Casual Workforce Fraud and Payroll Leakage in Kenya: How to Prevent Ghost Workers, Time Theft and Duplicate Payments
Casual Workforce Fraud and Payroll Leakage in Kenya: How to Prevent Ghost Workers, Time Theft and Duplicate Payments
October 14, 2026
Introduction
Casual workforce fraud and payroll leakage can quietly increase operational costs for Kenyan employers. What begins as an extra name on an attendance register, an inflated shift or an unauthorised payment can become a significant financial loss when repeated across hundreds of workers.
Businesses employing casual workers are particularly vulnerable because of frequent workforce changes, decentralised operations, manual attendance records and pressure to process payments quickly.
However, not every payroll irregularity is fraudulent. Some losses arise from administrative errors, poor coordination or inadequate controls.
The solution is a reliable hire-to-pay process that verifies every worker, authorised shift, wage rate and payment.
This article examines common casual workforce fraud risks in Kenya and practical strategies employers can use to protect payroll accuracy, strengthen accountability and maintain employment compliance.
1. Understanding Casual Workforce Fraud and Payroll Leakage
Payroll leakage refers to avoidable workforce costs caused by fraud, errors or weaknesses in payroll administration.
Common examples include:
Payments to ghost or inactive workers.
Duplicate employee records and payments.
Inflated attendance, shifts or overtime.
Unauthorised salary-rate adjustments.
Incorrect or redirected payment details.
Unreconciled payments and statutory deductions.
Fraud involves deliberate deception for unauthorised financial benefit, while payroll errors may occur without dishonest intent.
For example, two employees sharing a mobile-money number might indicate suspicious activity, but this alone does not prove fraud.
Employers must investigate irregularities objectively before taking disciplinary action.
Strong payroll management combines prevention, early detection, accurate records and fair investigation procedures.
2. Why Casual Workforces Face Higher Payroll Risks
Casual employment arrangements often involve changing headcounts, multiple supervisors and short deployment periods.
These conditions can create payroll vulnerabilities when proper controls are missing.
Key risk factors include:
Manual attendance registers and disconnected spreadsheets.
Workers being deployed without documented approval.
Supervisors controlling attendance recording and approval.
Duplicate employee profiles across different locations.
Inactive workers remaining on payroll.
Unapproved overtime and attendance adjustments.
Weak verification of bank or mobile-money details.
Limited reconciliation between HR, operations and finance.
For example, a company operating several warehouses may have different supervisors submitting attendance sheets. Without a central employee database, the same worker could appear under multiple records.
Employers should therefore establish consistent workforce registration, deployment and payroll procedures across all locations.
3. Common Types of Casual Workforce Fraud
Ghost workers and duplicate employee profiles
Ghost workers are individuals included in attendance or payroll records despite not performing the corresponding work.
They may be fictitious employees, former workers who remain active or real individuals whose identities are used improperly.
Duplicate profiles arise when one employee is registered under different names, telephone numbers or identification details.
Prevention: Maintain a central employee database, verify identification documents and regularly reconcile workforce records against actual deployments.
Time theft and attendance manipulation
Time theft occurs when employees receive payment for time they did not work.
Examples include:
Clocking in for absent colleagues.
Inflating working hours.
Recording shifts that were never worked.
Changing attendance records after approval.
Claiming full shifts despite partial attendance.
Biometric systems can reduce impersonation, but they must be supported by effective supervision and controlled attendance adjustments.
Unauthorised overtime and wage-rate manipulation
Overtime payments can become a source of leakage when additional hours are not properly approved.
Similarly, unauthorised wage-rate changes may result in workers receiving incorrect payments.
Employers should require documented overtime approval and restrict access to payroll master data.
Payment diversion and duplicate payments
Payroll fraud can occur when employee bank accounts or mobile-money numbers are changed without verification.
Rejected transactions may also be processed twice if payment reversals are not reconciled.
Prevention: Require independent approval for payment-detail changes and reconcile every successful, rejected or reversed transaction.
Inflated outsourced labour invoices
Businesses using external labour providers may face unsupported invoices containing inflated headcounts, shifts, overtime or statutory charges.
Every invoice should be supported by approved deployment schedules, attendance records and agreed commercial rates.
4. Warning Signs Employers Should Monitor
Payroll fraud is often identified through unusual patterns rather than a single transaction.
Warning sign
Potential concern
Multiple workers sharing payment details
Identity duplication or payment diversion
Payroll headcount exceeding approved deployment
Ghost workers
Frequent manual attendance adjustments
Time manipulation or weak controls
Unusually high overtime under one supervisor
Unauthorised overtime
Workers paid after leaving
Inactive-worker leakage
Sudden wage-rate changes
Unauthorised payroll adjustments
Repeated failed and reversed payments
Duplicate payment risks
Payroll costs increasing without increased output
Attendance or rate inflation
Employers should investigate these exceptions before concluding that fraud has occurred.
Regular payroll exception reports help management identify emerging risks and prevent small losses from accumulating.
5. The Financial Impact of Payroll Leakage
Even minor attendance or payment errors can create substantial losses when repeated across a large workforce.
Consider an organisation deploying 450 casual workers.
If approximately 14 invalid shifts are paid daily at KES 900 per shift over 26 working days:
Monthly payroll leakage:
14× KES 900× 26=KES 327,600
Estimated annual leakage:
KES 327,600× 12=KES 3,931,200
This illustrative calculation excludes potential overtime errors, statutory costs, investigation expenses and other administrative losses.
The example demonstrates why payroll controls should focus on identifying repeated exceptions before they become significant financial liabilities.
6. How Employers Can Prevent Casual Payroll Fraud
An effective fraud-prevention strategy should cover the entire workforce process, from recruitment to final payment.
A. Strengthen employee registration and onboarding
Every casual worker should have a unique, verified employee profile containing the information necessary for lawful employment and payment.
HR teams should check for duplicate records before creating new profiles.
Returning workers should be reactivated using their existing verified records rather than registered as entirely new employees.
B. Control workforce deployment
All casual labour requests should specify:
Required headcount and job category.
Approved work location and shift.
Engagement period and applicable wage rate.
Authorising manager or supervisor.
Only workers assigned to approved shifts should qualify for payment for those shifts.
C. Implement reliable attendance systems
Employers should use attendance systems that accurately record working hours and maintain an audit trail.
Biometric attendance, supervised digital check-ins and access-control records can improve reliability.
However, attendance technology should be supported by clear procedures for correcting missed clock-ins, system failures and legitimate exceptions.
Because biometric information is sensitive personal data, organisations must also consider applicable Kenyan data-protection requirements.
D. Separate payroll responsibilities
No single employee should control worker registration, attendance approval, wage-rate changes and payment authorisation.
Responsibilities should be divided between HR, operations and finance.
For example:
HR: Employee registration and record management.
Operations: Deployment and attendance verification.
Payroll: Calculation of approved wages and deductions.
Finance: Payment approval and reconciliation.
Management: Review of payroll exceptions and unusual trends.
Smaller organisations can introduce compensating controls such as independent management reviews and restricted system permissions.
E. Strengthen overtime and payment controls
Overtime should ordinarily be approved before employees work additional hours.
Payroll teams should compare submitted hours against attendance records, approved shifts and operational requirements.
Employee payment details should be verified independently whenever changes are requested.
Before releasing payments, finance should confirm that the approved payroll totals match the final payment file.
F. Reconcile payroll and statutory obligations
Payroll reconciliation should confirm that workers were paid the correct amounts and that all transactions have been accounted for.
Applicable statutory deductions and employer contributions should also be checked against payroll schedules and payment confirmations.
Rejected payments, reversals and replacements must be investigated and reconciled to avoid duplicate payments.
7. Using Payroll Analytics to Detect Fraud
Employers do not necessarily need expensive technology to identify payroll anomalies. Structured reports and basic spreadsheet analysis can reveal potential losses.
Useful monthly checks include:
Employee verification: Duplicate identification numbers, employee records and payment details.
Attendance analysis: Missing clock-outs, overlapping shifts, unusual manual adjustments and attendance recorded after employment has ended.
Payroll analysis: Duplicate payments, unexplained wage increases, excessive overtime and payments without approved attendance.
Operational analysis: Payroll-cost changes compared with staffing levels, production output and authorised labour requirements.
Management should assign responsibility for reviewing exceptions and resolving them before payroll approval.
8. Investigating Suspected Payroll Fraud in Kenya
Discovering suspicious payroll activity does not automatically justify dismissal or recovery of money from an employee.
Employers should follow a structured and fair investigation process.
Recommended investigation procedure
Preserve evidence: Secure attendance records, payroll reports, approvals, system logs and payment confirmations.
Identify the irregularity: Determine the affected transactions, workers, dates and potential financial exposure.
Conduct an impartial investigation: Where possible, involve individuals who did not participate in the disputed transaction.
Allow the employee to respond: Give affected employees an opportunity to explain allegations before disciplinary decisions are made.
Determine appropriate action: Base decisions on verified evidence, applicable policies and legal requirements.
Strengthen controls: Address the process weaknesses that allowed the irregularity to occur.
Under Kenya's Employment Act, 2007, sections 41, 43 and 45 are relevant to procedural fairness, reasons for termination and fair employment decisions.
Section 19 regulates deductions from wages. Employers should therefore avoid automatically deducting suspected losses without establishing a lawful basis.
Section 74 addresses employment-record requirements, making accurate workforce documentation important for both payroll control and compliance.
Investigations involving personal information must also comply with applicable data-protection requirements.
9. Managing Fraud Risks in Outsourced Casual Workforces
Outsourcing casual workforce management can help employers improve recruitment, supervision, attendance administration and payroll processing.
However, outsourcing alone does not eliminate fraud risks.
A labour outsourcing agreement should clearly define responsibilities for:
Employee verification and deployment.
Attendance recording and approval.
Payroll processing and statutory compliance.
Worker-level invoice documentation.
Payment reconciliation.
Fraud reporting and investigations.
Data protection and audit access.
Clients should verify that invoices agree with approved attendance, agreed rates and authorised headcounts.
Effective outsourcing depends on clear accountability, transparent reporting and regular reconciliation.
10. Monthly Casual Payroll Control Checklist
Before approving payroll, employers should confirm that:
Every paid worker has a verified employee profile.
Approved headcounts match actual deployment.
Attendance records support all payable shifts.
Overtime and wage-rate changes are authorised.
Duplicate employee and payment records are reviewed.
Inactive workers are excluded from current payroll.
Payroll variations have documented explanations.
Payment files match approved payroll reports.
Failed and reversed transactions are reconciled.
Applicable statutory deductions and remittances are verified.
Outsourced labour invoices have supporting records.
Outstanding exceptions have responsible officers and resolution deadlines.
Regular completion of this checklist helps strengthen payroll accuracy and management accountability.
11. How ACCUREX and PiPOHRIS Support Payroll Fraud Prevention
ThroughPiPOHRIS, employers can support more centralised employee records, attendance administration, payroll workflows and reporting.
When configured with suitable approval controls and reliable data, an integrated HR system can improve visibility over workforce changes, payroll exceptions and employee records.
Technology works best when supported by effective supervision, clear policies and regular management reviews.
Casual workforce fraud and payroll leakage can significantly affect business profitability when employee records, attendance systems and payroll procedures are poorly controlled.
Employers can reduce these risks by verifying worker identities, approving deployments, monitoring attendance, separating payroll responsibilities and reconciling every payment.
Regular audits and fair investigations are equally important.
The goal is not to create a workplace built on suspicion, but a workforce management process built on accountability, transparency and reliable evidence.
ACCUREX supports employers seeking to improve casual workforce management, strengthen payroll controls and reduce operational risk.
Frequently Asked Questions
1. What is a ghost worker?
A person included in attendance or payroll records without performing the corresponding paid work.
2. What causes payroll leakage?
Common causes include duplicate payments, inaccurate attendance, unauthorised overtime, incorrect wage rates and poor payment reconciliation.
3. Can biometric attendance prevent payroll fraud?
Biometrics can reduce attendance impersonation, but effective supervision, controlled adjustments and payroll verification remain necessary.
4. Can an employer deduct suspected fraud losses from employee wages?
Not automatically. Deductions must comply with section 19 of Kenya's Employment Act and other applicable legal requirements.
5. How often should employers audit casual payroll?
Key payroll checks should be performed every payment cycle, supported by periodic comprehensive workforce and payroll audits.
Talent Management. Performance Champion. Learning and Development. Coach and Mentor
With over 10 years in the HR arena, I'm not just seasoned; I'm practically marinated in success, specializing in turning chaos into controlled creativity. Change management, employee engagement, and training and development are my playground, and I play to win.