payroll fraud / ghost employee — quick-start

checklist

1. freeze or revert any pending bank account or direct deposit change for the affected employee(s) before the next payroll cycle.
2. export the payroll platform's bank-change audit log — Workday, ADP, Paychex all retain who made the change and when.
3. identify who submitted the direct-deposit change request — employee self-service, payroll admin portal, or HR helpdesk ticket.
4. pull IT helpdesk tickets opened by the affected employee in the 30 days before the change — social engineering often precedes the change.
5. check for ghost employees: accounts created in HR within 90 days with no corresponding corporate email, badge record, or manager attestation.
6. pull payroll totals per cost center for the last 4 quarters — ghost employees appear as anomalous headcount without manager attribution.
7. export all payroll adjustments (one-time payments, off-cycle checks, retroactive adjustments) for the investigation period.
8. pull IdP sign-in logs for payroll admin accounts — unauthorized access to payroll systems often uses compromised admin credentials.
9. note whether the change request matched the employee's established communication pattern (same device, same IP range, same request channel).
10. begin the primary tool path below — payroll audit log analyzer and ghost employee detector.

primary tools

1. 01adp payroll audit log forensic analyzerdrop adp export · parse paycheck + employee + approver · runs locally
2. 02workday payroll export forensic analyzerdrop workday payroll export · parse payment + earning + user · runs locally
3. 03payroll ghost employee detectordrop payroll export · detect ghost employee patterns · runs locally
4. 04payroll unauthorized adjustment detectordrop payroll export · detect unauthorized pay adjustments · runs locally
5. 05payroll overtime inflation detectordrop payroll export · detect overtime inflation patterns · runs locally
6. 06cross hcm payroll headcount correlatordrop hcm + payroll exports · correlate headcount to pay run · runs locally
7. 07cross payroll wfm timesheet correlatordrop payroll + wfm exports · correlate paycheck to timesheet · runs locally
8. 08case report generatorfill in case number · examiner · dates · findings · drop evidence files for auto hash · generates structured forensic report PDF · runs locally

go deeper