Ghost employees — fictitious or terminated workers kept on payroll — cost US businesses over $3 billion annually. Identity verification at HR onboarding is the countermeasure that closes the gap.
Payroll fraud is the most persistent form of internal fraud that organisations face — and ghost employees are its most lucrative variant. A ghost employee is a fictitious worker (who never existed) or a terminated worker (who continues to receive paycheques after leaving) kept on the payroll through falsified records or weak identity controls.
The Association of Certified Fraud Examiners (ACFE) estimates payroll fraud affects approximately 27% of businesses and causes a median loss of $100,000 per case before detection. In larger organisations with complex payroll structures, single fraud cases have exceeded $5 million.
Ghost employees represent an identity problem at the core. They persist because payroll systems trust the data entered into them rather than verifying the identity of the individuals receiving payment.
The mechanics vary by who is perpetrating the scheme and what level of system access they have:
HR-facilitated ghost addition — an HR employee with payroll access adds a fictitious employee record with a bank account they control. The fictitious employee receives regular paycheques that are redirected to the fraudster. The scheme persists as long as the fraudster remains employed and has system access.
Manager-level scheme — a manager retains a departed employee's records in the payroll system after termination, continues to approve timesheet submissions for the ghost, and collects the salary to an account they control. This requires either direct payroll access or collusion with HR.
Vendor ghost scheme — particularly in large organisations with contract or temp worker programmes, fraudsters create fictitious contractor records in vendor management systems. Invoices submitted by the ghost vendor are approved through normal accounts payable workflows and paid out.
Delayed termination exploitation — an employee gives notice but an administrator fails to process the termination in the payroll system. The former employee continues to receive salary for weeks or months. Sometimes this is an innocent administrative failure; sometimes it is facilitated deliberately.
The ACFE's 2024 Report to the Nations on occupational fraud documents that payroll fraud schemes have a median duration of 24 months before detection. In that two-year window, the average ghost employee scheme generates losses of $70,000 to $400,000 depending on the seniority level of the fictitious employee.
Across all US businesses, the ACFE estimates payroll fraud results in aggregate losses exceeding $3 billion annually. The problem is proportionally larger in mid-market companies that have grown to a size where payroll complexity is high but internal controls have not scaled with headcount.
| Dimension | Traditional HR Onboarding | Identity-Verified Onboarding |
|---|---|---|
| Identity confirmation | Paper documents reviewed by HR | Biometric face match + document authentication |
| I-9 verification | Manual document review | Automated document authentication + biometric |
| Bank account verification | Account number entered by employee | Identity-linked payment authorisation |
| Termination confirmation | Manual system update | Biometric deactivation removes access |
| Periodic re-verification | Rarely performed | Automated periodic biometric confirmation |
| Audit trail | Inconsistent paper records | Complete digital record with biometric evidence |
| Ghost employee creation difficulty | Low (data entry by HR) | Very high (requires real biometric match) |
In the United States, I-9 verification — confirming that every employee is legally authorised to work — is a federal requirement under the Immigration Reform and Control Act. ICE audits of I-9 records have increased significantly in recent years, with fines ranging from $272 to $2,701 per paperwork violation and $676 to $27,018 per substantive violation.
Traditional I-9 compliance relies on HR staff manually reviewing presented documents. The same document authentication weaknesses that create ghost employee risk also create I-9 compliance exposure — a staff member with fraudulent work authorisation documents is both a legal liability and a potential internal fraud risk.
Automated I-9 document authentication — which deepidv handles as part of the HR and employment verification workflow — reduces I-9 violation risk while simultaneously addressing the document authentication gap that enables ghost employee schemes.
Step 1 — Pre-hire identity confirmation: Before an offer is extended, the candidate completes remote identity verification: government ID authentication and biometric face match. This creates a verified identity record that is attached to the employee file from the start.
Step 2 — Day-one biometric enrollment: On the first day, the employee's biometric profile is activated in the HR system. From this point, any payroll, benefits, or access requests require a matching biometric event.
Step 3 — I-9 document verification: Work authorisation documents are authenticated using the same document verification pipeline, with the verified identity already on file serving as the anchor.
Step 4 — Ongoing biometric confirmation: Periodic re-verification checks confirm that the enrolled biometric record still matches an active employee. Dormant records that cannot produce a match are flagged for review and payroll suspension.
Step 5 — Termination with immediate deactivation: Employee termination triggers immediate biometric deactivation in the payroll system. Ghost employee persistence after termination becomes architecturally impossible.
The cost of implementing identity-verified onboarding is typically $15 to $40 per employee enrolled, depending on the verification components required. For an organisation with 500 employees and an annual turnover rate of 20%, the annual verification cost is $1,500 to $4,000.
The median loss prevented by catching a single ghost employee scheme: $100,000. The ROI is not debatable.
See how deepidv supports HR and workforce identity verification. Start protecting your payroll from day one.
Go live in minutes. No sandbox required, no hidden fees.
The F&I office is the last manual bottleneck in auto retail. Learn how modern dealerships are using in-store identity verification to close deals faster and reduce fraud.
Auto finance teams spend 40% of their time on document processing. Learn how digital verification is reclaiming that time and reducing errors in the F&I workflow.
The best identity verification systems know when to automate and when to involve a human. This article explores why the human factor remains essential and how to design systems that preserve it.
