The phrase has two meanings. Michigan's Attorney General uses payroll and tax fraud for practices where "employers fail to pay workers the full wages and benefits" they are owed. Everywhere else on this page it means money taken through the payroll, the payroll row in the hub's table of fraud types: ghost employees or inflated hours, with employers as the typical victim.
Payroll fraud schemes compared: who runs each, and what does the pay file show?
Table 1. Payroll fraud schemes, the record that shows each and the check.
| Scheme | Who runs it | What the pay or bank file shows | The check | Source |
|---|---|---|---|---|
| Ghost employee | Staff with payroll system access | A paid name with no worker behind it, or a leaver still paid | Leaver dates against the last pay run | ACFE 2026; SAO |
| Falsified hours (timesheet fraud) | Any employee who records time | Hours or overtime above the approved schedule | Overtime approved before it is paid | ACFE 2026; SAO |
| Pay rate or net pay change | Payroll staff | Net pay rising with no rate change; tax shown but not withheld | Tax withheld reconciled to tax paid over | USAO W.D. Okla. |
| Commission scheme | Staff paid on commission | Commission above the sales it rests on | Commission recalculated from booked sales | ACFE 2026 (fraud tree) |
| Mid month draw not deducted | Staff paid monthly | An advance with no deduction at month end | Each draw matched to a deduction | Washington SAO |
| Leave and benefit scheme | Any employee | Leave taken, accrual balance unchanged | Leave records against accruals | SAO |
| Dual employment | An employee in two jobs | One person on two payrolls for the same hours | Payroll to payroll data match | NFI 2022 to 2024 |
| Payroll diversion | An outsider with a phished login | A bank detail change, then pay to a new account, often a prepaid card | Every bank change confirmed outside the portal | FBI IC3 |
Seven start inside the employer. Diversion starts outside, with a stolen login, and takes pay the employee has earned.
What is payroll fraud, and what counts as a payroll scheme?
The ACFE's Occupational Fraud 2026 defines a payroll scheme as "a fraudulent disbursement scheme in which an employee causes their employer to issue a payment by making false claims for compensation" (p. 106), and gives overtime claimed for hours not worked and ghost employees added to the payroll as examples. The fraud tree splits them into ghost employees, falsified wages and commission schemes (p. 13); false or inflated expense claims are a separate fraudulent disbursement scheme, expense reimbursements. Washington's State Auditor's Office (SAO) files falsified time sheets under falsified wages too.
The ACFE counts only occupational fraud, by people using their own job, so diversion by an outsider falls outside its figures.
What about employers who cheat on payroll?
Michigan's page quotes the Economic Policy Institute on employers that misclassify workers, fail to pay for all hours worked or skip overtime premiums. An employer that withholds payroll tax and never pays it over commits employment tax fraud.
Who commits payroll fraud: staff, payroll insiders or outsiders?
Kim Weinrich was payroll supervisor, later payroll director, at Mustang Public Schools in Oklahoma. From July 2016 she "manipulated the District's payroll accounting software to increase her net pay each pay period", taking about $470,000 by April 2022. She got 18 months for wire fraud and a false tax return (USAO W.D. Okla., 8 August 2025).
From Ufuk Gürdaş, reviewer of this entry: "Reconcile the tax each pay run withheld with the tax the employer actually paid over: Kim Weinrich raised her own net pay for almost six years and made the software show federal tax for her that was never withheld, so the theft sat in the withholding lines, not in a new name on the payroll."
Payroll insiders like her commit a form of insider fraud. Ordinary staff pad hours or hold two jobs: a National Fraud Initiative match showed Barnsley Council one employee on two full time council contracts for 10 months.
In the ACFE's 2026 study, payroll schemes had a median loss of $63,000. They appeared in 13 percent of cases at organizations with fewer than 100 employees and 8 percent at larger ones (pp. 15, 34). Outsiders need only a stolen payroll login.
How does a ghost employee get paid?
Picture a ghost paid $2,500 a month at a large employer (illustrative):
- A leaver stays on the payroll, or someone with access adds a name.
- The bank details on that record point to an account the fraudster controls.
- Each pay run pays the ghost with everyone else. The SAO says this fraud usually occurs where an organization has many employees and weak internal controls.
- Payroll schemes in the ACFE's 2026 study ran a median 13 months before detection, against 12 months for all cases (p. 18). By then the ghost has drawn $32,500.
That pace is about half the ACFE's median velocity for payroll schemes, $4,800 a month (Figure 9, p. 19).
How does payroll diversion reroute a real paycheck?
Here the employee is real and the pay is earned. In a 2018 alert, the FBI's IC3 described criminals who phish employees for their payroll login, change the bank account information and add rules "preventing the employee from receiving alerts regarding direct deposit changes". The pay then goes to an account they control, "often a prepaid card". That makes it account takeover fraud, and in the US also ACH fraud, since direct deposit wages travel as ACH credits.
Payroll fraud red flags: which record shows each one?
- Two pays into one bank account or one address, which the SAO ties to relatives working for the same organization.
- A direct deposit change the employee never saw, because diversion rules hide the alerts (IC3).
- Payroll logins outside normal business hours, which IC3 says to monitor.
- A mid month draw with no deduction from the normal salary (SAO).
- Leave taken, accrual balance unchanged (SAO).
- Overtime with no support or approval (SAO).
- Tax shown as withheld that never was, as in Weinrich's records.
- Pay landing on a prepaid card, where IC3 says diverted pay often goes.
Is payroll fraud a crime? US, UK and EU rules
Yes, when the elements of a criminal rule in Table 2 are met, its intent test included. The Nacha row is a private network rule.
Table 2. Payroll fraud law in the US, UK and EU.
| Jurisdiction | Rule | Intent and conduct | Maximum |
|---|---|---|---|
| United States (federal) | 18 U.S.C. 1343, wire fraud (Weinrich's charge) | Transmitting, or causing, a wire, radio or TV communication in interstate or foreign commerce to execute a scheme or artifice to defraud that the sender has devised or intends to devise | A fine, up to 20 years in prison, or both; up to $1,000,000, 30 years, or both where it affects a financial institution or involves benefits tied to a declared disaster or emergency |
| United States (bodies receiving federal funds) | 18 U.S.C. 666 | An agent who embezzles, steals, obtains by fraud or "otherwise without authority knowingly converts", or "intentionally misapplies", property worth $5,000 or more, where the body gets over $10,000 in federal program benefits in any one year period; subsection (c) excludes "bona fide salary, wages, fees, or other compensation paid, or expenses paid or reimbursed, in the usual course of business" | A fine, up to 10 years in prison, or both |
| US ACH network | Nacha Operating Rules: PAYROLL entry description and False Pretenses, 20 March 2026 | Private network rules, not law: originators must use the PAYROLL description on PPD credits for wages; False Pretenses (a misrepresented identity, authority or account owner) covers payroll impersonation | None; a private rule carries no criminal penalty |
| England, Wales and Northern Ireland | Fraud by false representation, section 2 of the Fraud Act 2006 | Making a false representation dishonestly, knowing it is or might be untrue or misleading, and intending a gain, a loss or the risk of a loss; a representation submitted to "any system or device" counts | On indictment, up to 10 years in prison, a fine, or both (section 1(3)(b)) |
| England, Wales and Northern Ireland | Fraud by abuse of position, section 4 (sections 1 to 9 extend to these three nations only: section 15(2)) | Dishonestly abusing a position in which one is expected to safeguard another person's financial interests, or not to act against them, intending a gain, a loss or the risk of a loss; an omission can count | As for section 2 |
| Scotland | Crime classifications (Scottish Government) | Fraud recorded as common law or statutory fraud; embezzlement under other dishonesty | Not stated in the source opened |
| EU member states (recital 38: Ireland and the UK not bound, subject to Article 4 of Protocol 21; recital 39: Denmark not bound) | Directive (EU) 2019/713, Article 6 | Performing or causing a transfer of money, "when committed intentionally", by interfering with an information system or altering computer data without right, causing another person an unlawful loss of property for an unlawful gain | National law must set a maximum of at least three years (Article 9(4)) |
The Barnsley employee pleaded guilty to three counts of fraud. The overpaid wages considered at sentencing totalled £16,950, and on 14 June 2024 the court imposed "12 months imprisonment, suspended for two years". In England, Wales and Northern Ireland, fraud victims report to Report Fraud on 0300 123 2040; in Scotland they call Police Scotland on 101 (NCSC). In the US, IC3 asks victims to note "payroll diversion" in the body of their complaint.
Payroll fraud, employee fraud or embezzlement: where is the line?
When staff run it, payroll fraud is a form of employee fraud. When the person already controls the pay, it can be embezzlement too: the court in Weinrich's case noted the money she "embezzled". Diversion by an outsider is neither.
Table 3. Payroll fraud and the terms next to it.
| Term | Who commits it | What is taken | Who loses |
|---|---|---|---|
| Payroll fraud | Staff, payroll insiders or outsiders | Pay not owed, or a real employee's pay | The employer; in diversion, the employee's paycheck |
| Employee fraud | Staff, against their own employer | Any asset, through the job | The employer |
| Embezzlement | A person trusted with the money | Money already in their care | Whoever owns the money |
| Payroll tax fraud | The employer | Tax withheld or owed on wages | The tax authority |
Which controls stop payroll fraud, and who owns each one?
- HR closes each leaver's pay record on the last day, since the SAO's ghosts include former employees.
- Payroll confirms each bank change with the employee on a number already on file; Nacha suggests change controls for payroll payment instructions.
- Finance reconciles tax withheld with tax paid over, the gap in Weinrich's records.
- A second reviewer reads final payroll reports, overtime and leave balances, as the SAO advises.
- Public bodies in the NFI get its payroll to payroll matches.
- IT gives payroll its own logins and two factor authentication (IC3).
- The receiving bank watches PAYROLL credits for new or multiple pays into one account (Nacha).
complead, formerly Sanction Scanner, builds fraud prevention software. It returns approve, decline, review or step up with the reason attached. Its fraud checks share one engine with onboarding, screening, monitoring and investigation, which gives every customer one risk score in place of a score per tool.
Before the next pay run, decide who may change a payroll bank account and who checks each change.
Related terms
- Employee fraud. Fraud by staff against their employer.
- Embezzlement. Taking money one was trusted to hold.
- ACH fraud. Unauthorized or falsely induced ACH payments.
- Account takeover fraud. A criminal controls a real customer's account.
- Business email compromise. Email impersonation that redirects payments.
- Tax fraud. Deliberately paying less tax than is due.
