'Ghost' Employees May Be Haunting Your Workplace



Who You Gonna Call?

No one likes to get spooked … especially an employer that is being haunted by "ghost" employees, who can bleed an organization of thousands—or even millions—of dollars.

Ghost workers are employees on paper only, are deceased but still on the payroll or are real people who are not employed at the organization that's doling out paychecks to them. The last of the three types typically splits the ill-gotten gains with someone inside the organization who is perpetrating the fraud.

Whatever form a ghost employee takes, it's a way to steal money from a company, said L. Burke Files. Files is president of Financial Examinations & Evaluations in Tempe, Ariz., and he has seen ghost employees materialize at the hands of business owners as well as crooked bookkeepers and accountants.

People who create ghost employee accounts typically make up more than one fake persona, according to Files. 

"All fraud begins small and grows over time, like a weed in an untended garden," he said. "A thief looks to steal as much as [he or she] can without being noticed. … Fraud creates an appetite that cannot be satiated."

He recalled a bookkeeper for an oncology practice who ripped off $260,000 from her employer in 18 months by creating three fake employees and seven fake vendors. The medical practice discovered the theft when an advisor to medical practices and small hospitals raised a question. The advisor called Files after noticing that while the oncology office hit all its financial goals, it had unusually high expenses.

When Files learned that the bookkeeper never took a day of vacation in three of her five years on the job, alarm bells went off in his head.

"She's the only one in charge of the books … she's staying there to make sure no one finds out her fraud," Files said.

Beware of These Scary Situations

The crooked bookkeeper is an example of how one person operating with no oversight can perpetuate payroll fraud. Often, companies eliminate redundant positions to reduce costs, he noted, but by doing so lose the very mechanism that can detect fraud.

"We're automating more and more things and ending up with a single point of control, which becomes the single point of risk."

[SHRM members-only toolkit: Complying with Employment Record Requirements]

Having a system of checks and balances is an important theft deterrent, said Mason Wilder, certified fraud examiner and a research specialist at the Association of Certified Fraud Examiners (ACFE) in Austin, Texas. Prior to ACFE, he worked in corporate security intelligence and investigations for seven years.

"It's just a great organizational practice to have a separation of duties, especially when it comes to the departments that handle money and authorized payment. You might not want the person with access to blank checks to also be the authorized payer. You want to split up those functions as much as you can," Wilder said.

Other factors may contribute to fraud.

It's easier for ghost employees to exist when a business supports a workforce in remote locations, according to Scott Bales, vice president of solution engineering and delivery at Replicon—an information technology and services firm in Redwood, Calif.

"The remote nature [adds] a layer of cover to these types of ghost employees" involving a third party, Bales said.

He recalled a Fortune 500 company that used a vendor to administer payroll in different countries. At one location, the vendor wrote and delivered a check to a ghost employee every month for years, with the vendor keeping a portion of the proceeds. 

Red Flags

It's difficult to put a number on how widespread ghost employees are, ACFE's Wilder said, because many companies do not report to authorities fraud that occurs within the organization. However, based on ACFE's Report to the Nations, which is a compilation of survey responses from its members, payroll fraud is more common in the U.S. than in other regions. 

Tips are the most common way employers learn of fraud, according to the ACFE. Slightly more than half of those tips come from employees. Telephone and e-mail hotlines and a web-based tip form are the more popular reporting mechanisms that employers provide.

The ACFE suggests that employers, to protect themselves, pay attention to five categories of red flags:

• Employee information anomalies. An employee's Social Security number (SSN) is not listed, or multiple employees have the same SSN; an employee doesn't have any deductions—for taxes or benefits—coming out of the paycheck; or there are multiple address changes within a year or so.  
  
• Payroll-register anomalies for direct deposits. The same bank account number is used for multiple employees, potentially indicating a ghost employee's paycheck is being deposited into the same account another employee uses. Multiple bank accounts for one employee's paycheck could potentially indicate that a ghost employee's paycheck is being split between co-conspirators, Wilder said.
  "There is potential for overlap between the two, but they are also distinct red flags," he noted.
• Payroll-check anomalies. Multiple checks are issued to an employee within one pay period, or an image of the payroll check shows it was endorsed by someone with a name different from the payee's.  
  
• Bonus or pay-increase anomalies. An employee receives a bonus at a time different from the company's typical bonus distribution, or an employee receives multiple pay increases within one year.
  
• Employee time-off trends. An employee hasn't taken any paid time off or sick leave for an entire year, or the person processing payroll never takes vacation. Forced vacations or rotation of duties are an effective control, Wilder said. 
  

But tread quietly while investigating, Files cautioned. 

Preventive Actions

Feeling a little frightened? Don't be. Absent a "Ghostbusters" Proton Pack, Files suggested the following preventive actions to help keep your workplace free of mischievous spirits: 

1. Implement hiring protocols that include checking the candidate's SSN and driver's license. 
   
2. Periodically run all employees' SSNs through the Social Security Administration website—especially of those working in sensitive positions—and follow that up with a background check. Other websites for checking employee identification include E-verify or the IRS website.
   
3. Have a checks-and-balances system for hiring and payment. 
   "For fraud or error to occur you have to have a single point of control," Files said.
   
4. Use a payment system that requires employees to identify themselves. If this involves using an electronic swipe system, scrutinize whether the same two people consistently swipe their cards at about the same time. This could indicate that someone is swiping a second person's badge without the second person reporting to work. 
   
5. Scrutinize how consistent employees' hours are. If the hours never vary, it could be a red flag signaling a ghost employee because the fraudster wants "to make sure no one looks at this person," Files said.
   
6. Be suspicious if someone requests paper checks in lieu of automatic bank deposits and if a personnel folder contains scant information on a so-called employee. 
   

Wilder suggests employers conduct regular audits—such as comparing payroll files against the master employee file—even if there are no red flags.