Ghost Employee Fraud in Eastern Europe: Detection and Prevention
Ghost employees — fictitious workers added to payroll by insiders or contractors — are a growing risk in Eastern European remote teams where identity verification is weak and management oversight is thin. Here is how the fraud works and how to stop it.
What is ghost employee fraud in a remote Eastern European context?
Ghost employee fraud occurs when a fictitious person — or a real person who does no work — is added to a company's payroll, typically by an insider with payroll access. In Eastern European remote team contexts, this takes two main forms: an external contractor submits invoices for a team member who does not exist, or a legitimate employee creates additional fictitious worker identities to claim additional salary payments.
The fraud is difficult to detect remotely because the manager never meets the workers in person, communication happens through established channels that can be managed by one person, and work output — particularly in software development — can be partially fabricated or duplicated. Independent identity verification of every team member before payroll registration is the primary control.
How Ghost Employee Fraud Is Structured
- The insider model. A legitimate employee or contractor with payroll access adds a fictitious person using a fabricated identity — name, national ID, and bank account. The account is controlled by the fraudster. This requires only payroll system access and a secondary bank account.
- The contractor inflation model. An outsourcing contractor invoices for a team of, say, eight developers but only six exist. The invoiced salaries for the fictitious two are retained by the contractor. The client company, never having met the team, has no mechanism to detect the discrepancy without independent verification.
- The duplicate identity model. A real employee registers under two slightly different name variations — using a middle name, a nickname, or a transliteration variant — and receives two salary payments. In countries with Cyrillic-to-Latin transliteration variations, this is easier to execute than it sounds.
Prevention Controls
- Live video onboarding with document presentation for every hire
- Independent civil registry verification of each identity — not just document review
- Personal tax ID cross-check against the national tax authority database
- Bank account name confirmation — must match the registered employee name exactly
- Unique email and communication account per employee — flag shared device logins
- Periodic unscheduled video check-ins for all payroll-registered team members
Detection Signals
- Two employees sharing a bank account, address, or national ID
- Payroll records showing a worker who never appears in video calls or communications
- A contractor's team size that does not match output capacity
- Name variants that resolve to the same person under civil registry check
- An employee whose identity cannot be confirmed against any public record
- A new hire who refuses live video onboarding citing technical or privacy reasons