Occupational fraud: the schemes that hit small firms

What occupational fraud is, the billing and payroll schemes that run through a small firm's payments, and the controls linked to lower losses.

By Achekam · 11 October 2026 · 5 min read · For Running a business businesses in South Africa, Nigeria, Kenya

The fraud most likely to hurt a small business is not a hacker in another country. It is someone on the payroll: a trusted bookkeeper, a long-serving buyer, a manager who has been there since the beginning. They know where the gaps are because they work in them every day, and the business trusts them precisely because nothing has gone wrong so far.

This is uncomfortable to think about, which is why many owners don't. But the schemes follow a small number of patterns, most of them run through the payments the business makes, and the controls that stop them are well known.

Fraud by the people who work for you

The ACFE, a professional association of fraud examiners, defines occupational fraud as fraud committed by a person against the organisation for which they work. Its Occupational Fraud 2026: A Report to the Nations, the 14th edition, is based on 2,402 real cases from 143 countries and territories across 22 major industry categories. The report uses those cases to show how such frauds are committed and how they come to light.

What makes occupational fraud different from theft by an outsider is access. The person already has a login, a role in the payment process, and colleagues who will not think twice about what they are doing.

Three families of fraud

ACCA groups the frauds a forensic accountant may investigate into three categories:

• Corruption: bribes, kickbacks and conflicts of interest, such as a buyer steering orders to a supplier who pays them on the side.
• Asset misappropriation: stealing cash, stock or other assets, or making the business pay for things it should not.
• Financial statement fraud: deliberately misstating the accounts, for example to hit a bonus target or hide losses from a lender.

ACCA states that asset misappropriation frauds are by far the most common. For a small business, that is where the controls should go first.

Billing and payroll schemes through the bank account

ACCA describes fraudulent disbursements, a form of asset misappropriation, as using company funds to make fraudulent payments. Its common examples are billing schemes, paying a fictitious supplier, and payroll schemes, paying fictitious "ghost" employees.

Billing schemes

The employee sets up a supplier that does not exist, or that exists only as a bank account they control. Invoices arrive for vague services, each modest, each approved by someone who has seen many like it. Variations include inflating a real supplier's invoice and collecting the difference, or having a genuine supplier invoice twice.

Warning signs: a supplier with no physical address or phone number that answers, a supplier whose bank account matches an employee's, round amounts for undefined services, and one employee who always handles that supplier.

Payroll schemes

A ghost employee is added to payroll, or a leaver is kept on it, with the salary paid into an account the fraudster controls. A simpler version changes a real employee's bank details to the fraudster's own account for one pay run.

Warning signs: employees nobody has met, bank details changed shortly before payday, two employees paid into the same account, and payroll prepared and released by the same person.

Anti-fraud controls and faster detection

The ACFE's 2026 report states that the presence of anti-fraud controls is associated with lower fraud losses and quicker fraud detection. Controls do not only stop fraud; they shorten how long it runs, which is what decides how much it costs.

The report also looks at how frauds come to light through tips. It finds the most common ways tips were reported were web-based channels (46%), e-mail (34%) and phone (23%). Even a small business can give staff a way to raise a concern with someone other than their manager.

A short list of controls that matter most for a small firm:

1. Two people on every payment: one prepares, one approves, and the approver looks at the supporting documents.
2. Independent checks on bank details: any new or changed bank account, for a supplier or an employee, is verified by someone other than the person who entered it.
3. Matching before paying suppliers: invoices are checked against what was ordered and what arrived.
4. A clean supplier list: new suppliers are vetted, and the list is reviewed for duplicates and dormant entries.
5. Surprise reviews: the owner pulls a few payments at random each quarter and follows them back to the evidence.
6. A reporting route: staff know whom to tell if something looks wrong.

Where Achekam puts a second person in the payment path

Several of these controls are built into Achekam's workflows:

• Employee bank details. An employee's bank account entered or changed by one person must be verified by another person before it is paid in the payment schedule or bank file. A one-run swap of bank details needs an accomplice.
• Pay runs. A pay run is approved by someone other than the person who prepared it, nobody can approve a run that pays themselves, and an approved run is never recalculated.
• Purchase orders. The person who raised a purchase order cannot approve it.
• Supplier invoices. A supplier invoice recorded against an order is matched with what was ordered and what arrived, and if price or quantity differ it is held until someone writes a resolution note. A bill without a purchase order waits for approval before it posts.
• Integrity review. A procurement integrity review, sold as its own add-on, raises questions about warning patterns such as competing quotes sharing contact or bank details, or a supplier paid into an employee's bank account.

These controls depend on the roles being held by different people. In a business where one person can both prepare and approve, the software cannot create the second person.

For examples by industry, see ghost workers and bank verification on building sites and warning signs of staff theft in retail.

Start here

The ACFE's Report to the Nations on occupational fraud sets out typical losses, the most common schemes, how frauds are detected and which controls work. Read its findings on controls, then list who in your business can create a supplier, change a bank account and approve a payment. Wherever one name appears on all three, you have found your first control to fix.

General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.