Introduction

In June 2025, the government of Telangana conducted an Aadhaar-linked audit of payroll data across state departments. What they found was staggering: nearly 7,000 contract and outsourced workers flagged for removal due to suspected salary fraud. Preliminary estimates suggest the fraud ran into thousands of crores.

This was systematic ghost worker schemes that had persisted undetected for years, hiding in plain sight within government systems.This guide walks through what ghost worker fraud actually is, how it works in contract labour operations, the real financial impact, and why traditional payroll controls fail to catch it until an audit unearths the damage.

What Is a Ghost Worker?

A ghost worker is any person on the payroll who is not actually working for the organization but still gets paid. The term feels abstract, but the reality is concrete: someone is collecting a salary they did not earn.

Ghost workers take several forms:

1. Completely fictional identities created in payroll systems

2. Former employees who were never actually removed from payroll

3. Duplicate entries (same person in system twice with different IDs)

4. Contractors billing for workers who never worked

5. Inflated headcounts (vendor claims 50 workers, only 45 actually worked)

Each manifests differently. Each requires a different control to prevent. And remarkably, most organizations have no idea which form of ghost worker they are vulnerable to.

Why Ghost Workers Persist Undetected: The Root Causes?

Disconnected Systems

Attendance is recorded in one system. Payroll is processed in another. Vendor invoices live in a third. No one system cross-checks all three.

Here is how fraud exploits this gap:

Day 1: Vendor submits invoice claiming 50 workers worked. No supervisor verification.

Day 2: Finance sees invoice, processes payment based on invoice alone.

Day 3: Payroll receives the bill, assumes it is legitimate, and creates entries for 50 workers.

Days 4-90: No one cross-checks. Did those 50 workers actually mark attendance? Are they still employed? Did they actually work on the specified days?

By the time someone notices, months of salary have been paid to workers who may have never existed.

Weak Maker-Checker Controls

Traditional payroll processing has weak segregation of duties:

• Same person who enters payroll data also approves it

• Supervisors do not verify worker existence before payroll runs

• No monthly headcount reconciliation

• Manual overrides allowed without strong justification

In the Telangana case, officials discovered patterns suggesting collaboration: “certain employees and agencies had allegedly worked in tandem to create bogus employee records and bank accounts.”

When payroll controls are this weak, fraudsters have free rein. One insider can create fake workers and collect their paychecks themselves.

Manual, Paper-Based Offboarding

When a worker is terminated, their data should be locked immediately in payroll and HR systems. Instead, many organizations handle it manually:

• HR updates a spreadsheet (one of many copies floating around)

• Supervisor tells finance “worker no longer here”

• Finance does not verify the termination

• Worker remains in payroll system as “active”

Months later, invoices still include the terminated worker. Paychecks still go out. No one notices because systems are not talking to each other.

In contract labour especially, offboarding is fragmented:

• Principal employer thinks HR (from the vendor) handles it

• HR (vendor) thinks principal employer will prevent payment

• Vendor thinks principal employer will not pay them if worker is removed

Result: Worker falls through every crack.

No Biometric Cross-Checking

Many organizations record attendance via biometric machines but never cross-check it with payroll.

Scenario: Worker X was marked absent for 10 days (biometric data shows no punch) but still received full salary in payroll. No alert. No question. This inconsistency is never flagged because attendance and payroll are separate worlds.

In a fraud scenario, biometric data could expose the ghost worker immediately. But if no one is looking at both systems together, the fraud continues.

Politicized Decisions and Poor Audit Culture

In government organizations (which set the tone for formal sector practices), transfers, approvals, and decisions are sometimes made outside normal channels. A worker might be transferred but never actually leave the payroll of the original department. Two people get paid for the same role. No one corrects it because it might involve a VIP or politically connected person.

In the private sector, the equivalent is lax audit culture: management prefers not to investigate anomalies to avoid embarrassment or conflict. So ghost workers are tolerated, even quietly known about, but never formally addressed.

How Ghost Worker Fraud Actually Happens: Real Mechanisms?

The Fake Identity Scheme

A payroll officer with access to the system decides to create a fake employee. They:

1. Create a fake name and ID in the system

2. Assign a salary (usually similar to real workers to avoid suspicion)

3. Create or use a bank account (sometimes their own, sometimes a compromised account)

4. Process monthly payroll

5. Paychecks go to the account they control

The Telangana audit found this pattern repeatedly: “officials attempted to create bogus employee records and bank accounts, siphoning off salaries from multiple departments and sharing the proceeds among themselves.”

The fake worker appears on payroll. They have an employee ID. They are in all the systems. But they have never set foot in the office.

Detection is hard because:

• Attendance records are separate (easily manipulated or marked absent)

• No one visually verifies all employees on payroll

• No background verification checks if the person actually exists

• Tax deductions might look normal because the fake salary is reasonable

This scheme persists for 24-36 months on average before discovery (ACFE report).

The Old Employee That Would Not Die

A worker is terminated. HR removes them from the active roster. But payroll is slow, manual, or bureaucratic. The terminated worker remains in the system as “inactive” but still collecting checks because:

• Finance department was not notified formally

• Manager still approves them in the timesheet by habit

• No automated flag removes them from payroll

• New manager does not know they are no longer supposed to be there

This is actually one of the most common forms of ghost worker. It is not a dramatic fraud. It is organizational sloppiness, but the financial impact is identical.

In contract labour, this happens when:

• Principal employer terminates the worker but vendor keeps billing for them

• Vendor terminates the worker but old invoice templates are reused, inflating headcount

• Worker "absconds" (disappears) but is not formally terminated, so payroll continues

The Duplicate Entry

A worker is entered in the system twice:

• Once as “John Smith” with ID 10045

• Again as “J. Smith” or “John Smyth” with ID 10101

Both IDs receive paychecks. Both show up on tax records (if not caught during PF/ESI filing). No one realizes it is the same person.

This happens because:

• Multiple vendors each onboard the same contractor

• System does not have duplicate detection

• Name spelling variations are not flagged

• PAN/Aadhaar are not mandatory for matching

In Telangana, this was identified as one of the fraud patterns.

Contractor Headcount Inflation

For example: Vendor bills for 50 workers. But only 43 actually worked. They invoice for 7 workers who never touched the site. The principal employer pays without verifying.

Why does this work?

• Invoice is submitted by vendor (assumed to be accurate)

• Principal employer does not cross-check invoice against attendance records

• Supervisor at site does not formally verify headcount

• Payroll just processes the invoice

The vendor pockets the payment for 7 phantom workers. This scheme can run for months because payments are processed weekly or monthly, and no one bothers to reconcile.