Payroll Fraud: Warning Signs Business Owners Should Know

Quick Answer: Watch for payroll costs that rise without a clear reason, unusual overtime, pay-rate changes without approval, payments to former or unknown employees, duplicate bank accounts, frequent manual adjustments, and direct-deposit changes that were not verified. One of the best controls is a simple owner review of the payroll register before the money leaves the bank.

Payroll is one of those jobs that can start to feel automatic. The same people are paid every week or every other week. The money leaves the bank, employees get their deposits, and everyone moves on to the next thing.

That routine is part of what makes payroll fraud easy to miss.

Payroll fraud does not always look like one huge theft. It may be an extra hour here, an unauthorized pay-rate change there, or a former employee who was never removed from the system. Small amounts can repeat through many payrolls before anyone notices.

What Is Payroll Fraud?

Payroll fraud happens when someone intentionally uses the payroll process to take money or receive pay they did not earn. The person may work for the business, manage payroll, supervise employees, or be an outside scammer who gains access to an employee’s account.

Common examples include:

• Adding hours or overtime that were not worked
• Creating a fake, or “ghost,” employee
• Keeping a former employee active and redirecting the pay
• Changing a pay rate, bonus, or commission without approval
• Sending more than one employee’s pay to the same bank account without a valid reason
• Changing direct-deposit information after a fake email, a stolen login, or a spoofed self-service website
• Withholding payroll taxes or benefits from employees but failing to send the money where it belongs

Not every payroll mistake is fraud. People enter hours incorrectly. Pay rates get set up wrong. Terminations do not always reach payroll on time. Fraud involves intent, but an honest error and fraud can look similar at first. That is why a warning sign should lead to a review, not an immediate accusation.

Payroll Fraud Warning Signs

1. Payroll Costs Rise for No Clear Reason

If your head count is about the same but payroll keeps climbing, find out why. The reason may be valid, such as raises, overtime, bonuses, or higher sales commissions. But the change should match something you know happened in the business.

Compare total gross pay, overtime, and employee count with the last payroll and with the same period last year. A simple comparison can make an odd change easier to see.

2. Overtime Is Unusually High or Always Goes to the Same People

Some jobs naturally require overtime. The concern is a pattern that doesn’t fit the work: overtime during slow weeks, hours approved after the fact, repeated round numbers, or an employee approving another employee’s time without a supervisor checking it. Time fraud can also mean clocking in for a coworker or changing a time record after a manager already approved it.

3. Employee Information Does Not Make Sense

Look for more than one unrelated employee using the same bank account, address, phone number, or Social Security number. Also watch for missing tax forms, incomplete personnel files, or names that no manager seems to recognize.

A shared bank account is not proof of fraud. Family members may work for the same business, and spouses may use one account. It is simply something to verify.

4. Former Employees Are Still Being Paid

When the person who handles terminations is not the person who runs payroll, information can fall through the cracks. That creates an opening for pay to continue after someone leaves.

Review the payroll register for employees who quit, were fired, or moved to unpaid status. Final pay should match your records and state law.

5. There Are Frequent Manual Checks or Last-Minute Changes

Off-cycle payments are sometimes necessary. Still, repeated manual checks, unexplained advances, deleted payroll entries, or last-minute bonuses deserve a closer look. Fraud is easier to hide when transactions happen outside the normal process.

Require a short written reason and approval for every off-cycle payroll or manual payment.

6. Pay Rates, Bonuses, or Commissions Change Without Support

A raise should tie to an approval, a bonus to a decision someone actually made, and a commission to the sales record and the written plan. If the amount in payroll doesn’t trace back to something in writing, stop and ask before approving it.

This is especially important when the same person can change the rate and run the payroll.

7. Direct-Deposit Changes Come Through Email Only

A message that appears to come from an employee may actually come from a criminal. The request may ask payroll to send the employee’s next check to a new account. It may sound normal, and the email address may be only one letter different from the real one.

Verify every bank-account change through a phone number you already have, through a secure employee portal, or in person. Do not rely on a reply to the same email. The FBI also recommends multi-factor authentication and separate verification of changes to account numbers or payment procedures.

8. One Person Controls the Whole Payroll Process

Small businesses often have one trusted person who collects time, adds employees, changes rates, runs payroll, and reconciles the bank account. That may be efficient, but it leaves very little chance for an error or dishonest entry to be caught.

If you cannot divide every duty, add an owner review. The owner can compare the payroll register with approved hours and changes before payroll is submitted, then review the bank withdrawal afterward.

9. The Payroll Process Cannot Run Without One Employee

Picture the employee who never takes time off during payroll week and doesn’t want anyone else touching the system. That doesn’t mean the employee is stealing — it means the business depends too heavily on one person. Cross-train a backup and require time away from the process; a second set of eyes may find mistakes, weak procedures, or activity that needs an explanation.

Simple Ways to Lower the Risk

You do not have to take payroll away from your team or review every line of every timecard. You do need a consistent process.

• Review the payroll register before each payroll is submitted. Check names, hours, rates, bonuses, commissions, reimbursements, deductions, and total cash needed.
• Compare the current payroll with the prior payroll. Ask about any change that does not make sense.
• Require written approval for new employees, pay changes, bonuses, and terminations.
• Verify direct-deposit changes outside the email that requested the change.
• Limit payroll access. Employees should only have the permissions they need for their job.
• Review the payroll system’s audit log for changes to employee records, if the system provides one.
• Reconcile the payroll bank account and payroll liability accounts each month.
• Confirm that payroll tax deposits and benefit payments were actually made. Do not assume that a withdrawal from your bank settled every obligation.
• Cross-train a backup and have another person review the process when the main payroll employee is out.
• Give employees a way to report concerns privately.

A good habit: Before you approve payroll, ask three questions: Who was added or removed? Whose gross pay changed? Why is the total different from the last payroll? Those questions take only a few minutes and catch a surprising number of problems.

What Should You Do If Something Looks Wrong?

Start by gathering facts. Do not accuse an employee based on one unusual number.

• Save the payroll registers, time records, change reports, emails, bank records, and system audit logs.
• Review several pay periods to see whether the issue is isolated or part of a pattern.
• Restrict access if there is a reasonable concern that money or records are still at risk.
• Contact your CPA, payroll provider, employment attorney, and insurance carrier as needed.
• If money was redirected through a cyber scam, contact the bank immediately. The FBI also directs victims of business email compromise to report it through the Internet Crime Complaint Center at IC3.gov.

The right response will depend on what happened, how much money is involved, and whether employee records or tax payments were affected. Acting quickly matters, but so does handling the review carefully.

Good Controls Are Not a Sign of Distrust

No one wants to think that a trusted employee might steal from the business. Most employees will not. Good payroll controls are not about treating honest people like criminals. They protect the business and the people who work there.

They also protect the employee who handles payroll. When another person approves changes and reviews the final register, one employee is not left carrying the whole responsibility alone.

How We Help with Payroll

At Compton & Company, CPAs, we help small businesses keep payroll accurate, timely, and easier to review. We can help clients process payroll, keep payroll tax filings current, reconcile payroll with the accounting records, and build a clear approval process.

No payroll service can guarantee that fraud will never happen. The owner still needs to stay involved. A short review before each payroll, along with a monthly review of the books, gives you a much better chance of catching a problem while it is still small.

If you need help with payroll or monthly accounting, contact Compton & Company, CPAs. We help small-business owners understand what the numbers are saying and put practical systems in place.

Frequently Asked Questions

How often should a business owner review payroll?

Before every payroll, and again each month. Check the register before you submit; do the deeper review when you reconcile the payroll bank account and liability accounts at month-end.

Is payroll fraud always committed by an employee?

No. A manager, payroll administrator, outside payroll provider, or cybercriminal can all be involved — sometimes by stealing an employee’s login or sending a fake direct-deposit request.

Are two employees using the same bank account proof of fraud?

No. Spouses and family members often share an account, and that alone isn’t suspicious. Verify it — don’t assume.

What if the business is too small to divide payroll duties?

Yes — an owner review works as a backup control. One person can prepare payroll, but the owner should approve new employees, rate changes, bonuses, terminations, and direct-deposit changes, and review the final register before it’s submitted.

What is the most important payroll fraud control for a small business?

One step: the owner reviews and approves the payroll register before it’s submitted. It’s simple, low-cost, and it still matters even when an outside provider handles the filings.