SP6 “What You Need to Know” Series (Article 2 of 3) 

No business is immune to payroll fraud. It costs U.S. companies millions of dollars each year. 

Despite its prevalence, many organizations have no idea they’re victims of this type of theft. That’s because it can be extremely difficult to detect. Consider these facts:

• According to the 2020 Report to the Nations released by the Association of Certified Fraud Examiners (ACFE), organizations lose 5% of their revenue to fraud each year.  

• ACFE found the average loss per case was $1.5 million. 

Read the first article in this series about payroll diversion.

Since it can add up over time, it’s important to understand how payroll fraud is carried out. Experts say the following strategies are popular with fraudsters:  

• Payroll diversion 
• Phantom employees 
• Time sheet or PTO fraud 

In this article, we’ll examine the phenomenon of phantom employees, including how you can stop them from haunting your organization. 

What are Phantom Employees? 

Also called ghost employees, phantom employees are workers who exist only on paper.  

According to the Society for Human Resource Management (SHRM), two common phantom employee scenarios are: 

• Paychecks sent to employees who have passed away, quit, or been terminated; and  
• Paychecks sent to individuals who have never been on the company payroll.  

In the second example, a current employee carrying out the fraud usually splits the proceeds with the recipient. 

Keeping It All in the Family 

In many cases, the perpetrator is related to the phantom. Kathleen McGuiness, the Delaware state auditor, was indicted in October 2021 on numerous charges, Reuters reported. Among the allegations: McGuiness paid her daughter as a ghost employee late last year, while she was enrolled in college.  

When the daughter was a high school senior early in the pandemic, the state hired her as a public information officer. However, she did little work, and none at all at the time she left for college between August and December of 2020. 

According to the indictment, the daughter was classified as an intern in the payroll system and paid close to $20,000. Of that, $2,300 was disbursed during her first semester in college. The paychecks were sent to a bank account in her mother’s name. 

Now, McGuinness faces two felonies and multiple misdemeanor charges, according to Delaware Online. If she doesn’t take a plea deal, she’s set to stand trial in May 2022. Meanwhile, the Delaware General Assembly announced it will not decide whether to remove her from office until January. 

Who’s Auditing the Auditor? 

If the Delaware State Auditor’s office had had checks and balances built in, McGuinness, despite her position, would have had a much harder time carrying out her wage-stealing scheme. 

PayTech, a Phoenix-based payroll and HR solutions company, recommends establishing the following controls to identify potential ghost employees: 

• Don’t let the same person cut and sign checks. 
• Schedule consistent third-party audits (if running payroll in-house). 
• Examine cancelled checks. 
• Do a background check on all Social Security numbers on the payroll. 
• Scrutinize employees with few or no deductions. (Most people have some.) 

How to Detect Phantom Employees 

Without a doubt, human controls would have helped spot potential criminal activity. However, there’s another tool the state overlooked that could have prevented wage theft – the data on its own computers. Since she started out as an actual state employee, McGuinness’ daughter probably worked out of an office or remotely at home. In either case, she would have logged into the state’s network and left a digital trail including some of the following:

• Computer login records. 
• Badge swipe data. 
• VPN logs or logs of company systems. 

While someone may already be pulling it for information security purposes, the data could be used to detect payroll fraud, said SP6 Director of Professional Services Chris Selvig. 

Finally, the daughter’s lack of activity could have been verified. 

Phantom Employees: In Summary 

All organizations are potential targets of employee fraud. Because it is hard to detect, if it’s going to protect itself against phantom employees, a company must adopt the latest technology and establish a human review process. 

At SP6, we partner with organizations of all sizes and within most business sectors to detect fraud and prevent losses, using the data you already generate.  We’re experts at extracting, correlating and alerting on logs tracking user activity and behavior. Clients often see results in just a few months. 

Find out how we can help by scheduling a free consultation.