Fictitious Payroll

Illicit funds are integrated into the financial system as normal payroll or employee compensation, thereby legitimizing their final usage and blending them with legitimate capital.

Criminals create or manipulate corporate customers with opaque or inflated payroll structures, such as mini umbrella companies or ghost employees, to conceal true ownership and workforce details. This technique leverages suspicious wage disbursements and false reporting, making the business itself a high-risk customer from a financial institution’s perspective.

Payroll processing and wage distribution systems are exploited because routine salary disbursements are rarely scrutinized at each payee level. Criminals insert ghost employees, inflate legitimate wages, or forge contractor payments to channel illicit funds as ostensibly legitimate payroll expenses, thereby exploiting the inherent vulnerabilities of payroll services themselves.

Contains formal financial statements, tax returns, and business filings detailing labor costs, revenues, and workforce information. This enables investigators to compare declared payroll expenses against official tax declarations, identify discrepancies (e.g., inflated wages), and uncover ghost or phantom employees by analyzing potential mismatches in reported labor costs and actual tax or financial records.

• Includes official contracts and invoices documenting the nature and value of contractor services.
• Allows AML staff to validate contractor payments within payroll, detecting any fabricated or non-existent services billed as payroll expenses.

• Records the details of every financial disbursement, including amounts, timestamps, recipients, and account references for payroll payments.
• Helps detect repeated payroll disbursements to the same individuals, multiple employees sharing the same bank account, and other anomalies indicative of ghost employees or fictitious wages.

• Provides detailed information on each bank account's ownership and transaction history.
• Facilitates the detection of multiple employees or contractors receiving payroll payments into the same account or other patterns indicative of fictitious payroll schemes.

• Provides official HR data for all employees, including personal details, roles, and employment status.
• Enables cross-checking of payroll recipients against verified employees to identify ghost employees or inflated workforce counts.

• Captures the overall scope of an entity’s operations, including production volumes, client base, and typical employee headcount.
• Allows comparison of reported payroll outlays with actual business size, revenues, and operational scale to detect inflated wages or fabricated workforce claims.

• Contains information on corporate registration, shareholders, and beneficial owners.
• Enables identification of overlapping ownership among so-called mini umbrella companies used to divide payroll artificially and evade certain thresholds.

For higher-risk industries or suspected payroll irregularities, request supplementary payroll tax filings, verifiable wage registers, and proofs of work performed. Validate the declared workforce size and compensation against third-party data (e.g., union or trade associations) to detect overstated wages or non-existent contractors.

During the onboarding and renewal process, require official payroll records, employee tax IDs, and wage documentation to confirm the authenticity of a company's workforce. Cross-check these details with labor or tax databases to expose fabricated or inflated employee rosters, directly targeting ghost employee schemes.

Implement targeted rules and alerts to flag multiple payroll transfers funneling to a single account under different employee names, sudden spikes in payroll, or disbursements misaligned with known staff headcounts. These triggers help detect ghost employee and inflated wage patterns before funds exit the system.

Conduct proper AML due diligence on external payroll processors or subcontractors. Confirm their licensing, ownership, and legitimate business operations to identify any overlapping beneficial owners or "mini umbrella" schemes that conceal fraudulent payroll outflows.

Deliver specialized training sessions that illustrate typical payroll fraud indicators, such as repeated transfers to a single account labeled under multiple employee IDs or abrupt workforce expansions with unclear funding sources. Encourage staff to escalate these red flags promptly.

Cross-reference declared employees and contractors with public records, social media, or external databases to verify their existence. Investigate if alleged staff lack any legitimate digital footprint or if "mini umbrella" entities share identical ownership attributes, which may indicate possible payroll fraud.

Continuously re-check payroll data against updated corporate filings, tax forms, and insurance contributions. By regularly reassessing a client’s workforce details, institutions can spot newly added ghost employees or suspiciously inflated salaries introduced after initial onboarding.

Some employers still issue paper or electronic checks for payroll. Criminals insert ghost employees or inflate wages, then write checks payable to personal or controlled accounts:

• The checks appear as standard payroll expenses, concealing illicit funds under typically unquestioned payment processes.
• Fraudsters can deposit or cash these checks, integrating illicit proceeds into the financial system under the guise of regular compensation.

Criminals exploit business or personal bank accounts to launder illicit proceeds disguised as legitimate payroll disbursements. For example:

• They set up direct deposits for ghost employees or padded wages, funneling extra funds into accounts they control.
• By mixing these inflated payroll entries with genuine salaries, the illicit transactions appear routine in bank statements, reducing AML red flags.
• Multiple accounts may be used across mini umbrella companies to remain under reporting thresholds, further obscuring suspicious activity.

• Generate fraudulent contractor or vendor invoices tied to payroll line items, channeling illicit funds under supposed business expenses.
• Rely on automated platforms unlikely to confirm the existence or legitimacy of the contractor, enabling covert payouts.

• Insert ghost employees into official wage distribution systems, funneling illicit funds back to criminals as purported salaries.
• Inflate legitimate employees’ wages to disguise additional proceeds as standard payroll expenses.

• Outsource wage distributions, reducing internal oversight and enabling systematically inflated or fictitious payroll remittances.
• Exploit batch payment platforms that may not rigorously verify each payee’s legitimacy or wage amount.

• Disperse unauthorized wage payments or contractor fees from ostensibly legitimate corporate accounts, masking illicit transactions under routine payroll.
• Enable layering of illicit funds by mixing fake salaries with normal business operations, making them harder to detect.

• Rapidly direct deposits to bogus employee or contractor accounts, shielding the scheme under standard payroll cycles.
• Exploit employer-provided payee information without stringent identity checks, facilitating ghost employee payouts.

• Fabricate or hide payroll entries in ledgers, ensuring ghost employees or inflated wages remain undiscovered during reviews.
• Provide cover through doctored financial statements and false reporting, stalling tax or external auditors from uncovering fraudulent payroll distributions.

• Set up multiple small entities or “mini umbrella companies,” each with minimal stated employees, to skirt regulatory or tax thresholds.
• Fragment real payroll data across shell corporations, concealing ownership and inflating payroll costs to launder funds.

Criminals use business entities, including shell or front companies, to:

• Set up multiple or 'mini umbrella' firms, artificially segmenting payroll to avoid tax or regulatory thresholds.
• Overstate workforce numbers and wages, channeling illicit proceeds under official salary outlays.
• Conceal beneficial ownership, making it difficult for financial institutions to detect inflated or non-existent payroll expenses.

Criminals exploit third-party payment processing to:

• Issue inflated or fictitious payroll disbursements through batch payment systems.
• Reduce direct oversight of each payee’s legitimacy or wage amount, enabling the integration of illicit funds as ordinary salary payments.

Fraudulent payroll funds are deposited into bank accounts, merging illicit proceeds into the financial system. Since wages appear to originate from legitimate paycheck sources, standard monitoring and due diligence measures may not immediately flag these transactions.