Protecting organisations against fraud losses caused by ghost employees

Issue 7 2023 Risk Management & Resilience

Several key South African organisations are potentially incurring significant losses due to 'ghosts'; ghost employees who exist on paper within business or government departments, but not in real life.

This issue is criminal rather than paranormal in nature, whereby ghost employees are one of the most prevalent types of occupational fraud, perpetuated through illicit payroll activities, and potentially resulting in substantial losses for the organisations concerned, whether at the level of a business or government entity.

South Africa is not isolated in battling against this type of payroll theft; there have been many instances reported across Africa and even further afield, including the discovery of more than 80 000 ghost workers in the Nigerian police force, 30 000 on the Mozambican government payroll; and ghost employee scams also taking place within Zimbabwe and Kenya.

Ghost workers are not exclusively a challenge for the public sector either; large organisations with diverse environments can be just as vulnerable. To mitigate the risk and protect organisations, leaders need to invest in technology capable of accurately defining positive identity, thereby ensuring transactional validity, assuring trust and data integrity, and enforcing accountability.

The Association of Certified Fraud Examiners (ACFE) is the world's largest anti-fraud organisation, with over 90 000 members. In 2022, a global fraud study by the ACFE found that payroll fraud resulted in substantial financial losses overall and that the presence of ghost employees was a key element of payroll fraud1, accounting for 9%2 of reported cases globally.

The ACFE report notes, "Try as they might, organisations cannot prevent all fraud. If an organisation is operational long enough, eventually an employee will commit fraud. Consequently, the ability to quickly detect fraud is crucial. Our research indicates that the median duration of fraud – that is, the typical time between when a fraud begins and when it is detected – is 12 months. Additionally, the longer a fraud remains undetected, the greater the financial loss3."

How do ghost workers enter the system?

Ghost workers, who are fictitious employees loaded onto payroll and business systems with the simple goal of defrauding the organisation or committing a crime, can enter the system through various methods. These include being loaded or left in the system by corrupt employees, or being introduced by threat actors looking to do more than just defraud the payroll.

Many government institutions battle with the ongoing ghost employee challenge as they manage a vast network of databases, systems and computers that do not adhere to the highest level of data integrity. Tracking the ghosts is a daunting task, assuming that the business even knows they are there.

For public sector organisations and large businesses worldwide, it is imperative to create a comprehensive integrity management system, effectively managing and overcoming the challenges around counting employee heads accurately, and ensuring comprehensive visibility into the complexities of ghost employees, duplicate records and potential insider threats.

Datacentrix, a hybrid ICT systems integrator and managed services provider, encourages organisations to consider a unique transaction security solution, such as its own eDNA identity and access management (IDAM) solution that institutes people accountability across all critical enterprise applications. This solution is designed to eradicate ghost employees and any other forms of fraudulent transactions from public and private entities, validating employees through a fool-proof biometric identification process. This would include forensically examining and assessing specific transactions to ensure that the DNA of the payroll and other critical applications' activities are tied to a physical person, providing legally reputable evidence of every activity undertaken in the systems. This gives organisations an exceptional additional layer of preventative security.

eDNA presents nine steps to trusted data

Datacentrix's eDNA solution follows an authentication and trusted data management process to ensure that an organisation's individual identities and data are secured in the following order:

1. Secure enrolment that is compliant with positive identity governance, POPIA and Electronic Communications and Transactions (ECT);

2. Three-factor digital authentication that uses biometrics, then a PKI certificate, and finally a smartcard;

3. A secure access gateway, where logon is only permitted via eDNA's three-factor digital authentication process;

4. Customer-sensitive data transactions are performed that need to be secured;

5. Business rules are defined for tracking sensitive transaction data;

6. Transactions done with eDNA are signed and sealed at the data's source;

7. Using the basis of a business intelligence and alert system to build customer frameworks for business rule tracking and reporting;

8. The solution allows for the forensic production of legally accepted data evidence;

9. A tamper-proof system that ensures all computing facilities adhere to an end-to-end highest security level data platform and ultimate data protection.

The prevalence of ghost employees reflects broader issues of corruption and unethical behaviour, which can negatively affect society.

As noted by Nigerian Professor of Accountancy, Emmanuel Ikechukwu Okoye, "Fraud has become one of the greatest threats to the world economy. It is a global problem, not only in terms of its impact on our major corporations and key financial institutions, but also its effect on smaller companies and the wider public who indirectly pay for the losses through increased costs of goods and services.”

Rooting out ghost employees and ensuring that systems are in place to ensure they stay banished is an imperative undertaking for any organisation.

For more information on Datacentrix's eDNA offering, contact Rainer Jeske by emailing



[2] page 12 of the report

[3] page 14 of the report

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

The human factor side of video management systems
Leaderware Editor's Choice Surveillance Risk Management & Resilience
A video management system (VMS) is central to, and the most vital element to any control room operation using CCTV as part of its service delivery, however, all too often, it is seen as a technical solution rather than an operational solution.

Get the basics right to win more business
ServCraft Editor's Choice Risk Management & Resilience
The barriers to entry in security are not high. More people are adding CCTV and fencing to their repertoire every year. Cowboys will not last long in a space where customers trust you with their safety.

South Africa shows a 1200% increase in deepfake fraud
News & Events Risk Management & Resilience
Sumsub released its third annual Identity Fraud Report of the year, analysing identity fraud across industries and regions based on millions of verification checks across 28 industries and over 2 million fraud cases.

How hackers exploit our vulnerabilities
Information Security Risk Management & Resilience
Distractions, multi-tasking, and emotional responses increase individuals’ vulnerability to social engineering, manipulation, and various forms of digital attacks; 74% of all data breaches included a human element.

The illusion of good intentions
Risk Management & Resilience
The psychology of cyber criminals continues to be an intriguing aspect of discussions surrounding cybercrime. What cybercriminals do, particularly with ransomware, is neutralising perceptions of what they are doing by using business terminology.

Rapid rise in DNS attacks drives demand for new approach
Infrastructure Risk Management & Resilience
As ransomware grows more sophisticated and DNS attacks become more frequent, businesses are increasingly trying to protect themselves by adopting innovative approaches and technologies to bolster the integrity and security of their backup systems.

South Africans play a role in becoming scam victims
Editor's Choice Risk Management & Resilience
The South African fraud landscape is becoming increasingly risky as fraudsters and scammers look to target individuals with highly sophisticated scams, in an environment where it is becoming increasingly difficult for lawmakers and authorities to bring these criminals to justice.

Cyber threat anticipation
NEC XON Information Security Risk Management & Resilience
The ever-increasing number of sophisticated attacks on the horizon means organisations must evolve and adapt their cybersecurity strategies to protect their data, systems, and reputation.

Service orientation and attention to detail
Technews Publishing Editor's Choice Risk Management & Resilience
Lianne Mc Hendry evolved from working for an accounting firm to an accomplished all-rounder familiar with the manufacturing, distribution, and system integration aspects of the security industry value chain.

Gigamon announces the availability of its new Precryption technology
Information Security Risk Management & Resilience
Powerful technology captures packets inside the Linux kernel, bringing plaintext visibility to encrypted traffic to eliminate the most significant security blind spot across virtual, cloud, and container applications.