Ghost Employees and Unauthorized Pay Changes: Review Suspicious Payroll Records
An unfamiliar name on a payroll register deserves a specific question: which employment record and authorized earnings instruction explain this payment? Ask that before anyone calls the person a ghost employee or starts changing the record. The answer could be missing documentation, a payroll error, a legitimate payment after employment ended, or an unauthorized transaction.
Investigate the particular worker, earning and change path together. A real employee can receive an unauthorized allowance. A former employee can still be owed wages. A perfectly balanced payroll can contain a payment nobody authorized. The useful decision is what the evidence supports, who must resolve the remaining question and how the upcoming payday will be handled lawfully.
Use a questioned employee or earning as the starting point for this U.S. review. The Payroll Record Challenge Board organizes the payroll, HR and finance evidence needed to explain it. Fictional situations show how the decisions differ. Bank-destination authentication, criminal findings and employee disciplinary decisions require their own processes; the board does not determine them.
Employee setup and earning changes need records a reviewer can examine. Write those missing records into the brief for SelectSoftware Reviews' free consultation: employee authorization, changed values, effective dates and the origin of an import. Providers should demonstrate the evidence you list.
Table of contents
Name the inconsistency before deciding what it means
Ghost employee fraud involves wages or benefits directed through a nonexistent employee record, as described by the Association of Certified Fraud Examiners. A payroll review should also consider records for real people whose employment or particular payment is unsupported. Those situations can look similar in an exception report while requiring different evidence and responses.
Write an observable statement: “Employee reference E-184 appears in this run, but HR has not located the hiring authorization,” or “The preview includes a recurring allowance absent from the approved compensation record.” Avoid assigning motives in the operational worklist. A description another reviewer can reproduce is more useful than a label such as suspicious employee.
Separate an identity question from an entitlement question. Confirming that a person exists does not establish that the employer hired them, that they worked the reported hours or that the stated rate applies. Conversely, an inactive employment status does not establish that every later payment is wrong. Identify the earning period, payment purpose and relevant authorization before drawing a conclusion.
Give the concern an owner outside the questioned transaction's entry and approval path where possible. If the same person created the employee, entered the earning and supplies every explanation, seek a reviewer with access to independent source evidence. In a small team, this may be an owner or appropriately qualified external reviewer. Record any remaining independence limitation.
The 2025 GAO Green Book emphasizes preventive controls and attention to fraud and improper-payment risk. It is a federal internal-control framework, rather than a universal private-employer rule. Its practical lesson here is to design a review that can challenge an unexplained payment before release and can detect an exception that has already passed through.
Build a comparison with a separate source of authority
Start with a defined population: the employing entity, payroll group, pay period, run identifier and extraction time. Obtain the employee roster, earning detail and relevant changes using authorized access. Check that filters include the records you intend to review, such as reactivated employees, manual payments and supplemental runs. A report excluding inactive workers cannot answer whether an inactive worker was paid.
For employment, use the organization's authorized hiring, assignment and separation records. For pay, use approved compensation terms, effective dates and applicable time or earning instructions. For processing, obtain the history showing how the record reached payroll. Identify which system owns each fact. A payroll profile's current value explains what is configured; the approval record explains why it was permitted.
Two reports copied from the same unverified feed can repeat the same mistake. Trace the questioned fact far enough upstream to find its authority. For example, compare a new worker with the approved requisition and hiring record, then obtain confirmation from the responsible HR or operational owner through an established channel. Preserve disagreements between sources until someone resolves them.
Use stable employee references for matching and treat name differences as questions to resolve. Rehires, legal-name changes, transfers between entities and duplicate legacy records can complicate a comparison. Document the matching rule and any manual resolution. A fuzzy-name match can help find candidates, but it should not silently combine two people or establish that a record is fraudulent.
Limit the review copy to necessary information. An authorized specialist may need full records in a restricted system; a shared action list can usually use an employee reference and secure evidence location. Avoid distributing bank details, tax identifiers or unrelated medical information to everyone helping with the review. Access to an exception report should follow the task each person actually performs.
Establish completeness as well as accuracy. Compare the number of selected records and relevant earning totals with the run being reviewed, and account for excluded groups. Then reconcile the specific exceptions. A reviewer who checks five conspicuous rows still needs to know whether an import, off-cycle run or employing entity was omitted from the population.
Include recurring earnings that were already present before the review window. A change report can show no new event while an unsupported allowance continues to generate payments. Compare the active earning setup with its authority and intended end date, then inspect the affected runs. Document why a recurring item remains valid instead of assuming that a value carried forward from the previous payroll was previously approved.
Follow the questioned fact back to its authority. Two exports from one unverified feed can reproduce the same error.
Four alerts that need different follow-up
A paid worker is absent from the expected roster. Check whether the roster reflects the correct entity, effective date and employment population. A transfer, recent hire or rehire might be missing from a stale extract. Obtain the underlying employment authorization and identify who supplied the payroll record. A manager's unfamiliarity with a remote worker is a prompt to locate the responsible owner, not a finding about the worker.
If authorized HR and operational owners cannot substantiate the relationship, retain the original record and refer the unresolved discrepancy through the employer's fraud or investigation process. Record what was checked and what remains missing. The payroll team can describe an unsupported relationship without deciding whether someone committed a crime or choosing an employment sanction.
Pay continues after a separation date. Identify the services or obligation the payment covers. Final wages, an approved bonus, a correction for an earlier period or another authorized payment can appear after a person stops working. Compare the earning dates and approval with the separation record. An automated rule that treats every post-separation payment as fraud will misclassify legitimate obligations.
Then check for continued recurring salary, allowance or scheduled hours that nobody intended to pay. Distinguish an authorized later payment from an active default that should have stopped. Assign any final-pay or correction question to the appropriate reviewer, preserving the original effective dates. Changing the separation date merely to make the exception disappear damages the explanation.
Several workers share an account or contact detail. A shared destination, address or telephone number may identify a relationship worth examining, but the match alone does not establish a ghost employee. Confirm the people and their employment independently. Keep the bank-instruction review separate, using the employer's approved authentication process instead of treating an account comparison as proof of authorization.
Use restricted matching where available and share only the result needed for review. Do not email a complete bank-account list to managers for them to inspect. If the same administrator created several questioned records, examine the creation and approval sequence as a group while retaining a separate explanation for each employee and payment.
A rate, allowance or additional earning lacks support. Compare the exact amount, unit, recurrence and effective period with the approved instruction. A rate increase may be genuine but applied too early; a one-time award may have been configured to recur; an imported earning may have bypassed the ordinary approval path. Each explanation leads to different corrective work.
Examine additions as well as headline salary. An unchanged base rate can coexist with an unauthorized recurring allowance or inflated hours. Review the channels capable of creating those amounts: employee maintenance, time imports, bulk uploads, integrations and manual runs. Ask what actually changed in the affected run and which authorization covers that version.
Use the Payroll Record Challenge Board
Create one case for each questioned worker-and-earning combination. Keep related cases under a shared incident reference when appropriate. Copy the five panels below into a restricted document or case system. Each panel asks for a comparison and its consequence, so the board remains useful when one person is legitimate but a particular earning is not supported.
Panel 1: State the observed mismatch. Record the entity, employee reference, run, earning and period. Write the exact inconsistency and how it was found. Save the original roster or preview reference with its extraction time. Leave the explanation open until evidence supports it. This panel should let another reviewer locate the same row without exposing unnecessary personal identifiers.
Panel 2: Challenge the employment basis. Identify the authorized employment or assignment record and its owner. Record what independently confirms that this employer owes the person the relevant payment. Explain any rehire, leave, transfer or separation timing. Mark the basis Supported or Unresolved and identify the particular missing evidence. Current payroll status alone is insufficient to complete this panel.
Panel 3: Challenge the earning and its timing. Compare approved amount, unit, recurrence and effective date with the preview or actual earning. Record both values and the source of authority. Include hours or other source quantities when they drive the amount. Mark the result Matched, Error identified or Unresolved. Document the difference without treating every difference as deliberate misconduct.
Panel 4: Reconstruct the change route. Identify who or what created the record, the prior and replacement values, the event time, approval reference and import or interface involved. Record whether the reviewer can examine evidence independent of the person making the change. A service-account name may identify the integration; continue the inquiry to the source instruction and responsible operator when needed.
Panel 5: Record two decisions and the follow-up. First choose the evidence outcome: Explained and supported, Payroll error for correction, or Unresolved and referred. Separately record the authorized payroll action, decision maker, affected payment status and applicable deadline review. Name the investigation or correction owner and next review date. Keep the evidence outcome distinct from a legal or disciplinary conclusion.
Use these outcomes consistently. Explained and supported requires evidence resolving the original mismatch. Payroll error for correction identifies the authorized value, correction route and verification task. Unresolved and referred preserves the unanswered question, evidence and referral owner. None of these labels independently authorizes withholding earned wages, reversing a bank payment or deducting a suspected loss.
Close the board only when the assigned action has a verifiable result. If payroll was corrected, attach the actual corrected output. If a legitimate explanation was accepted, retain the supporting authority and review. If a separate investigation continues, record who accepted that handoff and what payroll must monitor; an unanswered referral email is not a completed transfer of responsibility.
Missing change records can prevent a reviewer from resolving an exception. In SelectSoftware Reviews' free consultation, distinguish an export you cannot retrieve from an approval the service never captured. That distinction helps you ask replacement providers for the right demonstration.
Work an early rate increase through the evidence
Consider a fictional employee, Morgan, whose approved hourly rate rises from $24 to $26 effective October 19. A payroll preview for October 12 through October 18 uses $26 for forty straight-time hours. Assume no overtime, other earnings or adjustments in this simplified example. The preview shows $1,040 gross; the approved rate for those hours produces $960, a difference of $80 before taxes and other items.
The employment panel is supported: HR has Morgan's current employment record and the operational owner confirms the assignment. The earning panel identifies a timing error because the approved increase begins after the reviewed service period. The change history shows an import carrying the new rate without its future effective date. Those facts support a payroll correction and an interface review; they do not establish fraudulent intent.
Before release, the authorized team corrects the affected input under its change process and checks a new preview against the approved terms. The case records the replacement preview and the person verifying it. The integration owner then checks whether other future-dated changes in the same batch lost their dates. A correct Morgan row does not establish that every other row in the batch is correct.
Now change one fact: no authorized compensation owner can substantiate the $26 instruction, and the payroll administrator also entered and approved it. The case becomes unresolved and referred. Preserve the submitted instruction, history and preview, and have the designated independent owner determine the next steps. Avoid asking the questioned administrator to supply the only independent confirmation of their own transaction.
If payment has already occurred, record that status explicitly. The $80 arithmetic difference is evidence for review, not permission to collect it from Morgan's next paycheck. Have the responsible payroll and legal reviewers determine the correct treatment, reporting consequences and any lawful recovery process from the actual facts. Keep that payment decision separate from the work needed to repair the import.
When reviewing several affected runs, keep each original gross amount, supported amount and difference visible. Do not offset an unexplained overpayment on one employee against an underpayment on another to report a smaller net exception. The employees, payment dates and correction decisions differ. The aggregate helps the case owner understand exposure; the individual records supply the facts needed to resolve each payment correctly.
The approved effective date separates this period from the later rate. The gross difference identifies a review item, with recovery decided separately.
Protect payday while the concern is investigated
Route an approaching payment deadline to the person authorized to make the wage-payment decision. The Department of Labor's guidance states that wages required under the FLSA are due on the regular payday for the pay period. Applicable state wage-payment rules and the particular circumstances also need review. An unresolved internal investigation should not quietly become a payroll operator's decision to delay an entire payment.
Describe the precise issue and the amounts or records affected. Identify what has been established, what remains disputed and whether payment is only previewed, submitted or completed. Ask the responsible reviewer to document the lawful action and its deadline. Where an approved alternative is available, retain the evidence for that choice and verify its execution. Do not assume a submitted instruction can still be stopped.
Keep financial recovery under separate authority. DOL guidance restricts deductions for employer shortages to the extent they reduce required minimum wages or overtime pay, and other applicable rules may be stricter. A signed payroll adjustment, an investigation finding and an employee's repayment arrangement can raise different questions. Obtain the required review before making deductions or initiating payment reversals.
Communicate factually with the employee through an established channel when the authorized process calls for contact. Ask for the specific information needed to resolve the payment, state who will respond and avoid broadcasting an allegation to their manager's wider team. An employee questioning an unexpected pay change may be helping identify the control failure. Preserve their account alongside the system evidence.
If a payroll user or integration may be compromised, involve the designated security owner promptly. Have that owner preserve relevant evidence and decide the appropriate access-containment action. Identify how payroll can continue through an authorized route. Uncoordinated credential changes, record deletion or repeated reprocessing can complicate both the evidence and the next payment.
Repair the route while preserving the original record
Retain the original employee and earning versions, the source instruction, available history, approval evidence, reviewed outputs and referral decision. Record who collected each item, when and from which system. Save exports in the approved restricted location with enough context to interpret time zones, effective dates and report filters. A screenshot can supplement a case, while an available structured history may supply details the screenshot omits.
Follow the employer's retention schedule and any applicable preservation direction. DOL Fact Sheet #21 describes at least three years for payroll records and two years for records supporting wage computations under its FLSA rules. Other obligations or an investigation hold can require longer retention. Those periods do not justify deleting a relevant record while an authorized preservation requirement applies.
Choose a repair tied to the demonstrated failure. An unapproved new-worker import may require independent employment confirmation before activation. A recurring earning created from a one-time award may require a recurrence check. A privileged administrator who can enter and approve the same sensitive change may require permission changes or a documented independent review. “Retrain payroll” is incomplete when the bypass remains available.
Test the repair with safe, synthetic scenarios through the supported process. Include the route that actually failed, such as a bulk import or administrator override. Confirm that the new check applies there and that the reviewer can retrieve its evidence. Record what was demonstrated and what remains untested. Do not enter fictitious employees or payment instructions into live payroll to create an example.
Evaluate the provider's evidence at the same boundary
If the current service cannot expose the necessary records, establish that limitation before choosing another tool. Ask for a demonstration of a new worker, a future-dated rate change, a one-time earning and an administrator correction. Specify which reports the reviewer needs and which roles can retrieve them. The requirement is a reconstructable decision and output, not a feature name on a sales slide.
Check the imports and interfaces as well as the ordinary screen workflow. Ask whether the same approval rules apply, how the originating user is identified, which earlier values survive and how long history remains available under the purchased arrangement. Confirm export and access limitations in current provider documentation or written service terms. These are questions to verify; this guide does not certify a named platform's controls.
Decide who performs the continuing review after outsourcing. A provider may process the records supplied by the employer while the employer retains the hiring and compensation authority. Assign an internal owner to challenge unsupported worker or earning records and obtain the provider's agreed evidence. A processing service and a separate fraud-investigation service are different responsibilities to define in the contract and operating plan.
The work retained by your team belongs in the service comparison. Use SelectSoftware Reviews' free consultation to describe the checks the employer will still perform after processing moves. Ask prospective providers who retrieves the record when an employment or pay instruction cannot be substantiated.
Revisit the affected population after the immediate case
Track unresolved exposure by case, payment status, owner and next action. Review related records when evidence points to a common import, administrator, earning code or approval bypass. Keep that expansion tied to the observed route. A shared address or one data-quality error should not create an indiscriminate investigation of unrelated employees.
At the next appropriate run, verify that the repaired route produces the authorized result and that no later feed restores the questioned value. Reconcile any correction, referral and employee communication still outstanding. Record the outcome that resolves the original inconsistency. The review has done its job when another authorized person can explain why this worker received this earning and can retrieve the evidence supporting that explanation.
Explore the Decision Guides library.
See the Payroll Operations & Controls hub.
About the author
Ben Scott writes and maintains payroll decision guides for founders and operators. His work focuses on execution realities and how decisions hold up under growth, complexity, and controls and documentation pressure. He works hands-on in HR and leave-management roles that intersect with payroll-adjacent workflows such as benefits coordination, cutovers, and compliance-driven process controls.
