Fictitious Employer-Employee Fraud

A specialized variant of unemployment insurance fraud involving the creation of fake employers or nonexistent employees to file fraudulent claims. By forging the documentation of an employment relationship, criminals secure approval for unemployment or wage-related benefits and extract illicit proceeds framed as legitimate claims. In many cases, fraudsters falsely claim they work for legitimate companies or establish entirely fictitious entities, supplying fabricated employee and wage records to obtain government disbursements. Some schemes also revolve around employer-employee collusion, with the employee drawing unemployment benefits while continuing to receive unreported wages, maximizing illicit gains. Because payouts originate from a recognized government source, these transactions may evade typical AML scrutiny when treated as routine financial aid.

[
Code
T0144.016
]
[
Name
Fictitious Employer-Employee Fraud
]
[
Version
1.0
]
[
Parent Technique
]
[
Risk
Customer Risk
]
[
Created
2025-03-12
]
[
Modified
2025-04-02
]

Tactics

Criminals submit fictitious or collusive employer-employee claims for unemployment benefits, fraudulently obtaining government payouts as newly generated illicit proceeds. This tactic directly targets the creation of illicit capital from the outset.

Risks

RS0001
|
Customer Risk
|

This technique exploits weaknesses in verifying the authenticity of claimants' identities and employment records. Criminals submit fictitious or stolen personal details, fabricate job histories, and even invent entire businesses. Because these records appear valid (e.g., official pay stubs, business registrations), government benefit agencies and financial institutions may treat the resulting deposits as legitimate, thereby escaping standard AML scrutiny.

Indicators

IND00499
|

Employer-submitted wage documentation displaying repetitive or conflicting data points (e.g., identical addresses, phone numbers) across multiple claimed employees, inconsistent with typical HR records.

IND02784
|

Recently registered businesses with no demonstrable operational history filing multiple wage or unemployment claims for purported employees.

IND02786
|

Wage or unemployment claims referencing employees who cannot be located in standard employment or identity databases, lacking any verifiable work history.

IND02787
|

Business or personal accounts receiving significant government benefit deposits while showing minimal legitimate payroll outflows, with funds instead quickly withdrawn or transferred.

IND02788
|

Employees continuing to receive wages while simultaneously drawing unemployment benefits from the same or affiliated employer, evidenced by conflicting payroll and benefit deposit timestamps.

Data Sources

  • Data Provided: Official filings and historical financial documents (e.g., tax returns, profit-and-loss statements).
  • AML Relevance: Confirms whether declared wages and business income match legitimate financial history and tax data, helping detect forged or overstated wage records.
  • Data Provided: Publicly available information from social media, news outlets, and other open data sources.
  • AML Relevance: Helps detect nonexistent or dubious employment histories and spot red flags like fake profiles or inconsistent public records.
  • Data Provided: Detailed records of all incoming and outgoing financial transactions, including timestamps, amounts, and counterparty information.
  • AML Relevance: Identifies suspicious government benefit deposits, tracks concurrent wage and benefit payments, and flags rapidly withdrawn or transferred funds indicative of fraudulent claims.
  • Data Provided: Aggregated identity and legal status details from government registries and third-party providers.
  • AML Relevance: Exposes unverifiable or nonexistent employees when cross-referenced against official records, revealing fictitious or duplicated identities.
  • Data Provided: Centralized storage of wage statements, HR documents, and employer-submitted records.
  • AML Relevance: Enables detection of repetitive, inconsistent, or fabricated wage documentation used in fictitious employer-employee fraud schemes.
  • Data Provided: Ownership details, balances, and transaction histories of personal or business bank accounts.
  • AML Relevance: Identifies the receipt of large government benefit deposits, insufficient payroll expenditures, and overlapping wage and benefit payments in the same account.
  • Data Provided: Comprehensive details on employee identities, roles, and employment history.
  • AML Relevance: Validates legitimate employee information and helps expose fraudulent or nonexistent employees that are central to the scheme.
  • Data Provided: Information on a business’s operational history, revenue, and day-to-day activities.
  • AML Relevance: Reveals a lack of real commercial operations and legitimate payroll outflows, exposing fabricated employer-employee relationships.
  • Data Provided: Verified personal and business information, including identification details and ownership data.
  • AML Relevance: Checks the authenticity of alleged employees’ identities and the legitimacy of their association with the business.
  • Data Provided: Official records of business incorporation, ownership structures, and registration details.
  • AML Relevance: Verifies the legitimacy of newly formed or dormant businesses filing fraudulent wage or unemployment claims.

Mitigations

For newly created businesses or high-risk employer accounts filing multiple benefit-related claims, verify tax filings, wage reports, and staff rosters in greater detail. Validate the authenticity of payroll documents and employer credentials by contacting relevant government agencies where necessary. Uncover fictitious claims by confirming whether stated employees actually exist and are accurately reported.

During account onboarding or periodic reviews for businesses claiming payroll or unemployment-related transactions, systematically verify the employer’s registration status, operational presence, and payroll obligations with relevant government databases and external records. Cross-check that reported employees actually exist in identity sources and that claimed wages align with typical HR or industry norms. This directly targets fictitious employers who submit fraudulent benefit claims.

Implement tailored monitoring rules to highlight accounts receiving repeated or large government disbursements for unemployment or wage benefits. Flag cases where there are no corresponding payroll outflows or where employees inexplicably receive both wages and unemployment benefits from the same business, signaling possible collusion. These alerts isolate suspicious patterns employed in fictitious employer-employee schemes.

Provide specialized training to AML and account review personnel on detecting signs of fictitious employer-employee fraud. Demonstrate how to identify repeated or missing data points suggesting non-existent employees, recognize high-risk patterns for wage/unemployment claims, and escalate any anomalies for deeper investigation.

Cross-check newly formed or suspicious employer entities and their purported employees using publicly available records, such as government registers, social media, or directory listings. Investigate repeated addresses or contact details across multiple claimed employees, as well as the absence of any logical digital footprint for purported businesses. This measure helps uncover phantom businesses and fake employees used to exploit unemployment or wage benefit programs.

Initiate account service restrictions, such as temporary holds or blocking withdrawals, if the legitimacy of the employer cannot be corroborated or if contradictory evidence suggests fraudulent claims. Require credible proof of valid employment relationships before restoring normal account functions. This directly disrupts criminal attempts to rapidly disburse illicit funds derived from fabricated employer-employee schemes.

Instruments

  • Fraudsters create fictitious or shell businesses and open corresponding bank accounts, posing as legitimate employers.
  • Government agencies deposit unemployment or wage benefits for nonexistent employees into these accounts, believing them to be standard payroll-related transactions.
  • Because the deposits originate from an official source, banks often apply lower scrutiny, making it easier for criminals to disguise the fraudulent nature of the funds.
  • The illicit proceeds are then rapidly dispersed to personal or third-party accounts, withdrawn in cash, or otherwise moved to obscure their criminal origin.

Service & Products

  • Criminals set up or manipulate payroll systems to generate official-looking pay stubs for fictitious employees.
  • Submitted records inflate or fabricate wage histories, qualifying bogus employees for unemployment benefits.
  • Automated or third-party payroll solutions reduce scrutiny of unusual or repetitive payroll data, easing the path for fraudulent claims.
  • Fraudsters register a fictitious or shell business and open a corresponding bank account to pose as a legitimate employer.
  • Government benefit disbursements for fake employees are deposited into this account, lending an appearance of normal payroll activity.
  • Criminals then funnel these funds to personal or third-party accounts, rapidly dispersing the illicit proceeds.
  • Perpetrators enlist or impersonate these services to produce fabricated wage records and financial statements for nonexistent employees.
  • Fraudulent documentation appears formally audited or verified, increasing the likelihood of successful benefits claims.
  • Minimal oversight or collusion within bookkeeping processes can obscure the lack of genuine business activity.

Actors

Serves as the purported employer in fraudulent schemes by:

  • Acting as a genuine yet colluding company that certifies false employment for individuals claiming benefits while still receiving unreported wages.
  • Operating as a completely fictitious or shell entity established solely to submit wage and unemployment filings for nonexistent employees.
  • Leveraging registration details and payroll accounts that appear legitimate, making it difficult for financial institutions to detect abnormal benefit disbursement patterns.

Produces or alters wage statements, identity documents, and other records by:

  • Creating fictitious pay stubs or employee rosters to support false benefit applications.
  • Giving the appearance of valid documentation that can bypass standard verification checks, reducing flags by financial institutions or government agencies.
  • Collaborating with or being hired by fraudulent applicants or complicit businesses to authenticate nonexistent employment relationships.

References

  1. FinCEN (Financial Crimes Enforcement Network). (2020, October 13). Advisory on unemployment insurance fraud during the Coronavirus Disease 2019 (COVID-19) pandemic (FIN-2020-A007). FinCEN. https://www.fincen.gov/coronavirus

  2. Financial Crimes Enforcement Network (FinCEN). (2020). Advisory on Unemployment Insurance Fraud During the Coronavirus Disease 2019 (COVID-19) Pandemic (FIN-2020-A007). FinCEN. https://www.fincen.gov/coronavirus