A mid-sized manufacturing company in the West Midlands discovered last year that it had been paying a salary to someone who did not exist. For fourteen months, £3,200 per month had been deposited into a bank account linked to a "David Pearson" — an employee who appeared on the payroll system, had a national insurance number, and was assigned to the night shift at one of three factory sites. Nobody had met him. Nobody had supervised him. Nobody had noticed he was fictional.
The fraud was uncovered during a routine internal audit when a new finance manager cross-referenced the payroll against site access records. David Pearson had never swiped a badge, logged a timesheet, or been recorded by any camera. The total loss: £44,800. The culprit: a payroll administrator who had created the ghost employee and routed the salary to an account she controlled.
This is not an anomaly. It is one of the most persistent and underestimated forms of occupational fraud in the UK.
What ghost employee fraud actually is
A ghost employee is a fictitious person on an organisation's payroll who draws a salary without performing any work — because they do not exist. The term also covers real people who have left the organisation but remain on the payroll, with their salary being redirected.
The Association of Certified Fraud Examiners (ACFE) identifies payroll fraud as one of the most common forms of occupational fraud globally. Their 2024 Report to the Nations found that payroll schemes — including ghost employees — accounted for 12% of all occupational fraud cases, with a median loss of $62,000 per scheme. Cases typically ran for 24 months before detection.
In the UK, the problem is compounded by the structure of many payroll operations: decentralised processes, limited segregation of duties in SMEs, reliance on manual record-keeping, and insufficient cross-referencing between HR, payroll, and operational systems.
How ghost employees get created
Ghost employee schemes follow a limited number of patterns, all of which exploit weaknesses in identity verification.
The fictitious hire. Someone with access to the payroll system — typically a payroll administrator or HR officer — creates a new employee record for a person who does not exist. They fabricate a name, generate or steal a national insurance number, and set up direct deposit to an account they control. If the organisation conducts right to work checks, the fraudster either bypasses them (by marking the check as "complete" in the system) or fabricates documents.
The collusion scheme. A line manager and a payroll administrator work together. The manager authorises the hire of a non-existent worker. The payroll administrator processes the paperwork. Because two people are involved — one in operations, one in payroll — the basic internal control of requiring dual approval is defeated.
The leaver who stays. An employee resigns or is dismissed. The termination is not processed in the payroll system, either through negligence or deliberate action. The salary continues to be paid, redirected to an account controlled by the person committing the fraud. This is particularly common in organisations with high turnover, where departures are frequent and payroll updates are chronically delayed.
The duplicate identity. A real employee is entered into the payroll system twice — once under their real name and once under a variation or alias. Both records are paid. The employee and the fraudster (who may be the same person) split the duplicate salary.
Why this is fundamentally an identity verification failure
Every ghost employee scheme depends on the same foundational weakness: the organisation cannot confirm that a real, unique individual corresponds to every person on its payroll.
Consider what is required to create a ghost employee. The fraudster must bypass a process that should answer three questions:
- Is this a real person? — Verified against a government-issued identity document.
- Is this person unique in our system? — Not a duplicate of an existing employee.
- Is this person physically present and performing work? — Confirmed through operational records, not just payroll entries.
If the onboarding process does not independently verify identity — if it relies on a payroll administrator entering data without anyone else confirming the individual exists — then ghost employees are trivially easy to create.
The right to work check process should, in theory, catch fictitious hires. A proper check requires verifying an original identity document or conducting an online share code check against a real person. But in organisations where the check is treated as a paperwork exercise rather than a genuine identity confirmation — where the person conducting the check is the same person with payroll access — the control fails.
The sectors most at risk
Ghost employee fraud is not evenly distributed across industries. Certain structural characteristics make some sectors significantly more vulnerable.
Large, multi-site operations. Organisations with multiple locations — factory sites, care homes, retail branches, construction projects — face a fundamental challenge: the people who approve hires are often not in the same location as the payroll team. A site manager in Glasgow approves a new hire. The payroll team in London processes it. Nobody in either location has met everyone at every site. The physical distance creates the space for ghost employees to exist.
High-turnover sectors. Industries with staff turnover above 20% — care, hospitality, logistics, retail — process large volumes of starters and leavers. When 50 people join and 40 leave in a single month, the opportunity for a fictional hire to be added to the flow, or a leaver to remain on the payroll, increases substantially.
Organisations relying on agency or temporary workers. When a significant portion of the workforce comes through agency arrangements, the line between "our employees" and "agency workers" blurs. Ghost employees can be hidden among agency invoices, with fictional workers attributed to staffing firms that may not detect the anomaly.
Public sector and grant-funded organisations. Where funding is linked to headcount — schools, NHS trusts, local authority services, charities — there is an additional incentive to inflate staff numbers. Ghost employees serve double duty: generating fraudulent salary payments and maintaining headcount numbers that justify funding.
The warning signs
ACFE research identifies several red flags that correlate with ghost employee schemes:
Payroll anomalies. Employees with no recorded absences, no holiday taken, no training attendance, no performance reviews. A perfect attendance record across years is, paradoxically, suspicious — real employees get sick, take leave, and interact with HR.
Unusual banking arrangements. Multiple employees paid to the same bank account. Bank details that match those of a payroll administrator or line manager. Changes to bank details shortly after an employee "joins."
Missing operational records. An employee with payroll entries but no site access logs, no IT system logins, no email account, no timesheets, no uniform issued, no equipment allocated. In any organisation with physical operations, a real employee leaves traces in multiple systems. A ghost employee exists only in payroll.
Resistance to audits or system changes. The person operating the scheme will resist anything that might expose it — payroll system migrations, headcount reconciliations, changes to payment approval processes, introduction of biometric time recording.
Leavers still on payroll. A simple reconciliation between HR termination records and active payroll records should catch this. In practice, many organisations do not perform this reconciliation regularly — or at all.
The fix: identity verification that goes beyond onboarding
Preventing ghost employee fraud requires closing the gaps that ghost employees exploit. The approach has three layers.
Layer one: verified onboarding. Every new hire must be verified against a real identity by someone independent of the payroll process. The person who checks the identity document should not be the person who enters the payroll record. This is basic segregation of duties, but it is absent in many SMEs where one person handles both HR and payroll.
Layer two: periodic re-verification. Ghost employees survive because nobody checks whether the person on the payroll is still the person doing the job — or whether a person is doing the job at all. Periodic identity verification — quarterly or semi-annually — confirms that every individual on the payroll corresponds to a real person who is actively working. This is not a new concept; it is standard practice in financial services under know-your-customer obligations. The same principle should apply to the employment relationship.
Layer three: cross-system reconciliation. Payroll records should be reconciled against operational records at regular intervals. Every person on the payroll should have corresponding entries in at least two other systems — site access, IT logins, timesheet submissions, or manager-confirmed attendance. An employee who exists in payroll but nowhere else warrants immediate investigation.
The cost of inaction
The direct financial losses from ghost employee fraud are significant but recoverable. The broader costs are not.
Regulatory and tax exposure. Paying salary to a non-existent employee means PAYE and NIC have been calculated incorrectly. If HMRC investigates, the organisation faces penalties for incorrect tax submissions on top of the fraud loss itself.
Audit failure. For regulated organisations — financial services firms, healthcare providers, public bodies — the discovery of ghost employees during an external audit raises fundamental questions about internal controls. It can trigger regulatory investigation, loss of accreditation, or reputational damage that far exceeds the financial loss.
Insurance implications. Fidelity insurance may cover employee fraud losses, but claims require demonstrating that reasonable controls were in place. An organisation that cannot show it verified the identity of every person on its payroll may find its claim denied.
The organisations that eliminate ghost employee risk are those that treat identity verification as an ongoing process, not a one-time event. If you can confirm, at any point, that every person on your payroll is a real, verified individual who is actively working, ghost employees cannot exist.
Certifyd's identity verification platform links every employee to a verified, unique digital identity at onboarding and supports periodic re-verification that confirms the person on the payroll is the person doing the work. For organisations managing multi-site workforces or high-turnover teams, it closes the gap that ghost employee fraud depends on. See how it works.