The Ghost Employee Payroll Fraud: How a Trusted HR Manager Stole £247,000 in Plain Sight

The Ghost Employee Payroll Fraud: How a Trusted HR Manager Stole £247,000 in Plain Sight

The outcome: A UK care home group discovered that its HR manager had been adding fictitious employees to the payroll for over two years, diverting £247,000 into bank accounts she controlled. A targeted investigation by UKPI uncovered the fraud, preserved court-standard evidence, and supported a successful prosecution that resulted in a 30-month custodial sentence.

The Situation

The client operated a group of four residential care homes across Yorkshire, employing approximately 220 staff. The business had grown steadily over the previous five years, adding two new facilities and nearly doubling its workforce. With that growth came complexity. The HR function, originally managed by the business owner alongside other duties, had been handed over to a dedicated HR manager three years earlier.

The HR manager, who we will refer to as Ms Turner, came with strong references and relevant experience from a similar role in the hospitality sector. She took full control of recruitment administration, payroll processing, and personnel records. She reported directly to the business owner, who trusted her to manage staffing without close oversight.

The first sign of trouble came during a routine discussion with the company’s external accountant, who noted that payroll costs as a percentage of revenue had crept upward over the previous 18 months, rising from 62% to 68%. The business owner initially attributed this to agency staff covering vacancies and the general upward pressure on care sector wages. But when the accountant compared headcount figures against National Minimum Wage calculations, the numbers did not add up. There appeared to be more people on the payroll than could reasonably be working across the four sites.

The business owner asked UKPI to investigate quietly, without alerting any staff.

The Challenge

Ghost employee fraud, where fictitious names are added to a payroll system so that their wages flow to accounts controlled by the fraudster, is one of the most common forms of internal theft in businesses with large, variable workforces. Care homes, hospitality companies, and construction firms are particularly vulnerable because they employ large numbers of part-time and shift-based workers. Staff turnover is high, new names appear on payroll regularly, and no single manager typically has visibility across every shift at every location.

The challenge for investigators is that the fraudster usually controls the very records that would reveal the fraud. In this case, Ms Turner managed the personnel files, processed new starter paperwork, and submitted payroll data to the external payroll bureau. If she had fabricated employees, she would also have fabricated their personnel files, and she would know immediately if anyone started checking those records internally.

UKPI needed to identify the ghost employees without accessing the HR system in a way that would alert Ms Turner, verify whether those individuals were real people performing real work, and gather evidence that would stand up in both criminal proceedings and civil recovery.

The Approach

The investigation proceeded through three parallel lines of enquiry: payroll data analysis, site-level verification, and digital forensics.

Payroll data analysis. Working with the external payroll bureau under a confidentiality agreement authorised by the business owner, UKPI obtained 24 months of payroll records including employee names, National Insurance numbers, bank account details, start dates, and hours worked. Our analysts cross-referenced this data against several indicators commonly associated with ghost employees.

The first flag was bank account clustering. Eleven employees were paid into just four bank accounts. While it is not unusual for a married couple to share an account, having three or four apparently unrelated employees paid into the same account is a strong indicator of fraud. The second flag was timing. Eight of the eleven employees sharing accounts had all been added to the payroll within a six-month window, during a period when two of the care homes were expanding. The third flag was hours. Several of these employees were recorded as working consistent hours every week with no variation, no sick days, and no holiday taken, a pattern that real employees almost never follow.

Site-level verification. UKPI arranged for discreet visits to each of the four care homes. Our operatives attended under the pretext of routine health and safety assessments, a cover agreed with the business owner. During these visits, shift supervisors at each site were asked to confirm which staff were on duty and to provide a list of their regular team members. None of the supervisors at any of the four sites recognised seven of the names identified through the payroll analysis. Four other names were recognised but described as people who had left months or even a year earlier, yet were still appearing on the current payroll.

This gave UKPI a list of eleven suspected ghost employees: seven who had apparently never existed on site, and four who had left the business but whose payroll records had never been closed.

Digital forensics and bank tracing. With the business owner’s authorisation, UKPI’s forensic team imaged Ms Turner’s company laptop and work phone. The examination revealed several telling pieces of evidence. Ms Turner had created personnel files for the ghost employees using a template that she modified with fictional details. Several of the files contained photographs downloaded from social media profiles belonging to people with no connection to the care industry. The files had been created in batches, with metadata showing they were produced within hours of each other rather than over the normal onboarding period.

Bank account tracing confirmed that the four accounts receiving payments for the ghost employees were held in names associated with Ms Turner’s family members. Two accounts were in the name of her adult son, one in her sister’s name, and one in the name of a former partner. Total payments to these accounts over the 26-month period came to £247,300.

UKPI also discovered that Ms Turner had been gradually increasing the hours recorded for the ghost employees over time, starting with modest part-time hours and building to near full-time equivalents. This gradual escalation, often called “salami slicing” in fraud investigation, is designed to avoid triggering sudden cost increases that might attract attention.

The Outcome

UKPI compiled a full evidence pack and presented findings to the business owner and their solicitor. The evidence included the payroll analysis, site verification records, digital forensic reports, and bank account tracing documentation. The business owner chose to report the matter to the police.

Ms Turner was arrested and later charged with fraud by false representation and proceeds of crime offences. She pleaded guilty at Crown Court and received a custodial sentence of 30 months. A confiscation order under the Proceeds of Crime Act was applied for, and approximately £89,000 was recovered from the identified bank accounts. The remainder of the loss was claimed through the company’s fidelity insurance policy.

Following the investigation, UKPI worked with the business owner to implement improved payroll controls, including separation of duties between HR and payroll processing, quarterly headcount reconciliation against site rosters, and independent verification of all new starters within their first month of employment.

The Lessons

Ghost employee fraud succeeds because of trust and poor separation of duties. This case illustrates several principles that apply to any business with a large payroll:

One person should never control the entire payroll chain. Ms Turner handled recruitment paperwork, personnel records, and payroll submissions. With no independent check at any stage, she was able to create and maintain fictitious employees for over two years. Separating these functions, so that one person adds employees and a different person authorises their payroll, is the most effective control against this type of fraud.

Departing employees must be removed promptly. Four of the ghost employees were real people who had legitimately worked at the care homes before leaving. Ms Turner simply continued their payroll records after departure and redirected their wages. A monthly reconciliation between the payroll and site rosters would have caught this immediately.

Bank account patterns are a reliable fraud indicator. Multiple employees paid into the same bank account is one of the strongest signals of ghost employee fraud. Payroll systems can be configured to flag duplicate bank details automatically, yet many businesses never activate this check.

External investigation preserves evidence and credibility. An internal investigation led by another member of staff would have alerted Ms Turner and given her time to destroy digital evidence or close bank accounts. UKPI’s covert approach ensured that the laptop data, payroll records, and bank account balances were all preserved before any confrontation.

Small, growing businesses are most vulnerable. The care home group had grown quickly, and its financial controls had not kept pace. Fraud often flourishes in the gap between a company’s growth and the maturity of its internal processes.

If you suspect payroll irregularities, unexplained cost increases, or potential ghost employees in your business, contact UKPI on 0800 043 1754 for a confidential discussion about how an employee investigation can uncover the truth and protect your business.