Fraud Week Edition: Ghosts are Real! Ghost Employee & Vendor

Ghost Employees

 
Ghost employees and payroll fraud can take different forms including fictitious employees, employees who do not work, and continuous payment after termination. For the fraud to work, proper controls are generally absent thus creating the opportunity for a fake employee to be created and fraudulent payments made:

1. The employee is “hired” by the creator without adequate third-party confirmation of the physical presence and required documents.
2. Timekeeping is maintained by the creator and approved either by the creator or by someone who is not familiar with day-to-day operations
3. A paycheck is issued by the company and intercepted by the creator
4. In some cases, a real employee leaves the company, but the manager leaves them on the payroll for a few weeks and diverts the paycheck to their own account.

These frauds can be carried out by a front-line manager or an HR employee working alone or in collusion but often in a remote location without adequate oversight.

Proactive fraud testing can help to sift out HR/payroll records that might indicate ghost employees. Often, the HR record contains incomplete, duplicate, or falsified information such as false social security numbers, missing personal data, zero vacation days taken, missing employee reviews, and a duplicate bank account.
 

How to Find Fraud

 
IDEA can help you to see the holes in your system that enable payroll fraud to occur.  By combining HR data and payroll transactions IDEA can help you find:

• Unusual net pay
• Missing bank information
• Duplicate tax identification numbers
• Different employees with the same bank information
• Employees over retirement age
• Employees without benefits deductions
• When manual checks are issued
• Employees with no paid time off
• Terminated employees
• Employees paid after termination
• Employees with deposit-type changes
• Paid employees not on HR master

Ghost Vendors

 
As the name would imply, ghost (aka phantom) vendors are nonexistent companies whose payments are pocketed by an employee or related party. This “double paycheck” is a popular form of fraud that is very detrimental to the organization.

Fortunately, there are common pitfalls of this fraud fall into which make them easier to spot. Regardless of motive, most perpetrators will re-use a piece of their real information that’s already in the organization’s system in another capacity. The most commonly selected details to re-use are the employee’s own address as the vendor’s main office or the employee’s banking information to receive the payments. Of course, this leads to the simple conclusion that any vendor sharing any information with any employee is a suspicious find.

In IDEA, it’s as simple as performing the right join. Having a granular list of vendor and employee data allows for auditors to cross-reference these key pieces of identifiable information and all that’s needed is to designate them as keys in a join task. Audimation recommends the data be cleaned first to maximize the matching ability. This means removing any character not crucial to the data (spaces, punctuation, etc.) and making every letter either upper or lower case. IDEA uses “fuzzy matching,” further enhancing the usefulness of joins by also allowing wiggle room for typos and misspellings.

For convenience, the test can be automated using Python or IDEAScript. The script can then be scheduled with Windows’ Task Scheduler and the results easily collected and assessed with IDEA’s reporting and visualization features. If any of these features are unfamiliar or you’d simply like refreshers on how to use them, don’t hesitate to contact us!

We are excellent “Ghost Busters” and have 25 years of experience in finding them, and we can even help gather the data for possible prosecution!  Don’t let it happen to your business, or under your watch.  If you believe your company could be having this issue, schedule a demonstration today.