12 Oct Ghost employees and payroll fraud: Should you use an undercover investigator?

A name on a payroll does not, by itself, establish that a person is genuinely employed or performing the work recorded.

In May 2026, the Department of Employment and Labour announced arrests connected to alleged TERS fraud involving more than 700 fictitious employees and losses exceeding R26.9 million. Although that case concerned relief claims, it raises a relevant question for employers: how independently are employee records verified?

Is an undercover operative the best starting point?

Usually, suspected ghost employee fraud should begin with a records-based investigation. The immediate task is to establish whether the people being paid exist, are legitimately employed and are entitled to those payments.

Relevant checks may include comparing:

• Payroll entries with approved employee records.
• Employment start and termination dates with payment histories.
• Attendance information with recorded shifts or overtime.
• Payroll amendments with their authorisations.
• Employee details with independently verified information.

An anomaly should be investigated before it is labelled fraud. Duplicate information or unexpected payments may have an innocent explanation.

When could undercover work become useful?

An undercover operative may be appropriate where the concern extends beyond inaccurate records to suspected workplace collusion.

For example, an investigation might need to establish whether people are knowingly confirming attendance for absent workers or whether supervisors and administrators are coordinating false information.

In those circumstances, workplace observations may help explain conduct that documents alone cannot resolve. They should support a broader investigation rather than replace payroll verification.

Why independence matters

If the person suspected of misconduct also controls the relevant records or approvals, asking that person to verify their own work provides limited assurance.

An independent investigation can compare information across departments, examine conflicting explanations and establish which findings are supported by evidence.

Match the investigation to the problem

A payroll discrepancy does not automatically require an undercover operative. The right approach depends on whether the unanswered questions concern documents, identities, approvals or conduct inside the workplace.

SSC Legacy can investigate suspected employee-related irregularities and help determine whether document verification, further enquiries or undercover support is appropriate.

Contact SSC Legacy to discuss suspected employee irregularities confidentially.