Payroll fraud schemes can be costly — and for small businesses, devastating. The Association of Certified Fraud Examiners (ACFE) has found that the median loss from payroll fraud schemes is $50,000. However, some long-term payroll frauds, particularly when perpetrated by upper management, have produced losses in the millions of dollars. Can your company afford that? Probably not.
Payroll fraud incidents can also result in bad publicity, weakened employee morale and, potentially, an IRS investigation. It’s critical that your business take steps to protect its payroll function.
Illegal self-enrichment
There are several ways for fraud perpetrators to illegally manipulate payroll to enrich themselves. For example, cybercriminals often target payroll functions. They might use phishing emails to trick your workers into providing sensitive information, such as bank login credentials. This becomes a form of payroll fraud if they divert payroll direct deposits to accounts they control. Criminals might also target you and accounting department managers by sending fake emails from “employees” requesting changes to their direct deposit instructions.
Also watch out for occupational payroll fraud. In the absence of appropriate internal controls, crooked accounting staffers could add invented “ghost” employees to the payroll. The wages of those ghost employees might then be deposited in accounts controlled by the fraudsters.
And any employee who files for expense reimbursement may inflate expenses, submit multiple receipts for the same expense or claim fictitious expenses. This is considered payroll fraud because reimbursements are often added to paychecks. By the same token, workers eligible for overtime who artificially inflate their work hours are also generally considered payroll fraud perpetrators.
Effective internal controls
To prevent payroll fraud — and uncover it quickly if it occurs — implement and enforce strong internal controls. For instance, require two or more employees to make payroll changes, such as increasing pay rates or adding or removing employees. Payroll staffers should be alert for excessive or unusual pay rates, hours or expenses. And if they receive a request to change an employee’s direct deposit information, they should verify the request with the worker before proceeding.
For their part, department managers must closely monitor employee expense reimbursement requests. They should ask employees to explain discrepancies, such as totals that don’t add up or expense claims that lack receipts.
Other effective controls include:
Audits. Regularly conduct payroll audits to detect anomalies. Also audit automatic payroll withdrawals to confirm proper transfers are made.
Training. Educate employees about payroll schemes, phishing attacks and the importance of not sharing sensitive information.
Confidential hotlines. Offer an anonymous hotline or web portal to employees, customers and vendors to report fraud suspicions. Be sure to investigate every report.
Tax responsibilities
Finally, a scheme that’s most often perpetrated by business owners and executives is deliberately failing to pay required payroll tax. Ensure that upper management and payroll department employees understand their tax responsibilities and that no one individual has the ability to divert funds intended for payroll tax to a personal account. Contact us for more information and assistance with internal controls.
© 2026
