Most owners have never held the payroll register up against the people who actually show up. It takes an afternoon.
At the bank we had a phrase for an account that looked fine on paper but that nobody could put a face to. We called it a name without a person. It came up in all kinds of reviews, and it usually had an ordinary explanation. Every so often it didn't.
On payroll, a name without a person is called a ghost employee. Sometimes it's a former worker who was never taken off the system, whose pay keeps landing in an account someone else now controls. Sometimes it's a person who never existed at all, made up by whoever can add an employee and also approve the run. Either way, the company is paying someone who isn't there.
Small companies are not too small for this. In the ACFE's Occupational Fraud 2026: A Report to the Nations, payroll schemes showed up in 13% of the cases at organizations with fewer than 100 employees, compared with 8% at larger ones. The typical payroll scheme ran 13 months before anyone caught it. That's a year of paychecks, each one small enough that nobody looked twice.
A paycheck nobody picks up
still gets paid.
This story is a composite, built from several situations I've seen, with the details changed.
A woman I'll call Renee ran a commercial cleaning company with about forty people on staff. Many were part time, and the crews changed every few months. Her operations manager, a man I'll call Gary, had handled payroll for years. He hired people, entered them into the payroll service, sent in the crews' hours, and approved the run before it went out. Renee trusted him, and for good reason. He was very good at his job.
When a crew member quit, Gary sometimes waited a pay period or two before removing them, in case they came back. That isn't unusual in a business with turnover. Over time, a few of those people stayed on the books long after they'd gone, and their direct deposit details were quietly changed to accounts Gary controlled. The amounts were modest. Part-time hours, never overtime, nothing that would stand out on a payroll summary that ran four pages.
It came out at year end, when one of the W-2s came back from the post office as undeliverable. Renee called the former employee to fix the address. The woman told her she hadn't worked there in over a year.
Nothing about Renee's setup was careless. One person simply held every step of the process, and nobody outside his chair ever checked the list against the people.
The checks I'd ask you to run
You don't need special software for this. You need the payroll register, a list of who actually works for you, and someone other than the person who runs payroll.
Match names to people. Print the register for the last full pay period. Go down it with your managers and have them confirm each name is someone they supervise and saw working that period. Anyone nobody can vouch for gets a phone call.
Look for shared bank accounts. Ask your payroll provider for a report of direct deposit accounts. Two employees paid into the same account deserves a question. So does an account that changed recently with no signed request on file.
Check the details that should be unique. Duplicate Social Security numbers, duplicate addresses, or a home address that matches another employee or the office are all worth a second look.
Notice who never changes. Real employees usually have something going on in their file: a benefits election, a retirement contribution, a vacation request, a new address. Someone with no deductions and no changes in years may be perfectly fine. Ask anyway.
Compare departures to removals. Pull the list of everyone who left this year and confirm each one was taken off payroll by their last pay date.
Then split the job. The person who adds employees to payroll shouldn't be the person who approves the run. If you're too small for that, approve it yourself, and once a quarter read the register line by line. Not the summary. The names.
Most payroll services will also send an alert when a new employee is added or a bank account is changed. Turn those on, and have them go to you as well as to the person who made the change. It costs nothing, and it means a change can't happen without a second person hearing about it.
W-2 season is a good time to start. The addresses are already being checked, and you'll be looking at every name on the register anyway. If a W-2 comes back undeliverable, don't just correct the address. Call the person.
If I sat down with you this week and we went through your payroll register together, could you put a face to every name on it?
Want to know how your controls hold up? Start a conversation.