fatcousin
// case type

payroll fraud / ghost employee

unauthorized direct deposit changes · ghost employees · overtime inflation · payroll adjustment after termination. evidence is ADP/Workday/UKG payroll audit exports + HCM headcount cross-checks.

tools
13
priority
H
processing
local · in browser

start here · primary tools

ordered. work top-down. the first tool is the suggested entry point for this case type.

  1. adp payroll audit log forensic analyzerdrop adp export · parse paycheck + employee + approver · runs locally
  2. workday payroll export forensic analyzerdrop workday payroll export · parse payment + earning + user · runs locally
  3. payroll ghost employee detectordrop payroll export · detect ghost employee patterns · runs locally
  4. payroll unauthorized adjustment detectordrop payroll export · detect unauthorized pay adjustments · runs locally
  5. payroll overtime inflation detectordrop payroll export · detect overtime inflation patterns · runs locally
  6. cross hcm payroll headcount correlatordrop hcm + payroll exports · correlate headcount to pay run · runs locally
  7. cross payroll wfm timesheet correlatordrop payroll + wfm exports · correlate paycheck to timesheet · runs locally
  8. case report generatorfill in case number · examiner · dates · findings · drop evidence files for auto hash · generates structured forensic report PDF · runs locally

also useful · secondary tools

supporting and follow-up tools. surface as the investigation widens.

  1. ukg payroll audit log forensic analyzerdrop ukg payroll export · parse pay + benefit + user · runs locally
  2. gusto payroll audit log forensic analyzerdrop gusto export · parse run + employee + admin · runs locally
  3. multi payroll platform timeline correlatordrop 2+ payroll exports · unified payroll timeline graph · runs locally
  4. evidence manifest generatordrop evidence files · compute md5 sha1 sha256 · chain of custody manifest · case number · analyst · export pdf and csv · runs locally
  5. incident timeline builderdrop multiple CSVs with timestamps from any forensic tool · merge into unified chronological timeline · entity tagging · filter by source · export full timeline · runs locally
// case-kit pipeline

run as a stack

skip the click-through. these presets are curated forensic pipelines you can save as a stack with one click and run on your evidence locally.

  • payroll fraud kit

    6 steps

    drop ADP/Workday payroll exports → ghost employee scan → unauthorized adjustment detect → HCM headcount cross-check → draft case report

    1. 01evidence-manifest-generatorhash every payroll export before analysis — chain-of-custody for HR/legal
    2. 02adp-payroll-audit-log-forensic-analyzerparse ADP payroll audit rows — user, action, timestamp
    3. 03payroll-ghost-employee-detectorflag ghost employee patterns in payroll data
    4. 04payroll-unauthorized-adjustment-detectordetect unauthorized payroll adjustment events
    5. 05cross-hcm-payroll-headcount-correlatorcorrelate payroll payments to HCM headcount records
    6. 06case-report-generatordraft case report from payroll + HCM correlation findings

  • WFM timesheet abuse kit

    5 steps

    drop UKG WFM + payroll exports → overtime inflation detect → payroll/WFM timesheet cross-correlate → report

    1. 01evidence-manifest-generatorhash WFM + payroll exports together
    2. 02ukg-workforce-scheduling-audit-log-forensic-analyzerparse UKG workforce scheduling audit rows
    3. 03payroll-overtime-inflation-detectordetect overtime inflation patterns in payroll data
    4. 04cross-payroll-wfm-timesheet-correlatorcorrelate scheduled hours to paid overtime
    5. 05case-report-generatordraft case report from WFM + payroll correlation

  • comp to cash reconciliation kit

    8 steps

    drop comp benchmark + equity + payroll + total rewards exports → band vs pay vs exercise cross-check → report

    1. 01evidence-manifest-generatorhash comp, equity, payroll, and rewards exports
    2. 02pave-compensation-benchmark-export-forensic-analyzerparse compensation benchmark band rows
    3. 03carta-equity-cap-table-export-forensic-analyzerparse equity grant + vest rows
    4. 04adp-payroll-audit-log-forensic-analyzerparse actual payroll payment rows
    5. 05sequoia-total-rewards-export-forensic-analyzerparse total rewards statement components
    6. 06cross-comp-payroll-benchmark-correlatorcorrelate benchmark bands to actual pay
    7. 07cross-equity-payroll-exercise-correlatorcorrelate equity exercises to payroll
    8. 08case-report-generatordraft case report from benchmark vs pay vs equity chain
// pattern-matched

related tools

tools that the manifest-classifier flagged as plausibly useful here but that aren't in the hand-curated lists above. less editorial weight — scan, don't work top-down.

+ 2 more in this pattern match. browse the full forensics catalog via the forensics category.

ready