Payroll Fraud: Red Flags and Bank Evidence

How Payroll Fraud Shows Up in Bank Evidence

Payroll fraud becomes visible when the employee named in the payroll system differs from the person entitled to the money or the account receiving it. The main schemes are ghost employees, diverted pay and inflated pay. Payroll staff can create records, managers can approve false timesheets and outsiders can impersonate an employee to change bank details.

Ask the employer for the employee master file, payroll registers and the payment file submitted to the bank for each suspect run. Add employment and termination records, approved timesheets, bank-detail change logs and payroll audit logs. Obtain employer statements and bank payment confirmations for the same periods.

An Australian Banking Association (ABA) file contains the instructions for a batch of payments. Its detail records identify accounts and amounts. ANZ’s payment-file guidance explains that an ABA file can hold several batches. Australian Payments Network describes the direct-entry system that exchanges debit and credit instructions.

Keep instructions and completed payments separate in your analysis. An employer statement can show one payroll debit for a whole batch. Use the bank’s batch details to identify individual payments and check returned or rejected items before counting a loss. The employee master file tells you who was supposed to be paid. Recipient evidence tells you where the money went.

Payroll is one route for staff theft. The wider employee fraud investigation covers the response beyond testing wage payments. Compare separately recorded expense fraud if the same employee also receives reimbursements.

Ghost Employees and Shared Bank Accounts

A ghost employee is a payroll record for someone who does not perform the employment recorded against them. Sort payment lines by Bank State Branch (BSB) number and account number to find accounts receiving wages under several employee names. Preserve leading zeros when preparing that comparison.

Match each shared account to the employee master file and supporting employment records. A joint account can legitimately receive two employees’ pay. Establish who holds the account and whether each named employee works for the business before treating the match as a loss.

For example, in a hypothetical Australian pay run, two employee records each direct $1,800 to the same account. One record belongs to a real worker. The other has no evidence of employment. The $3,600 total reconciles with the bank debit, but $1,800 requires investigation. Reconciliation of the total alone would miss that difference.

Compare each termination date with later pay credits. Continued ordinary wages can expose a former employee left on the books. Separate authorised final pay, back pay and leave payouts from recurring payments for work supposedly done after departure.

Examine new records with no tax file number declaration or onboarding tax information. Check absent super fund details and missing leave history against the person’s employment basis and length of service. Casual workers and genuine new starters can have little leave history. A cluster of missing employment records, repeated pay credits and a shared recipient account warrants a closer test.

Inflated Pay, Overtime and Off-Cycle Runs

Inflated pay appears when a payment exceeds the worker’s supported entitlement. Compare each employee’s net pay in the payroll register with the credit instruction in the submitted ABA file. Then reconcile the batch total with the employer’s bank debit and any returns. Use net pay for the payment comparison. Gross wages include amounts that do not reach the employee’s account.

Inspect the file actually submitted to the bank, including changes made after payroll approval. A freshly exported file can differ from the one used to pay wages. Bank payment records and upload logs help identify which version was released.

Review off-cycle runs, manual adjustments and overtime spikes against approved hours and pay rates. Give particular attention to payments approved by the person who processed them. Record the authorised amount beside the amount paid and explain each difference before adding it to the loss schedule.

An off-cycle payment can correct a genuine mistake. The diagnostic question is whether the payment has an authorised reason and supporting calculation. Check whether a correction also duplicates money already paid in the normal run.

Following Diverted Wages to the Perpetrator

Diverted wages can be traced by matching employer payments with credits in the suspected recipient’s statements. Compare dates and amounts, allowing for settlement timing. Use payment references and recipient account details to distinguish a match from another transaction of the same amount.

Where the employer statement shows only a batch debit, connect it through the bank’s itemised payment record to the recipient credit. Account-holder records establish whose account received the money. Payroll change logs then show who changed the destination and when. Receipt of money and responsibility for changing the payroll record are separate findings.

Recipient statements require lawful access. The guide to obtaining bank records by subpoena explains that route when the records are held by another party.

Single Touch Payroll (STP) reports provide another comparison with the bank evidence. The Australian Taxation Office (ATO) describes income statements as showing year-to-date wages, withheld tax and super amounts owed. Services Australia’s STP guidance also identifies cessation details and income categories.

Compare reported wages with the payroll register for matching periods and account for tax and other deductions before comparing net receipts. Differences can expose omitted payments, inflated reported earnings or corrections that need explanation. An STP report records what the employer reported. It does not establish that a particular bank account received the pay. Use bank evidence to prove the destination.

Forensic accountants can use FinTrace to save hours on the statement review within that investigation. FinTrace turns supplied PDFs into a searchable Excel ledger and a clear findings report, with suspicious transactions flagged. Each finding cites the source filename and page, so the supporting statement is already at hand. You can focus your own payroll analysis on the relationship between those movements and the employer’s records.

Controls That Prevent a Repeat

Payroll fraud risks rise when one person can add an employee, change their bank details and release the payment. Unreviewed manual payments create another route around the normal approval process. The Commonwealth Fraud Prevention Centre’s separation-of-duties guidance specifically recommends separating payroll entry from verification and reconciliation.

Apply those principles to the point where each scheme enters the pay run:

• Separate employee setup from pay run approval. Require employment evidence before a new record receives wages.
• Verify bank-detail changes independently with the employee through contact details already held. Retain the change request and approval.
• Review exceptions before releasing each run. Include new employees, changed accounts, payments after termination and unusual overtime or manual adjustments.
• Require independent approval of off-cycle payments and reconcile them with the next normal run to detect duplicates.
• Periodically match the payment file to the employee master file. Flag shared account numbers and staff with no leave or super history for an employment-record check.

The Commonwealth Fraud and Corruption Control Framework requires Commonwealth entities to manage fraud risks and test controls. Businesses can use the same prevention and detection principles when designing their payroll checks.

For each established payroll loss, identify the control that would have stopped its entry or release. Test bank-detail verification with a change request and independent payroll review with an exception from a pay run. Confirm that the employee master-file match catches an unsupported employee before their next payment is released.