Software

Payroll fraud creates considerable losses for South African companies and taxpayers. The Public Servant Association revealed that ghost employees are costing the public purse nearly R4 billion. The Chartered Institute of Payroll Professionals estimated that payroll fraud steals at least R100 million annually from businesses and represents roughly 10% of business fraud cases.

Yet, these are not the activities of mastermind criminals. Payroll fraud is often incredibly basic. But when there are dozens to thousands of employees on the books, detecting these crimes can be resource- and time-intensive.

Diligent monitoring, audits, and face-to-face confirmation campaigns will expose and discourage payroll fraud. But these approaches are often also resource intensive. Fortunately, there is another method that works well in the short term: checking bank account details.

Bank accounts don't lie

Payroll criminals manipulate employee information. They can load ghost employees onto systems as new hires or edit existing records, such as those of departing employees, rather than remove them. They can abuse the profiles of infrequently paid employees such as contractors and freelancers, skimming money when legitimate payments aren't due or adding inflated charges that are diverted to a different account.

They can also change banking details right before and after payroll runs, hoping to avoid detection since such changes can sidestep proper processes, hide inside dense financial records, and not show up unless there is an audit of payroll activities.

In all of these abuses, changes to banking details are the common thread, says Yolande Schoültz, founder of YSchoültz Attorneys | Conveyancers | Notaries.

"For payroll fraud to work, money to be misappropriated and to be fraudulently paid over to a bank account, there must be a change in banking details."

Fraudsters alter payroll details, concealing their activities behind legitimate profiles and their role as system gatekeepers. However, most don't go as far as to forge relevant documents such as bank confirmation letters. When organisations have processes that dictate how to legitimately change employee bank details, they will keep those documents on file. Looking for those anomalies will expose payroll fraud.

Each month, check the new employees and terminations. The new employee records should have corresponding bank documentation reflecting their banking account details. The records of former employees should not have new banking details. If you compare those groups with the documents you have on file, you'll uncover irregularities.

"Even if that's the only verification you do, you are still mitigating payroll fraud," says Schoültz.

Signs of potential payroll fraud include:

• New employees on payroll with no or lacking corresponding banking documentation
• Profiles of terminated employees that are still active
• Bank account changes on profiles of employees that receive infrequent or variable payments
• Altered banking records with no corresponding documentation or requests
• The same bank account details appearing on multiple records
• Changes to banking details right before and after payroll runs

Monthly spot checks on new employee additions, or banking changes to terminated and infrequently paid employees, will show fraud patterns if there are any. Also conduct quarterly or biannual audits of payroll records, specifically looking for changes to banking details.

Simplifying fraud detection with technology

Why aren't organisations conducting these checks? The first issue is that management of payroll departments is often ambiguous. Do they fall under finance or human resources?

"Should payroll be a part of HR or finance? It's not either of the two; it's both, with finance taking the lead. Nevertheless, payroll can often operate independently from finance. When requests for verifications arise, they simply export a file and forward it to finance, which often accepts it without further scrutiny," says Schoültz.

The second is that conventional payroll software is typically isolated from people who should have oversight authority. Many companies still rely on payroll software that is at least 10 years old and typically lacks modern features such as remote access, ad hoc reporting, and integration with other business systems.

Modern payroll software that provides role-based access is a potent deterrent against payroll fraud because it removes barriers complicating payroll oversight, says Sandra Crous, MD of South African payroll and HR platform Deel Local Payroll.

"If you have a system where the head of HR or Finance can log in remotely and generate reports, you remove that isolation. They don't need to go through the payroll staff to see what is going on. And if they use these measures to regularly check on new and terminated employees, emphasising bank account changes, they'll uncover and discourage payroll fraud."

Payroll fraud may lack sophistication, but its cumulative impact is devastating. Vigilance over bank account details is a simple yet effective way to expose and discourage these crimes. By scrutinising banking detail changes and leveraging modern payroll software for oversight without bottlenecks, organisations can dramatically reduce their vulnerability to payroll fraud.

For media queries please contact:
Victoria Lindsay
victoria@innocomm.co.za

About Deel Local Payroll:
Deel Local Payroll, powered by PaySpace, revolutionises payroll management. It offers online, multi-country payroll and HR management for businesses from start-ups through to enterprise in over 40 African countries, the United Kingdom, the Middle East, and Brazil.

Cloud-native, Deel Local Payroll, is scalable, configurable, highly secure, and easy-to-use—delivering anytime, anywhere access. It features payroll automation, self-service features, automatic legislation and feature updates, customised reporting, and more.

Since 2024, Deel Local Payroll has been part of Deel, operating as an independent subsidiary, serving its customers through the PaySpace platform.

Media files

Download logo

Kaspersky's (www.Kaspersky.co.za) detection systems discovered an average of 500,000 malicious files per day in 2025, marking a 7% increase compared to the previous year. Certain types of threats saw growth globally – there was a 59% surge in password stealer detections, a 51% growth in spyware detections, and a 6% growth in backdoor detections compared to 2024.

These findings are part of the Kaspersky Security Bulletin (https://apo-opa.co/44CY5Zj) series where we review the key cybersecurity trends of the past year.

Windows remains the primary target for cyberattacks. 48% of users on Windows were targeted by different types of threats throughout 2025. For Mac users, this figure stands at 29%.

Web threats

Globally, 27% of users were attacked with web threats – these refer to malware that targets users when they are online. Web threats are not limited to online activity, but ultimately involve the Internet at some stage for inflicted harm. In Latin America, 26% of users were attacked by web threats in 2025, while this share reached 25% in Africa, 21% in Europe and 19% in the Middle East.

On-device threats

33% of users were attacked with on-device threats. These include malware that is spread via removable USB drives, CDs and DVDs, or that initially makes its way onto the computer in non-open form (for example, programs in complex installers, encrypted files, etc.). Africa headed the rating with 41% of users attacked with this type of threat; APAC reached 33%, Middle East – 32%, Latin America – 30%, and Europe 20%.

“The current cyberthreat landscape is defined by increasingly sophisticated attacks on organisations and individuals around the world. One of the most significant revelations made by Kaspersky this year was the resurgence of the Hacking Team after its 2019 rebranding, with its commercial spyware Dante used in the ForumTroll APT campaign, incorporating zero-day exploits in Chrome and Firefox browsers. Vulnerabilities remain the most popular way for attackers to get into corporate networks, followed by using stolen credentials – hence the rise in password stealers and spyware we see this year. Supply chain attacks are also common, including attacks on open-source software. This year the number of such attacks increased significantly, and we even saw the first widespread NPM worm Shai-Hulud,” comments Alexander Liskin, Head of Threat Research at Kaspersky. “This increasingly complex threat landscape makes implementing robust cybersecurity strategies vital for organisations, as failure to do so can lead to months of downtime in the event of attacks. Individual users should also always use reliable security solutions, otherwise they put not only their data and money at risk, but also those of the organisations where they work.”

Follow this link (https://apo-opa.co/44CY5Zj) to learn more about other KSB reports.

To stay protected, follow the recommendations below.

Individual users:

• Do not download and install applications from untrusted sources.
• Do not click on any links from unknown sources or suspicious online advertisements.
• Always use two-factor authentication when available. Create strong and unique passwords, using a mix of lower-case and upper-case letters, numbers, and punctuation. Use a reliable password manager to help to remember them.
• Always install updates when they become available; they contain fixes for critical security issues.
• Ignore messages asking to disable security systems for office or cybersecurity software.
• Use a robust security solution appropriate to your system type and devices, such as Kaspersky Premium (https://apo-opa.co/4pFVUMB).

Organisations:

• Always keep software updated on all the devices you use to prevent attackers from infiltrating your network by exploiting vulnerabilities.
• Do not expose remote desktop services (such as RDP) to public networks unless absolutely necessary and always use strong passwords for them.
• Use advanced Kaspersky Next (https://apo-opa.co/4pQstI1) security products for comprehensive visibility across all company's corporate infrastructure to rapidly hunt out, prioritise, investigate and neutralise complex threats and APT-like attacks.
• Use the latest Threat Intelligence (https://apo-opa.co/3MdQvOI) information to stay aware of actual TTPs used by threat actors.
• Back up corporate data regularly. Backups should be isolated from the network. Make sure you can quickly access the backups in an emergency if needed.

All statistics in this report come from Kaspersky Security Network (KSN). For 2025, the statistics cover the period from November 2024 through October 2025.

For further information please contact:
Nicole Allman
nicole@inkandco.co.za

Social Media:
Facebook: https://apo-opa.co/4iwRZzo
X: https://apo-opa.co/4owAi4r
YouTube: https://apo-opa.co/48pGVkt
Instagram: https://apo-opa.co/3XwhmI4
Blog: https://apo-opa.co/4apW9XJ

About Kaspersky:
Kaspersky is a global cybersecurity and digital privacy company founded in 1997. With over a billion devices protected to date from emerging cyberthreats and targeted attacks, Kaspersky's deep threat intelligence and security expertise is constantly transforming into innovative solutions and services to protect businesses, critical infrastructure, governments and consumers around the globe. The company's comprehensive security portfolio includes leading endpoint protection, specialized security products and services, as well as Cyber Immune solutions to fight sophisticated and evolving digital threats. We help nearly 200,000 corporate clients protect what matters most to them. Learn more at www.Kaspersky.co.za.

Media files

Download logo