Payroll Fraud
Fake employees, redirected wages, and compromised payroll data. Payroll fraud is recurring, predictable, and often goes undetected for months because no one questions the pay run.
Source: ACFE Report to the Nations, 2024
How payroll fraud works
Payroll fraud exploits the fact that payroll is routine. Every fortnight or month, the same payments go out to the same people. No one scrutinises individual pay run entries the way they might examine a large supplier invoice. That predictability is exactly what makes it vulnerable.
The fraud can come from outside, through business email compromise targeting HR or payroll staff with requests to "update bank details". Or it can come from inside, through employees or contractors with direct access to payroll systems.
Unlike one-off payment redirection, payroll fraud is recurring. A single undetected change means money is stolen every pay cycle until someone notices. And because the amounts per employee are relatively small compared to supplier payments, the theft often flies under the radar.
Common types of payroll fraud
Payroll fraud takes several forms, all exploiting the routine nature of pay runs.
Ghost employees
Fictitious employees are added to the payroll system. Their wages are paid to accounts controlled by the fraudster. Common in larger organisations where headcount is harder to track.
Bank detail redirection
A real employee's bank details are changed to an account the fraudster controls. The employee doesn't get paid, and the fraudster withdraws before anyone notices.
BEC targeting payroll
An attacker impersonates an employee via email, requesting HR or payroll to update their direct deposit details. The next pay cycle sends their salary to the criminal.
Terminated employee exploitation
Employees who have left the company aren't removed from payroll. An insider continues to process their 'wages' to an account they control.
Warning signs to watch for
Payroll fraud is designed to blend in. But there are patterns that stand out under scrutiny.
Bank detail change requests via email
An employee asks to change their bank details by email rather than through HR systems or in person.
Multiple employees sharing bank details
Different employee records with the same BSB and account number is a strong indicator of ghost employees.
Employees with no tax file number
Ghost employees often have incomplete records: missing TFN, no super fund, or generic contact details.
Payroll changes before long weekends
Changes made right before a pay run or long weekend, designed to avoid scrutiny during processing.
Headcount mismatches
The number of people on payroll doesn't match HR records, department headcounts, or building access logs.
Resistance to payroll audits
Employees responsible for payroll who discourage reviews or insist on handling the process alone.
How ezyshield prevents payroll fraud
ezyshield verifies the person behind every bank account before money moves, including employees. Ghost employees can't pass verification, and redirected wages get caught before the pay run.
Verify every payee
Every person on payroll is verified biometrically and their bank account ownership confirmed. Ghost employees fail because there's no real person to verify.
Re-verify on change
Bank detail changes trigger re-verification. The account holder must confirm ownership through our secure flow, not just an email to HR.
Pre-pay-run checks
Every pay run is checked against verified fingerprints before money leaves. If anything has changed since the last verification, payment is blocked.
Related content
Insider Threats
How internal actors exploit their access to redirect payments.
THREATPayment Redirection Fraud
The broader category of fraud that payroll redirection falls under.
PRODUCTHow ezyshield Works
Verify every bank account before every pay run, automatically.
LEARNAP Fraud Prevention
Protecting your accounts payable and payroll processes from fraud.
Protect every pay run, every cycle
ezyshield verifies bank account ownership before every payment, including payroll. No ghost employees. No redirected wages.