payroll fraud / ghost employee
unauthorized direct deposit changes · ghost employees · overtime inflation · payroll adjustment after termination. evidence is ADP/Workday/UKG payroll audit exports + HCM headcount cross-checks.
a guided path, not automation — each step opens a tool you run yourself; nothing uploads. progress is saved only in this browser.
wraps the payroll fraud kit preset — drop ADP/Workday payroll exports → ghost employee scan → unauthorized adjustment detect → HCM headcount cross-check → draft case report
guided steps
- evidence manifest generator
hash every payroll export before analysis — chain-of-custody for HR/legal
- adp payroll audit log forensic analyzer
parse ADP payroll audit rows — user, action, timestamp
- payroll unauthorized adjustment detector
detect unauthorized payroll adjustment events
- cross hcm payroll headcount correlator
correlate payroll payments to HCM headcount records
- case report generator
draft case report from payroll + HCM correlation findings
suggested options · title: payroll fraud investigation
when you're done
export a run summary — a small JSON record of which steps you marked done, your notes, and a self-hash so the record can't be silently altered. it is your reproducibility note, not a per-tool receipt: each tool emits its own input→output receipt when you run it.