwise. Using figures from the Association of Certified Fraud Examiners, a restaurant fraud analysis breaks down how occupational fraud comes to light:

Detection method	Share of cases
Tips	43%
Internal audit	15%
Management review	13%
Document examination	5%
Account reconciliation	5%
By accident	4%
Automated monitoring	3%
External audit	2%
Law enforcement	2%

The lesson is uncomfortable for anyone who has spent heavily on controls. If you rely only on automated reports, you will miss most fraud. The people who notice are colleagues, and they speak up only when they trust the channel. FirstHR’s small business guide makes the same case: the vital control is a credible environment where staff feel safe coming forward without fear of retaliation.

A good channel is cheap. It needs a route that does not run through the employee’s own manager (an outside director, an external hotline or a named person in finance), a clear statement that retaliation will not be tolerated, and a leadership team that visibly acts on reports.

Software still has a role. Analytics can flag payroll values far from the expected range, but a person should verify each flag, so the process stays proportionate and fair.

The first 72 hours: a step-by-step response

When a tip or an anomaly arrives, speed matters and so does restraint.

Preserve records. Export payroll registers, employee rosters, timesheets, system change logs and bank records for the whole period in question, as FirstHR advises. Store copies somewhere the suspect cannot reach.
Limit access quietly. Adjust permissions through routine-looking changes rather than an announcement.
Write down what you know. Record who reported what, when, and exactly what you observed. Keep opinion out of the notes.
Bring in only those who need to know. The wider the circle, the greater the chance the suspect hears of it.
Decide who investigates. A small internal team with no link to the suspect can do the first pass. Anything involving covert observation, interviews that may become evidence or complex financial tracing usually calls for specialists.
Plan the interview last. Confront nobody until the documents tell you what to ask.

Evidence that stands up

A suspicion becomes a case when documents and data line up. Typical evidence includes payroll registers, employee rosters, tax forms such as 941s and W-2s, bank records and timekeeping data. Federal payroll investigations often begin with unpaid employment taxes, inaccurate Forms 941, off-the-books wages or false employee records.

For each item, keep a chain of custody: who exported it, when, from which system, and who has handled it since. A spreadsheet someone “cleaned up” is far weaker than a raw export with a timestamp.

In large conspiracies, documents are not enough. The Australian Plutus Payroll case, which involved the misappropriation of around $105 million in tax funds, relied on intercepted communications and video surveillance to show intent. Most employers will never face a case of that scale, but the principle holds at every size: intent is proved by behavior, and behavior is captured by records and, sometimes, by lawful observation.

Keep the tracks separate

Professional investigators run the disciplinary inquiry and the criminal inquiry separately. Mixing them can damage both: an HR interview conducted without proper safeguards can taint evidence that police would need, and a police-style approach can breach employment fairness. Decide early which outcome you are pursuing, and write down why.

Watching staff lawfully

Covert monitoring is where well-meaning employers create their own legal problems. Rules differ by country and state, so check yours before you act.

In Victoria, Australia, for example, the Office of the Victorian Information Commissioner explains that where an employer has reason to suspect unlawful activity, the privacy principles may permit using or disclosing an employee’s personal information as a necessary part of investigating it. That depends on having reasonable grounds, not a hunch, and organisations are often expected to complete a privacy impact assessment before running a monitoring program. In the United States, state laws on recording, workplace monitoring and background checks vary, so speak to an employment lawyer before you install anything.

Two practical rules apply anywhere:

Write down your grounds for suspicion before surveillance begins.
Use the least intrusive method that answers the question. Reviewing system logs comes before following a person.

Internal action or a police report?

Many employers choose to handle fraud themselves. According to the ACFE’s 2020 findings, about 46% of organizations that did not refer a case to law enforcement said internal discipline was enough. That is a legitimate choice for small losses and first offenses, but it has costs. Without a referral, the person can move to the next employer and repeat the scheme, and your insurer or lender may expect a report.

Timing matters more than the route. Cases that come to light through law enforcement typically run about twice as long, with median losses near $890,000, compared with much smaller losses when the business catches the problem itself. Early internal action limits exposure.

When to hire a private investigator

You do not need an investigator to compare a payroll register with a roster. You do need one when:

The suspect is senior, or controls the systems you would use to investigate.
You need lawful covert observation, for example to show an employee claiming hours or leave while working elsewhere.
The money has moved and you need to trace hidden assets.
You want evidence prepared to a standard a court or tribunal will accept.
The fraud connects to an insurance or compensation claim. In Victoria we handle WorkCover fraud investigations.

Our perspective

We have been running investigations since 2006, with a team that includes former police, ex-military personnel and polygraph specialists. The pattern we see in payroll cases is consistent: the fraud is found late, the first response is emotional, and the evidence is weaker than it should have been because someone confronted the suspect too soon.

Our advice is plain. Treat the first week as evidence preservation, not accusation. Keep your questions neutral. Let the documents show the pattern, and only then consider surveillance, which we plan to the specific scenario rather than from a template. Every investigation we run is tailored, because a ghost employee scheme in a 30-person firm and a rate manipulation inside a large corporate department call for different work.

The discipline is also what makes us useful in the most serious cases we take. Following money through accounts and records, documenting movements, and building a file that stands up in front of a decision maker are the same skills we use when a family asks us to find someone.

— Global

From payroll files to finding missing children

Our work is not limited to the workplace. We also take on missing persons and child recovery, and families contact us from many countries. Cases involving a missing child are not like payroll fraud in their stakes, but they share a method.

Records first. As with payroll, we start with what can be documented: travel and communications history, financial traces, known associates and last confirmed locations.
Lawful, proportionate surveillance. Observation is planned around a clear objective and the rules of the place where it happens.
Evidence for decision makers. Whether the audience is a family court, a prosecutor or the authorities in another country, the file has to be clear and dated.
Working with the authorities. When a child is missing or at risk, the police should be contacted immediately. A private investigator supports that effort. It does not replace it.

If a child has been taken or is missing, do not wait for the situation to resolve itself. Tell the police, gather recent photos, passport details, devices and any messages, and then contact us about our child recovery and missing persons services. We tailor each case to the child’s circumstances and the countries involved.

Working with us on a payroll inquiry

If you suspect payroll fraud, we can review your records with you, plan an inquiry that keeps disciplinary and legal options open, and gather court-ready photos and video where surveillance is justified. Surveillance is published at a one-off price of $1,000 to $1,450; see how our pricing works. Other services, including corporate investigations, are quoted to the case.

Preventing the next case

After an incident, fix the conditions that allowed it.

Separate duties: the person who adds employees should not approve their pay or reconcile the bank account.
Verify every new hire and every change of bank details by a call to a known number.
Run surprise reviews of the roster against HR records and actual attendance.
Review change logs monthly, looking for edits outside normal hours.
Publicize your reporting channel twice a year and show that reports lead to action.

FAQ

What constitutes payroll fraud?

It is any deliberate manipulation of payroll records or payments to take money the person is not entitled to. Examples include ghost employees, inflated hours, altered pay rates, redirected direct deposits and withheld taxes that are never remitted.

What evidence is needed to report payroll fraud?

You need records that show the discrepancy and who made it: payroll registers, rosters, timesheets, system change logs, bank statements and tax forms. Keep original exports with dates and a note of who handled them. Authorities will want facts rather than conclusions, so avoid editing or annotating the originals.

What is the most common way to detect fraud?

Tips. In the ACFE data summarized above, tips led to detection in 43% of cases, far ahead of internal audit at 15% and automated monitoring at 3%. A safe, non-managerial reporting channel is the most valuable control a small business can add.

Can I put an employee under surveillance?

Sometimes, but only with reasonable grounds and within the privacy and surveillance laws that apply where you operate. Take legal advice first, document why you suspect wrongdoing, and use the least intrusive method that works.