How to Prevent Payroll Fraud and Ghost Workers in Small Nigerian Businesses

The cheapest protection against payroll fraud is not software. It is making sure that nobody can add a name, change a bank account and approve the payment on their own. Most small-business payroll theft in Nigeria, whether a ghost worker, a quietly altered account number or inflated overtime, survives for months only because one person controls the whole chain.

This page lists the common schemes, the controls that cost nothing, a quarterly check you can run in an afternoon, and what to do if you find something. It is written for owners and finance managers of businesses with roughly 5 to 100 staff, not for public-sector payrolls.

The five schemes to look for

• Ghost workers. Someone who does not work for you, or no longer does, is paid every month. The usual cause is a leaver who was never removed, sometimes on purpose by the person who prepares payroll.
• Altered bank details. A real employee's account number is changed to another account for the month, then changed back. The employee complains about non-payment, and the "mistake" is blamed on the bank.
• Duplicate accounts. The same person appears twice under slightly different names or with a second salary account.
• Inflated overtime or allowances. Overtime hours that cannot be matched to an approved sheet, or a new allowance added to one person without a letter.
• Unremitted deductions. PAYE or pension is deducted from staff but not paid to the state IRS or PFA, and the money is kept. This is also a compliance breach in its own right.

What a ghost worker costs: an example

A distribution company in Ikeja has 40 staff. Aisha, a storekeeper, resigned in January, but her name stayed on the payroll file. Her gross was ₦200,000 a month, so her net pay was ₦166,400 after pension and PAYE. The payroll clerk changed her bank details to his own account.

The loss came from one name among forty. Nobody saw it because a name that stays on the list does not change the total, and the company only looked at totals. The numbers came from our PAYE calculation module with the whole gross treated as pensionable.

Controls that cost nothing

These are habits, not purchases. Put them in writing and enforce them for the owner too.

1. Separate the three roles. One person maintains the employee list and bank details, a second prepares the monthly run, and a third (owner or finance head) approves the payment. If you have only two people, the owner approves and checks the master list.
2. Control bank detail changes. Accept a change only on a signed form from the employee, with a bank statement or account confirmation. Call the employee on the number already on file to confirm. Make the change effective from the next payroll, not the current one.
3. Name every addition and removal. A new starter needs a signed offer, an ID and a line manager's confirmation. A leaver needs a resignation or termination letter and a payroll removal date.
4. Have budget holders confirm headcount. Each month, each department head signs a list of the people they actually manage. The list is compared to payroll. Any name on payroll but not on a list is investigated before payment.
5. Hold an exception report. Print every employee whose net pay changed by more than 10% from last month, everyone new, everyone removed, and every bank account change. Read it every month. Our monthly reconciliation checklist shows the layout.
6. Cross-check the numbers that cannot lie. The PAYE paid to the state IRS and the pension paid to PFAs should tie to the payroll register. If the register says ₦201,300 and the receipt says ₦150,000, stop.
7. Match the bank file to the approval. The total approved should equal the total in the bulk payment file. See paying salaries by bank transfer, and do not let the preparer be the bank's only signatory.

Overtime and part-month pay

Overtime is the easiest line to inflate because it is a total, not a rate. Require a signed overtime sheet approved by the line manager before the cut-off, not after. The Labour Act sets no flat overtime rate for most private employees, so your handbook or contract is what defines the rate, and an approver can check the sum against it. For a part month, pay should follow your written method for prorating, covered in how to prorate salary, so the figure is not discretionary. A clear cut-off date also stops last-minute changes, as set out in payroll cut-off dates.

A quarterly check you can run in an afternoon

Four times a year, someone who does not prepare payroll should do the following. It takes about half a day for a business with 40 staff.

• Pick 10 names at random from the payroll register and physically verify each person: see them, or confirm by a call to their line manager.
• Sort the register by bank account number and look for duplicates. Sort again by account name and compare it to the employee name.
• Compare headcount in the register with headcount on the department lists and the pension schedule.
• List every change to bank details in the quarter and confirm each has a signed form.
• Compare PAYE and pension totals with remittance receipts.

Record the result and keep it in the audit file. If you are ever visited by the state IRS or questioned by an auditor, a signed quarterly check shows that you took control seriously. The routine these checks sit inside is described in the monthly payroll process.

Signs that something is wrong

Fraud rarely announces itself, but it leaves patterns. Be suspicious when an employee never takes leave and will not let anyone else touch "their" payroll files, when payroll is always late to be reviewed, when a department's headcount on the payroll is higher than the number of desks, or when staff cannot say who a named colleague is. Complaints from real employees about missing pay should be logged and traced even when the bank is blamed. Two or three of these together justify an unannounced check of the whole register.

If you find fraud

1. Secure the evidence. Take copies of the payroll files, bank statements, change forms and email logs. Restrict the suspect's access to the payroll system without telling them why, using a normal-looking reason.
2. Quantify the loss. Work out the months and amounts from the bank records, as in the example above.
3. Get advice. Speak to a lawyer before taking any action against an employee. A dismissal for misconduct still needs a fair process, which the disciplinary procedure guide explains. The National Industrial Court deals with employment disputes, and a criminal complaint is a separate route that a lawyer can advise you on.
4. Tell your bank. Ask what it can do to trace or hold funds in the receiving account. Speed matters.
5. Fix the control that failed and write down what changed.

Be careful with personal data while you investigate: only the people who need the payroll records should have them. Our page on employee data protection and payroll sets out the limits under the Nigeria Data Protection Act 2023.