Payroll Fraud in Malaysia

Published September 21, 2017 · Updated October 16, 2026

How can you tell whether someone on your payroll is real? A fictitious employee means a ghost worker paid despite never working or having left long ago.

In this guide, we discuss the fictitious employee meaning in plain terms and five common payroll fraud schemes in Malaysia. We also cover warning signs, a payroll-control matrix, and practical steps businesses can take to prevent, detect and investigate fraud.

Who Counts as a Ghost Employee on the Payroll?

A fictitious employee is anyone on the payroll who provides no genuine work. It may be an invented person, a departed worker never removed, or a real individual colluding to share the salary.

The fictitious employee meaning matters because ghost workers rarely appear as obvious lines in the accounts. They hide inside ordinary payroll data, sitting beside genuine staff with plausible names, job titles and salaries.

In practice, a ghost employee is created when someone with access to payroll master data adds a record that should not exist. The record may be fully invented. It may reuse the identity of a former worker. It may even be a real person — a relative or friend of the employee who set it up — who never performs any work and splits the salary.

In Malaysia, the cost goes beyond the net salary paid out. The company still remits employer statutory contributions on that salary to the Kumpulan Wang Simpanan Pekerja (EPF) and PERKESO. It also deducts monthly tax deductions (MTD, also known as PCB) that must be declared to the Inland Revenue Board of Malaysia (LHDN). A single ghost employee can create significant losses once salary, employer contributions and leave entitlements are counted.

The scheme almost always involves someone with privileged access. That is why the controls later in this guide focus on who can create, edit and approve payroll records — not just on catching errors after payment runs.

How Does Payroll Fraud Happen in Malaysian Companies?

Payroll fraud is rarely a single dramatic act. In Malaysian businesses — from a small coffee shop business in Malaysia running casual staff to large multinational companies in Malaysia with thousands of payroll lines — it takes a handful of recurring forms, each exploiting a weak control point in the payroll cycle.

Understanding these schemes is the first step to designing controls against them. The five patterns below account for the majority of payroll fraud cases we see when clients bring us their payroll records for review.

1. Ghost Employees

A ghost employee is added to the payroll and paid like any other worker. The fraudster controls the bank account, collects the salary, and keeps the record looking unremarkable. The scheme survives because nobody reconciles the payroll headcount against actual staff on the ground.

2. Time Theft

Time theft includes buddy punching, inflated overtime, manual timesheet adjustments and phantom hours claimed for work never done. It is the most common scheme in shift-based industries such as retail, F&B and manufacturing, where timesheet data feeds directly into payroll.

3. Unauthorised Pay-Rate Changes

An employee or supervisor edits a pay rate, allowance or salary record in master data, often reversing the change after the payroll run. The fraudster receives a higher amount for one or two cycles, then restores the original figure so the anomaly is harder to spot.

4. Duplicate Bank Accounts

One person receives two salaries through two bank accounts — either as two employee records, or one record plus a duplicate line in the payment file. Bank detail changes made without verification are the classic entry point for this scheme, including phishing-style changes made through HR email.

5. False Expense and Allowance Claims

Employees submit fabricated mileage claims, duplicate receipts, inflated travel allowances or claims for expenses never incurred. Individually small, these claims compound across a workforce and are frequently paid with minimal supporting evidence.

What Are the Warning Signs of Payroll Fraud?

The clearest warning signs are payroll records that cannot be matched to a real, present worker. Missing EPF numbers, unverifiable bank details, duplicate identities and unexplained master-data changes all point to fraud.

Because payroll fraud is hidden inside routine transactions, warning signs tend to appear in patterns rather than single events. Business owners and finance teams should treat the following indicators as reasons to investigate, not as proof of wrongdoing on their own.

Common red flags include:

• payroll headcount that exceeds the number of people actually reporting to work or appearing in access logs;
• employee records without EPF or SOCSO numbers, or with contributions that never appear in EPF statements;
• bank accounts shared by two or more employee records, or sudden bank-detail changes shortly before payday;
• repeated manual adjustments, late overtime entries or rounded timesheet figures approved by the same supervisor;
• employees who never take leave, never attend medical checks or cannot be reached at their listed contact details;
• resignation or termination records that remain on the payroll after the final payment cycle.

A simple monthly habit catches many of these. Reconcile the payroll register against the headcount approved by department heads. Also reconcile it against statutory payment files submitted to EPF and PERKESO. Ghost employees rarely survive that reconciliation.

What Is a Payroll-Control Matrix?

A payroll-control matrix is a one-page summary that maps each payroll risk to a specific preventive control, a review frequency and a named owner. It converts vague intentions — "we should check payroll" — into an accountable routine.

For Malaysian companies, the matrix should cover the risk points identified earlier and reference the statutory touchpoints of EPF, SOCSO and MTD submissions. The version below is a practical template that can be adapted to any organisation's size and structure.

How Can Businesses Prevent Payroll Fraud in Malaysia?

Prevention is far cheaper than detection and investigation. The controls below are the ones that matter most in practice, and most of them cost discipline rather than money. Where a business lacks the in-house resources to run them, outsourced payroll services can provide independent processing and controls. These can form part of a corporate secretarial and payroll arrangement.

It is also worth remembering the downstream effects of clean payroll data. Accurate salary records drive correct MTD deductions, which flow through to each employee's personal income tax position. Fraudulent payroll data corrupts that chain for both the company and its staff.

1. Segregation of Duties

No single person should be able to create an employee record, approve the payroll and release the payment. In small companies where headcount makes full separation impractical, the owner should personally review the payroll register and approve the bank payment file before release.

2. Approval Controls

Every new hire, termination, salary change and bank-detail change should require documented approval from someone other than the person entering it. Payroll runs should be approved against a change log showing exactly what moved since the previous cycle.

3. Payroll Master-Data Controls

Restrict access to employee master data, log all changes, and run a periodic report of records created or amended between payroll cycles. Match the payroll headcount to attendance systems and department confirmations, and confirm statutory contribution files against EPF and SOCSO submissions.

4. Bank-Detail Verification

Verify any bank account change through a known contact channel — never solely through email, which can be compromised. Apply a cooling-off period before paying to a new account, and use bank account verification services where available. Duplicate account numbers across employee records should be blocked automatically.

What Should You Do If Payroll Fraud Is Discovered?

Fraud is not unavoidable, but no control environment eliminates every risk. When a business discovers a suspected ghost employee or other payroll fraud, it should respond through three distinct stages. Review what prevention control failed, determine how the issue surfaced, and investigate what happened. This is better than improvised crisis handling.

A practical sequence of steps is:

1. Preserve evidence — freeze payroll master-data logs, payment files and approval records before confronting anyone.
2. Suspend further payments to the suspect record, without alerting the person if an investigation is ongoing.
3. Reconcile payroll against statutory filings to quantify the loss, including EPF, SOCSO and MTD amounts.
4. Seek professional advice on the legal position. Payroll fraud can constitute criminal breach of trust and cheating under Malaysia's Penal Code. A police report may be warranted.
5. Recover funds where possible, correct statutory filings with the relevant authorities, and close the control gap that allowed the scheme to survive.
6. Communicate proportionately — notify your insurer if a fidelity policy exists, and inform stakeholders only as required.

The distinction between the stages matters. Prevention controls stop the fraud starting; detection controls surface it quickly; investigation establishes facts and supports recovery. Businesses that confuse these stages often destroy evidence or make employment-law missteps before the facts are established.

Conclusion

Payroll fraud in Malaysia most often succeeds where one person controls the whole payroll cycle and nobody reconciles the numbers. The fictitious employee meaning is simple at heart: a salary without a worker. Schemes built around it, from time theft to duplicate bank accounts, require deliberate, layered controls to stop.

A payroll-control matrix, strong segregation of duties and routine bank-detail verification prevent most losses. Detection reconciliations catch the rest early, and a disciplined investigation preserves the evidence needed for recovery. The earlier these controls are built into a payroll process, the cheaper they are to run.

As a technology-enabled Corporate Services Provider, 3E Accounting Malaysia supports businesses with outsourced payroll services, payroll-control design and statutory compliance across EPF, SOCSO and LHDN requirements. If you suspect a ghost employee on your payroll or want to strengthen your payroll controls before one appears, speak with our team today.

Frequently Asked Questions