Managers have the authority (but not the license!) to issue paychecks to fictitious employees or real persons who have ghostly appearances. 

Herman didn't seem to be the type of person who dabbled in the supernatural. But as a manager for a medium-sized company, he had hired more than 80 ghost employees to his payroll.

The ghosts were actual people who worked at other jobs for different companies. The manager filled out time sheets for the fictitious employees and authorized them, then took the resulting paychecks to the ghost employees, who cashed them and split the proceeds with him. Herman's authority in the hiring and supervision of employees enabled him to perpetrate this fraud.1

Simply enough, a ghost employee is someone on the payroll who doesn't actually work for a victim company. Through the falsification of personnel or payroll records a fraudster causes paychecks to be generated to a ghost. The fraudster or an accomplice then converts these paychecks. (See "Ghost Employees" flowchart on page XX.) The ghost employee may be a fictitious person or a real individual who simply doesn't work for the victim employer. When the ghost is a real person, it's often a friend or relative of the perpetrator.

In order for a ghost-employee scheme to work, four things must happen: (1) the ghost must be added to the payroll, (2) timekeeping and wage rate information must be collected, (3) a paycheck must be issued to the ghost, and (4) the check must be delivered to the perpetrator or an accomplice.

Adding the Ghost to the Payroll

The first step in a ghost-employee scheme is to enter the ghost on the payroll. In some businesses, all hiring is done through a centralized personnel department, while in others the personnel function is spread over the managerial responsibilities of various departments. Regardless of the way new employees are hired within a business, it's the person or persons who have the authority to add new employees that are in the best position to put ghosts on the payroll.

Employees in payroll accounting also sometimes create ghost employees. In a perfect world, every name listed on the payroll would be verified against personnel records to make sure that those persons receiving paychecks actually work for the company, but in practice this doesn't actually happen. Thus, persons in payroll accounting may be able to create fictitious employees by simply adding a new name to payroll records. Access to these records is usually restricted, with only high-level employees having the ability to make changes to the payroll. These persons would therefore be among the most likely suspects in a ghost-employee scheme. On the other hand, lower-level employees sometimes gain access to restricted payroll information and shouldn't be disregarded as possible suspects.

One way perpetrators try to conceal the presence of a ghost on the payroll is to create a ghost with a name very similar to that of a real employee. The name on the fraudulent paycheck will appear to be legitimate to anyone who glances at it. For instance, if a victim organization has an employee named John doe, the ghost may be named "John Doer."
Instead of adding new names to the payroll, some employees undertake ghost employee schemes when they don't to remove the names of terminated employees. Paychecks to the terminated employees continue to be generated even though the employees no longer work for the victim organization. The perpetrator intercepts these fraudulent paychecks and converts them to his own use.

Collecting Timekeeping Information

The second thing that must occur for a paycheck to be issued to a ghost employee, at least in the case of hourly employees, is the collection and computation of timekeeping information. The perpetrator must provide payroll accounting with a timecard or other instrument showing how many hours the fictitious employee worked over the most recent pay period. This information, along with the wage rate information contained in personnel or payroll files, will be used to compute the amount of the fraudulent paycheck.

Timekeeping records can be maintained in a variety of ways. Employees might manually record their hours on timecards or punch timeclocks that record the time at which a person starts and finishes his work. In more sophisticated environments, computer systems can track an employee's hours.

When a ghost-employee scheme is in place, someone must create documentation for the ghost's hours. This essentially amounts to preparing a fake timecard showing when the ghost was allegedly present at work. Depending upon the normal procedure for recording hours, a fraudster might write up a fake timecard and sign it in the ghost's name, punch the timeclock for the ghost, and so on. The preparing of the timecard isn't a great obstacle to the perpetrator. The real key is obtaining approval of the timecard.

A supervisor should approve the timecards of hourly employees before paychecks are issued. This verifies to the payroll department that the employee actually worked the hours that are claimed on the card. A ghost employee, by definition, doesn't work for the victim organization, so approval, obviously, will have to be fraudulently obtained. Often, the supervisor himself is the one who creates the ghost. When this is the case, the supervisor fills out a timecard in the name of the ghost, then affixes his own approval. The timecard is thereby authenticated and a paycheck will be issued. When a non-supervisor is committing a ghost-employee scheme, he will typically forge the necessary approval, then forward the bogus timecard directly to payroll accounting, bypassing his supervisor.

In computerized systems, a supervisor's signature might not be required. In lieu of this, the supervisor inputs data into the payroll system and the use of his password serves to authorize the entry. If an employee has access to the supervisor's password, he can input data for the ghost, which will appear in the payroll system with a seal of approval.

If the perpetrator creates ghosts who are salaried rather than hourly employees, it isn't necessary to collect timekeeping information. Salaried employees are paid a certain amount each pay period regardless of how many hours they work. Because the timekeeping function can be avoided, it may be easier for a perpetrator to create a ghost employee who works on salary. However, most businesses have fewer salaried employees and they are more likely to be members of management. The salaried ghost may therefore be more difficult to conceal.

Issuing the Ghost's Paycheck

Once a ghost is entered on the payroll and his timecard has been approved, the third step in the scheme is the actual issuance of the paycheck. The heart of a ghost-employee scheme is in the falsification of payroll records and timekeeping information. Once this falsification has occurred, the perpetrator doesn't generally take an active role in the issuance of the check. The payroll department prints the check - based on the bogus information provided by the perpetrator - as it would any other paycheck.

Delivery of the Paycheck

The final step in a ghost-employee scheme is the distribution of the checks to the perpetrator. Paychecks might be hand-delivered to employees while at work, mailed to employees at their home addresses, or direct-deposited into the employees' bank accounts. If employees are paid in currency rather than by check, the distribution is almost always conducted in person and on-site.

Ideally, those in charge of payroll distribution shouldn't have a hand in any of the other functions of the payroll cycle. For instance, the person who enters new employees in the payroll system shouldn't be allowed to distribute paychecks because this person can include a ghost on the payroll, then simply pocket the fraudulent check when paychecks are being disbursed. Obviously, when the perpetrator of a ghost employee scheme is allowed to mail checks to employees or pass them out at work, he is in a perfect position to assure that the ghost's check is delivered to himself.

In most instances, the perpetrator doesn't have the authority to distribute paychecks, and so must make sure that the victim organization sends the checks to a place where he can recover them. When checks aren't distributed in the workplace, they are usually mailed to employees or deposited directly into those employees' accounts.

If the fictitious employee was added into the payroll or personnel records by the perpetrator, the problem of distribution is usually minor. When the ghost's employment information is inputted, the perpetrator simply lists an address or bank account to which the payments can be sent. In the case of purely fictitious ghost employees, the address if often the perpetrator's own (the same goes for bank accounts). The fact that two employees (the perpetrator and the ghost) are receiving payments at the same destination may indicate payroll fraud. Some fraudsters avoid this duplication by having payments sent to a post office box or a separate bank account.

Remember that a ghost employee isn't always a fictitious person. It may, instead, be a real person who is conspiring with the perpetrator to defraud the company. For example, some employees place their relatives or spouses on the company payroll. When real persons are falsely included on the payroll, the checks are sent to the homes or accounts of these persons.
Distribution is a more difficult problem when the ghost is a former employee who was simply not removed from the payroll. If paychecks are distributed through the mail or by direct deposit, the perpetrator will have to enter the terminated employee's records and change their delivery information. In companies where paychecks are distributed by hand or are held at a central location for employees to collect, the perpetrator can ignore the payroll records and simply pick up the fraudulent paychecks.

1Wells, Joseph T. Occupational Fraud and Abuse. Austin, Texas: Obsidian Publishing Company Inc., 1997.