The Cost of the Unseen: Tightening Controls on Ghost Employees and Vendor Fraud

Fraud schemes rarely show up in evident ways. Instead, they often hide in plain sight, quietly embedded in payroll records or disguised within vendor invoices. Today’s technology, including advanced AI tools, has made it easier than ever to fabricate ghost employees or falsified invoices, leaving businesses of all sizes vulnerable to financial losses that accumulate silently until it’s too late.

What are Ghost Employees?

Payroll should be as simple as paying the people who work for you. However, in today’s world of remote work and shifting workplace structures, it has become easier for ghost employees, fake or former workers who are still on the payroll, to slip through unnoticed.  Because of this complexity, it has become easier for ghost employees to be added or left in the system without detection. This oversight could happen through fraud (i.e., someone intentionally adding a fake name) or through lack of oversight (i.e., an employee leaves but isn’t removed from payroll). Signs of ghost employees might include employees sharing the same bank account or address, former employees still appearing on payroll, rising payroll costs without new hires, or unrecognizable names on the payroll. Remote work has made this problem even harder to spot now that face-to-face interaction with employees has become less frequent.

A study by the Association of Certified Fraud Examiners (ACFE) found that payroll fraud (including ghost employees) accounted for 15% of occupational fraud cases in the U.S. and Canada. On average, these schemes often last 18 months undetected, costing businesses about $2,800 per month and nearly $50,000 before discovery.

Controls to Prevent Ghost Employees:

Detecting and preventing ghost employees relies heavily on data analytics. Establishing a clear separation between HR, payroll and accounting functions creates essential checks and balances. Regular payroll reconciliations, analytics-driven monitoring to flag suspicious entries, automated HR recordkeeping and verified identification for paycheck pickups all work together to strengthen payroll integrity.

Vendor Invoice Fraud - Fake Bills, Real Losses:

Employees aren’t the only ghosts defrauding companies. Vendor fraud has evolved into two major threats: ghost vendors created to divert payments and fraudulent invoices submitted under the names of legitimate vendors. Both threats are on the rise and causing serious concerns for businesses. Fraudulent invoices are often vague, incomplete or include charges beyond agreed terms. They may appear as repeated small “miscellaneous” expenses. These ghost vendors may appear to be real, but don’t provide any real products or services.

A study by Creditsafe, published on Business Wire, found that 98% of U.S. companies believe they are at risk of vendor fraud. Similarly, the ACFE reports that billing fraud losses are increasing, accounting for 22% of all asset misappropriation cases and having a median loss of $100,000. This makes billing fraud second only to corruption as the most common form of fraud.

Fraudsters are growing more sophisticated, and city governments have been recent targets. In August 2025, CBS News reported that the city of Baltimore lost over $800,000 after a scammer tricked the city’s Accounts Payable team into updating the bank details of a legitimate vendor. The scheme, which began months earlier with a fake supplier form submitted in Workday, ultimately diverted $1.5 million in city funds before it was caught. Investigators found that the fraudster used a personal email address posing as a real vendor employee, and the change was approved without verification. This gap in the city’s policy proved costly.

Controls to Prevent Invoice Fraud:

The best defense is building strong internal controls. Assigning one person to approve invoices and another to confirm payments ensures proper checks and balances. Always verify that goods or services were actually received before issuing payment. Keeping purchase orders, invoices and payments within the same accounting system also makes it easier to detect inconsistencies.

Separation of duties remains one of the most effective safeguards, but it is important not to stop there. Requiring employees in sensitive roles, such as Accounts Payable, to take mandatory vacations can help uncover irregularities that might otherwise go unnoticed, as fraudulent activity often depends on continuous, uninterrupted access.

Protect Your Assets:

Whether it’s ghost employees, ghost vendors or fraudulent invoices from legitimate vendors, fraud thrives in the shadows. The good news is that with strong internal controls, smart use of accounting systems and clear separation of duties, businesses can bring these schemes into the light before they do lasting damage.

If your business has been impacted by fraud, Moore Colson’s Forensic Accounting and Litigation Support team can assess the extent of the damage and develop strategies to put protective measures in place, ensuring you’re better safeguarded moving forward.