My husband recently experienced identity theft. Our mail was stolen, and tax information was gathered. In the course of a few weeks, over 12 credit cards were opened as well as a bank account. My husband has been on the phone constantly with credit card companies, credit bureaus, and the police to resolve the matter, but we know that this will be a long process and we will have to be vigilant. Everyone must be vigilant to protect their information and assets. Criminals are more sophisticated now and more creative.

Most Common Types of Payroll Fraud

In the payroll business, I see attempted fraud on a regular basis. Employers are the victims of these crimes and protective measures need to be in place. Payroll fraud comes in many guises and is often hard to identify. Here are a few methods that are used to defraud a company through payroll:

Timesheet Fraud. Often referred to as “Buddy punching,” this type of fraud involves an employee adding unauthorized hours to their timesheet. This type of fraud may go unnoticed for a long time because it may be done in small increments, a few hours here and there.
Ghost Employees. This type of scam is usually committed by an employee who is trusted and has access to payroll. A “ghost” employee is set up in the system to receive direct deposits.
Payroll Diversion Scam. This is the most common scam that we are seeing now. Typically, the HR representative receives an email which appears to be from an employee of the company requesting to change their direct deposit for the current pay period. Once payroll processes, the pay for the employee is diverted to this wrong account. Propel HR recently stopped such a transaction which included a large year-end bonus that was routed to a pay card that our system recognized as fraudulent. The FBI reports that the average dollar loss reported in direct deposit change request is $7,904.

 6 Ways to Protect Your Payroll

In today’s modern world, we are more at risk to become victims of crime. What can businesses do to protect payroll?

Keep staff informed. Whether formal cyber training or regular communication on scams and security measures, employees need to be able to recognize phishing and spoofing emails as well as other potential threats.
Review and constantly update IT. It is important that cyber security is a focal point of IT needs. If the company is too small to maintain their own IT department, consider outsourcing and have the firm provide regular security assessments.
Embrace protective technology. Yes, it may be a pain to open an encrypted email, but it is worth the trouble. Email encryption is a simple way to protect employee data. Other tools that are simple and can greatly reduce fraud are multi-factor authentication for payroll access and using positive pay, fraud-prevention system offered by most commercial banks, to verify all checks presented. Also, require employees to regularly change their passwords.
Implement controls. Set up proper security measures for employees with payroll access. There needs to be a system of checks and balances, and permission levels should be regularly reviewed.
Scrutinize payroll reports. This is the most important step of the process and should be performed by both the HR representative tasked with payroll as well as a senior person in the company. Review the final payroll register for accuracy. Look for ghost employees, padded hours, and any unauthorized advances or changes. This not only reduces your risk for payroll fraud but also gives you time to catch any honest mistakes.

Pick up the phone. This sounds too simple, but it may be the most effective way to prevent payroll diversion. If you receive an email request to change a direct deposit account, pick up the phone and confirm with the employee. However, call the number in the company directory, not the phone number on the email signature line.

Payroll fraud is real. The victims are both hard working employees and the companies that employ them. But fraud can be prevented. It is important that we are all more aware and are more vigilant around email, internet, and payroll processes. There are simple things we can all do to make our data safer. As for my family, we installed a locking mailbox and placed a credit freeze on our accounts. It may seem a little excessive, but it gives us piece of mind that we can take steps to protect our data and assets. Wouldn’t you have a greater piece of mind if you knew you were taking all steps to protect payroll?

About Propel HR. Propel HR is an IRS-certified PEO that has been a leading provider of human resources and payroll solutions for more than 20 years. Propel partners with small to midsized businesses to manage payroll, employee benefits, compliance and risks, and other HR functions in a way that maximizes efficiency and reduces costs. For more information, visit www.propelhr.com.