Industry focus
Ghosts in the Machine
The Rise of AI Could Raise the Spooky Spectre of New Frontiers in Retail Fraud
When retailers reluctantly talk about the taboo topic of internal fraud, they euphemistically refer to “the enemy within”, those employees who, for a myriad of reasons—from greed to need—have used and abused the positions of trust bestowed upon them.
The word “reluctant” highlights the fact that for many businesses they simply do not want to acknowledge the existence of dishonest colleagues because it may reflect badly upon their candidate choices or that their vetting and internal security processes are at best lax or at worst non-existent or simply not fit for purpose.
The fact remains that dishonest colleagues are real people with real challenges—from gambling or drug addiction to those with a sense of entitlement, a twisted logic that justifies theft because they were overlooked for a pay rise or promotion. They could be seasonal staff stealing while they can get away with it in their narrow employment time window or seasoned store managers helping themselves to stock or cash over longer periods of time, but never enough to get caught.
Let us also not forget the real people who are coerced by organised retail criminal gangs into infiltrating retail supply chains in order to steal to pay a “debt” to their handlers. Their motivation is visceral in that they are temporary, transient, and trafficked under threat of violence and aggression, exposure, or deportation.
But the common theme is that they are all real employees whose behaviour is hidden in the system. But what about those employees who are deliberately hidden in systems—the ghosts in the machine? These spectres have been largely hidden because of the controversy surrounding their very existence.
We may be a few months away from Halloween, but these ghosts are quietly haunting businesses now in terms of long-term reputational and financial cost damages.
Ghosts, in employment terms, fall into two categories—legal and illegal. Firstly, there are those who, although engaged in legal operations with those who employ them, silently remain in the background because of the transient and precarious conditions they work under.
These are the essential workers behind the growth of artificial intelligence (AI), the “ghosts” who are real people, who as keyboard warriors log in daily to laboriously teach and train the AI search engines to do what we all believe they already do. What we all know as “machine learning” is in fact driven by the humans—the labellers and moderators who point the algorithm in the right direction as to the context of what it is seeing and what to do with it.
There have been numerous articles and “shockumentaries” in the US about the big tech companies who are making billions of dollars out of the AI models of today and tomorrow but pay as little as a few cents an hour for hundreds of thousands of people within its own Silicon Valley “gig economy” to make AI look like effortless magic.
When we log into the numerous search engines or are looking for matches for facial recognition, it is this sweat shop of human effort teaching the machines that allows it all to happen. Ironically, behind the technology that will revolutionise human existence by removing the need for repetitive data searches is a poorly renumerated human having to do all the work for little reward. In short, there is little earning in machine learning.
Illegal Ghost Worker Fraud
The growth of AI will also complicate the employment picture in relation to the second, yet illegal, category of ghost workers. This is because of the mushrooming trend in outsourcing functions such as payroll to third parties, many of whom engage with AI models to boost efficiencies. The overall impact of this perfect storm will be the creation of less transparency around employment practices.
Indeed, outsourcing payroll—ironically to make savings on staff salaries—can inadvertently create expensive opportunities for ghost worker fraud. External payroll companies who are unfamiliar with the workforce may process payments for non-existent employees without realising the deception that has probably been instigated by long-serving managers with insider knowledge who are being economic with the truth. Compound this issue with the advent of AI models mimicking the existing payroll process and the opportunities for hidden fraud suddenly multiply.
What is a Ghost Worker?
Whereas we have spoken about the real people in
business—either seen or unseen—the second type of “ghost workers” are so-called because they often do not technically exist. These individuals fall into the illegal world of fraudulent payroll payments for “phantom” employees.
As such, HR industry experts have defined a ghost worker as an individual listed on a company’s payroll who doesn’t actually work there. Indeed, sometimes, these spectral staff members are for fraudulent purposes entirely fictitious, yet despite their non-existence, these phantom employees continue to receive regular payments, silently draining company resources.
While it’s challenging to execute such an audacious fraud in small businesses where everyone knows each other, larger corporations with multiple departments or locations provide the perfect cover for ghost workers to thrive.
Creating a Ghost Worker
To establish a ghost worker, the perpetrator, who for the purposes of this example is our long-serving manager with access to the payroll of his or her team must:
Input all necessary details for the “employee”.
Ensure the ghost worker appears on the payroll.
Provide salary information within the organisation.
Set up a payment method for the fictitious employee.
For the initiated manager, the scam is seen as low risk because they have painstakingly scrutinised the poor processes put in place by external payroll teams and found it wanting. Exploiting it is therefore simply a matter of setting up separate bank accounts to receive multiple payments on top of their own legitimate salaries.
According to a global study—Occupational Fraud - A Report to the Nations”—from the Association of Fraud Examiners, ghost worker scams are not only on the increase, but make up an established and growing work-based scam trend accounting for eight per cent of reported cases and resulting in substantial financial losses.
Cases are expensive and far from isolated, according to the report which provides global examples of the practice.
The Impact of Ghost Workers
According to the report, ghost worker fraud is more than simple financial mischief. It’s a serious crime that, if not detected:
Depletes company resources
Undermines payroll integrity
Can result in severe legal consequences
Damages organisational trust and reputation
One example quoted in the global report was the Passenger Rail Agency of South Africa (PRASA) where its payroll systems were compromised by the creation of ghost workers. An investigation by the South African government discovered that almost 1,500 PRASA employees could not be verified—there was no human trace of them.
Furthermore, identifying the ghost worker issue saved the South African Government payroll and taxpayer 200 million Rand (£828,350).
The Occupational Fraud report said the overall global cost of payroll fraud which included ghost workers amounted to a staggering £17 billion.
Nigeria’s Federal Audit uncovered 23,000 ghost workers siphoning off $11.5 million monthly through falsified bank accounts and duplicate salaries. The Government had to implement biometric verification and cross-check bank details to identify discrepancies, such as payments to non-existent personnel.
Similarly, the World Health Organisation (WHO) noted Nigeria’s Integrated Payroll and Personnel Information System (IPPIS) later identified systemic vulnerabilities in manual processes. These cases underscore the importance of regular HR identity checks and periodic audits, especially in regions relying on paper-based systems.
Global Retail
But it’s not just the public sector at risk. Sectors such as retail and hospitality are also a target.
In the US last year, a phantom employee scam led to a public appeal from the Manheim Police Department for the whereabouts of the manager of a Wendy’s burger restaurant in Philadelphia after she disappeared from the company along with her “alter ghost ego” William Bright.
Linda Johnson had devised the cunning plan to create the fictitious Bright as a front of house employee, and by manipulating the time-keeping system had clocked in and out as him for no less than 128 shifts, pocketing a total of $20,000 in just one year.
The growing issue of ghost employees was also covered in Loss Prevention Magazine in the US, the sister publication of Loss Prevention Magazine Europe, in its Spring 2025 issue.
The article—Ghosts in the Payroll: The Fraud You Don’t See Coming—told the story of when a warehouse supervisor in Ohio noticed that their payroll budget was creeping up despite no new hires. The business went on to discover that three employees who hadn’t clocked in for weeks were still getting paid.
“Meet the ghost employee: a fake or inactive worker who stays on the books, quietly collecting pay checks while no-one’s looking. In retail—especially high-turnover operations—they’re more common than you’d think and spotting them takes more than just an eagle-eyed payroll team,” the article said.
According to Wayne Hoover, CFI senior partner at Wicklander Zulawski in the US, “The companies that I dealt with were operating before advanced analytics became available—tools that could have flagged this type of fraud early on.”
“Back then, pay cheques were still being written and handed out manually instead of via direct deposit. Today, you’d be able to run a report and see if a bank account number is linked to more than one employee.”
Why They Do It
Motivations vary for why anyone would engage in such internal subterfuge, but the evidence suggests it is more than pure greed.
“One of the individuals I interviewed admitted he did it because he had gambling debts,” added Wayne.
“Another woman said she started the fraud to help cover medical bills for her grandmother. There’s a wide range of reasons people commit theft—financial pressure, peer influence, spur-of-the-moment decisions, or even the belief that they’re owed more because they’re doing the work of two people without a raise.”
“Understanding these drivers is key to building both better systems and better cultures—ones where employees feel heard, valued, and less likely to justify unethical behaviour,” he added.
The LP Magazine article on phantom employees goes on: “Sometimes it’s a clerical error. Other times, it’s deliberate fraud. Either way, these phantom workers can quietly drain thousands from payroll if no one’s paying close attention.”
“Retail operations—especially large warehouses and fulfilment centres—are a prime environment for ghost employees to slip through unnoticed. The combination of high turnover, complex systems, and fragmented oversight creates the perfect storm for payroll fraud to thrive.”
“First, the high turnover common in retail makes it difficult to keep accurate records. Employees are frequently hired, fired, or quit, and these changes aren’t always promptly reflected in HR or payroll systems. As a result, former employees or even fake identities can remain on the books, collecting pay cheques, despite not working.”
“The sheer size of retail operations further compounds the issue. With multiple departments—HR, payroll, security, and scheduling managers—working in silos, discrepancies can easily go unnoticed. Poor communication between these departments means that ghost employees can remain undetected for months, draining resources without raising any red flags.”
“Additionally, the increasing shift to remote work and the fast-paced nature of retail environments have made oversight more challenging. Physical headcounts are harder to verify, and without consistent checks, it’s easy for payroll discrepancies to slip through the cracks.”
How It Happens: Exploiting the System
In its summary, the article goes on to show how easy it is to implement.
The article said: “Ghost employees often slip through the cracks because of simple but dangerous weaknesses in scheduling and payroll systems. Here’s how fraudsters and careless employees can exploit these gaps”:
• Manipulating Scheduling Systems
In high-turnover retail environments, it’s easy for managers or employees to create false shifts or leave former workers on the schedule. These false shifts can go unnoticed, especially in busy operations where schedules are constantly changing.
• Insider Manipulation
Employees with access to HR and payroll systems can add fake workers or fail to remove terminated employees from the payroll. “I noticed that in the companies where I handled these types of cases, the manager was responsible for distributing pay cheques to each employee on payday,” recalled Wayne. “This gave them complete control—and no one realised they were pocketing extra pay cheques using ghost employees.”
• Biometric Workarounds
In some retail operations, biometric timekeeping systems (such as fingerprint or facial recognition) are used to clock in and out. Fraudsters can bypass these systems by using fake data or “buddy punching,” where one worker clocks in or out for another.
• Lack of Oversight
When HR, payroll, and security systems aren’t well integrated, discrepancies can go unnoticed. In large retail operations, where employees come and go frequently, missing or duplicate records are harder to detect. “I found that a lack of separation of duties was the biggest mistake companies made,” Wayne said. “Following that up with regular payroll reconciliations could have caught these issues much earlier.”
Spotting the Signs
So how do businesses go about identifying a culture of dishonesty?
Since ghost workers don’t exist, it’s impossible for them to show up for work, although the fraudster can manipulate attendance or time keeping records to give the false impression of a productive member of the team. Here, unusual patterns in attendance or overtime claims can prove invaluable to an investigator as do frequent early arrivals or other deviations from normal attendance.
Multiple salary payments going into the same bank account would also be a giveaway, which is why fraudsters often set up bogus accounts, sometimes with co-conspirators, making it harder to detect.
Audacious fraudsters may create fake employee records in the payroll system or, in the case of someone with intimate knowledge of the payroll system, make use of former employee records that have not been cleansed from the system, post their leaving the business.
Likewise, they may exploit the presence of temporary workers in retail whose names remain on the payroll because they may return seasonally although are not there for most of the year.
Other tell-tale signs are around performance reviews, or lack of them. The invisibility of a ghost worker because of their lack of interaction with supervisors and non-attendance at meetings or mandatory training sessions should raise questions.
All of these fraud hacks are only made possible by the lack of adequate internal controls and weak verification protocols and processes. These include poor or disorganised record keeping or as mentioned earlier the outsourcing of payroll to third parties unfamiliar with the specialist nature of businesses such as retail.
“Spotting a ghost employee starts with comparing records that don’t usually talk to each other such as payroll, scheduling, HR, and access logs,” the article continues.
“If someone’s collecting a pay cheque but hasn’t been scheduled, clocked in, or seen on-site, that mismatch is the first sign that something’s wrong. These gaps often show up during routine audits or when someone finally starts asking questions.”
“We are “back to office” at our company, so the challenge isn’t too bad, but we do use card access reports and timekeeping systems,” shared another industry expert. “These systems help ensure accurate tracking of employee attendance and work hours, reducing the risk of payroll errors or fraud.”
Technology adds another layer of protection. Facial recognition and badge-in data can confirm physical presence, while payroll software can flag unusual patterns, like employees being paid without hours logged. But even the best tools won’t catch everything without a culture of accountability, where red flags are investigated and teams know what to look for.
From Discovery to Prevention
According to the article, once a ghost employee is identified, time is critical. These immediate steps can mitigate the damage and prevent it from happening again:
Freeze all future payments tied to the ghost record. Whether it’s a fake name or a missed off-boarding, the goal is to stop the financial bleed immediately.
Investigate the source. Dig into how the ghost made it onto the payroll—was it human error, weak system controls, or insider fraud? Bring in HR, payroll, and security to trace it back.
Escalate when needed. If there’s evidence of deliberate fraud, involve legal or compliance, and consider law enforcement depending on the scale of the issue.
Use it as a reset point. One ghost is rarely an isolated incident. Re-assess your payroll processes, tighten system access, and retrain staff to close any gaps exposed by the incident.
“Even one bad record can quietly drain thousands from payroll. The key isn’t just finding the problem—it’s building a system that makes it harder for fraud to happen in the first place. Strong oversight, cross-team visibility, and a little healthy scepticism can go a long way in keeping your headcount honest,” the article concludes.
The moral of this story is that even if you are a non-believer who prefers not to acknowledge the existence of dishonest colleagues, ghosts can and do exist and need to be exorcised from the business as fast as possible before they spook the markets by delivering a truly frightening figure onto the bottom line
