How to prevent payroll fraud: 5 common scenarios

Payroll fraud isn’t always obvious. Unauthorized pay adjustments, manipulated hours, and other fraudulent transactions can blend into normal payroll activity, making them difficult to catch.

For lean startup teams, payroll automation software can make managing payroll easier, but it doesn’t eliminate the need for oversight. When employees have broad access to payroll systems without sufficient oversight, unauthorized activity can be harder to detect. Regular reviews, approvals, access controls, and reconciliations can help founders and operations teams identify unusual activity before it becomes a bigger problem.

In this guide, we cover five common payroll fraud scenarios and what you can do to reduce the risks to your company. You’ll also learn the warning signs to watch for and practical risk-reducing controls you can put in place around payroll access, employee data, approvals, payment changes, and reconciliation.

Payroll fraud happens when someone intentionally manipulates or falsifies a business’s payroll system or records to receive or direct unauthorized payments. In a startup, anyone who has access to the payroll system, such as a payroll administrator, employee, or manager, could potentially use that access to commit fraud.

Payroll fraud can come in many forms, including unauthorized payments to fake or former employees, inflated hours, unauthorized pay increases, false bonuses or commissions, and unauthorized changes to payment information.

All organizations are at risk of payroll fraud, but several factors can make startups especially vulnerable.

Lean teams with broad access

One person on a team may be the only one who knows how to do payroll. They could have access to manage employee records, make payroll changes, and process payroll, with fewer checks and balances than you'd typically find on larger finance teams.

Rapid growth

Startups can grow quickly, bringing more employees, compensation changes, bonuses, and payment details to manage. With more payroll activity to keep track of, fraudulent payments or unauthorized changes may be harder to spot.

Lack of formal payroll controls

Speed and flexibility are top priorities for most startups, so they may not have clear payroll processes, access restrictions, or regular payroll reviews.

Heavy reliance on automation

Payroll software saves founders time and effort by streamlining routine tasks. However, automation doesn’t replace the need to review payroll activity and control who can make changes.

Competing priorities

Founders and operators juggle numerous competing priorities. They may not have the time to regularly review payroll, software access, and internal controls.

Payroll fraud can be difficult to spot if you don’t know what to look for. Here are some common warning signs to watch for at your startup. While they don’t automatically mean that fraud is taking place, they can signal that there’s something you should investigate further.

• Unexplained increases in payroll expenses: Your payroll is rising but there aren’t any corresponding changes in headcount, salaries, bonuses, or other types of compensation adjustments.
• Unfamiliar or former employees on the payroll: Your payroll records don’t match your current employee roster
• Missing or inconsistent payroll records: Timesheets, agreements, employee information, or approval records are not available or don’t match payroll transactions.
• Unusual payroll system activity: There are unfamiliar logins, unexpected password resets, or new administrator accounts that haven’t been authorized.
• Unauthorized payroll changes: Compensation adjustments appear without the required approvals or supporting documentation.
• Lack of payroll oversight: Only one person knows how payroll works and manages everything without any independent approval or review.

Payroll fraud prevention doesn’t have to be complicated. With a few internal controls in place, you can reduce fraud risk and minimize unauthorized behavior.

• Separate payroll responsibilities: Avoid giving one person full control over both payroll changes and payments.
• Establish an approvals process with thresholds: Require approvals for sensitive changes like salary increases, adding new employee records, and direct deposit updates.
• Strengthen account security: Use role-based access and multi-factor authentication. Review account activity regularly.
• Verify all payroll updates: Check supporting documentation before approving payroll changes.
• Establish a regular payroll reconciliation process: Compare payroll accounts against accounting records, previous payroll runs, and bank transactions.
• Maintain audit trails: Use payroll software that tracks who makes changes and when so you can investigate unusual activity.
• Review payroll controls regularly: Reassess permissions, roles, approval workflows, and reconciliation processes as your startup expands.

So what does payroll fraud look like in practice? Here are five common scenarios, along with the appropriate warning signs to watch for and controls that can help reduce your risk.

Scenario 1: Ghost employees and payments to former employees

A ghost employee is a fictitious employee who exists only in your payroll system, while a former employee is one who used to work at your startup and has since left — but they are still an active employee in your payroll system. Both of these scenarios can lead to payroll fraud.

• Startup scenario: One operations employee is responsible for onboarding new hires, updating payroll records, and running payroll from start to finish. They have broad access to the payroll system, and can add a ghost employee or leave a former employee active on payroll and change their direct deposit information to route payments to an account they control.
• Warning signs: Look for employees who are on payroll but not in any HR or personnel records. Investigate unfamiliar employee names and headcounts that don’t match the current team.
• Control: Compare your payroll roster with active employee records on a regular basis. Make sure departing employees are removed from active payroll after any final payments are processed. Ensure there is an approval process in place for new payroll profiles and changes to employee and payment information in the payroll system.

Scenario 2: Falsified hours, overtime, bonuses, and commissions

Employees may intentionally inflate their hours, overtime, bonuses, commissions, or other variable compensation to increase their pay.

• Startup scenario: A startup uses an automated payroll system where managers approve employee-submitted hours and variable compensation. However, managers aren’t required to verify these entries against supporting records, making it possible for an employee to inflate their hours or enter a false bonus or commission.
• Warning signs: Be on the lookout for unexpected spikes in hours and overtime as well as bonuses or commissions that seem unusual or don't match approved compensation.
• Control: Require managers to verify payroll entries against time records, bonus approvals, and commission records. Set thresholds for additional review of unusually large payments or adjustments.

Scenario 3: Unauthorized changes to salaries and payroll records

Without proper controls, anyone with the appropriate payroll access can change an employee’s salary, pay rate, bonus, and other payroll information without needing approval.

• Startup scenario: The payroll administrator on a lean team has broad permissions to make changes throughout the system. They can increase their own pay or another employee’s pay without anyone else reviewing or having to approve the change.
• Warning signs: Keep an eye out for frequent manual adjustments in the payroll system without any supporting documentation. Investigate compensation that doesn’t match employee agreements or approved pay changes.
• Control: Add an approvals process to payroll changes, where someone other than the person making a change has to sign off. Keep detailed records of approved raises, bonuses, and other types of compensation changes so payroll amounts can be easily verified against what's been authorized.

Scenario 4: Payroll diversion and fraudulent direct deposit changes

A malicious external party can gain access to an employee's payroll account or trick someone into changing an employee’s payment information in the payroll system to redirect their paycheck to a different bank account.

• Startup scenario: Someone gains access to an employee’s email account and sends the payroll administrator a request to update direct deposit information. If the administrator processes the request without verifying it, the next paycheck goes into the fraudster’s account.
• Warning signs: Watch for unexpected requests to change bank information or requests that pressure the team to act quickly right before payday.
• Control: Verify sensitive payment changes in person or over the phone using a trusted contact method, instead of relying only on email. Set up strong authentication for employee payroll accounts and require additional verification for direct deposit changes.

Scenario 5: Payroll account takeover and compromised admin access

A malicious external party can gain access to the payroll system, allowing them to change employee information, redirect payments, and make other unauthorized changes.

• Startup scenario: Someone gains access to a payroll administrator's account through stolen login credentials. With the administrator's permissions, they can make unauthorized changes to employee records or payment information. They may go unnoticed if there are no regular reviews of payroll activity in place.
• Warning signs: Keep an eye out for unexpected password resets, unfamiliar login devices or locations, and unexplained employee or payment updates.
• Control: Set up multi-factor authentication and use role-based permissions. Do not share payroll administrator accounts between multiple employees. Review login and payroll activity on a regular basis.

One last thing to keep in mind: Many of these warning signs won't be immediately obvious. Regularly reviewing payroll records and account activity, and cross-checking that information against employee records, approved compensation changes, and other supporting documentation, is often what makes it possible to spot suspicious activity in the first place.

With only a few people on your team, it may feel easier to assign all payroll tasks to one person. However, one important way to prevent payroll fraud is to separate payroll duties. Have one person prepare payroll and a different person approve the payroll run. If there are any sensitive changes to payroll, make sure someone else has to review and approve those changes.

Use software to support approval workflows and speed up payroll processing, while limiting employees' access to the functions necessary for their roles.. For example, someone responsible for preparing payroll shouldn't also be able to approve their own changes, while a department manager may only need access to approve their team's timesheets, without access to company-wide payroll records or compensation changes.

Payroll reconciliation and regular audits are important tools for catching payroll fraud, helping you spot any unusual activity early before it snowballs into a larger issue.

Payroll reconciliation is helpful for catching discrepancies. When you compare payroll reports with accounting records, previous payroll runs, and bank transactions, you can identify missing, duplicate, or unexpected payments.

Similarly, regular audits help uncover suspicious activity. You can spot patterns and anomalies when you review employee records, compensation changes, and payroll activity. Audits also help you spot weaknesses in your internal controls.

To make sure important checks don't fall through the cracks, consider using a payroll compliance checklist as part of your regular payroll review process.

If you suspect payroll fraud is taking place at your startup, it’s important to act quickly. First, secure any potentially compromised payroll accounts to prevent further unauthorized activity. Review access permissions, reset compromised passwords, and disable unauthorized access. Contact your bank or payroll provider if payments or account information may have been affected.

Then, investigate suspicious activity. Review payroll records, approval histories, and transactions. Look at supporting documentation, such as emails and system activity logs. Speak with the appropriate people at your company, as well as external experts such as legal counsel, accountants, or bookkeepers, to help you investigate the issue.

If fraud is confirmed, follow the appropriate internal procedures and determine whether it needs to be reported to the relevant authorities. And once the issue is addressed, take some time to strengthen your internal controls. Look at security gaps and see where you can improve internal approval processes (e.g., requiring a second person to approve compensation changes or introducing additional verification for direct deposit updates) to reduce future instances of payroll fraud.

Lean startup teams need smart controls, not more administrative headaches. Limiting payroll access, requiring approvals, and regularly reviewing payroll activity can help reduce your startup's risk of fraud. These safeguards also give founders and operators greater visibility into payroll so they can identify suspicious activity before it becomes a bigger problem.

Visibility and control matter beyond payroll, too. They're essential to managing your company's broader financial operations. Mercury helps startups simplify money management by bringing banking and financial workflows together in one place, giving founders greater visibility into their finances and more control over how they manage their money.

Explore Mercury today and see how you can manage your startup’s finances with more clarity and confidence.

^{This article is for informational purposes only and does not constitute legal, tax, investment, or financial advice. Founders should consult their own legal and financial advisors before making important financial decisions.}