Editor’s note: This article builds on themes first explored in I Have Discovered Payroll Embezzlement is Taking Place in my Practice: What do I do Next?, an ACMPE Fellowship paper by Debbie A. Casaus, FACMPE (August 2017).

In 2024, a federal judge in Rhode Island sentenced the former office manager and bookkeeper of a Pawtucket medical practice to 27 months in prison. According to the U.S. Attorney's Office, she managed all the practice's finances, added relatives and friends to payroll as unauthorized paid employees, and converted patient copayments and other practice funds to personal use, taking nearly $570,000. After she was fired, she also collected state temporary disability benefits she was not entitled to. The court ordered $579,857 in restitution, split among the practice, an insurer that had covered part of its loss, and the state benefits program.¹

That outcome took a prosecutor, three investigating agencies, an insurance claim and a sentencing hearing. For the practice, it began on the day someone realized the payroll did not add up. From that day forward, several processes run at once: legal, insurance, tax, employment and communication with staff. What an administrator does first can determine which records are preserved and how much money the practice recovers.

The stakes are not limited to large organizations. The Association of Certified Fraud Examiners' (ACFE) 2026 study of 2,402 occupational fraud cases found a median loss of $104,000 and a median of 12 months before detection, and smaller organizations had the highest median losses of any size group.² The steps below apply whether the money left through a staff member, an outside impersonator or a problem at the payroll vendor.

First, identify where the money went

Payroll losses come from three places, and each one changes the first phone call.

Someone inside the practice. An employee with payroll access pays people who do not work there, raises their own pay, adds bonuses or overtime, pads hours or redirects other employees' deposits. A pediatric office manager in Illinois overpaid her own salary, paid herself for overtime and mileage no one authorized, and added herself and family members to the practice's health insurance. She took more than $350,000 between 2011 and 2017.³

Someone outside the practice. An impersonator uses a phishing email to capture an employee's payroll login, or sends a message posing as an employee who wants to change a direct deposit account. The FBI warned about this payroll diversion scheme in 2018. Its 2024 guidance on business email compromise applies to any request to change account information: verify it through a separate channel, and if a transfer turns out to be fraudulent, contact the bank at once to request a recall.⁴^,⁵

The payroll vendor relationship. A provider may fail to remit withheld taxes, or someone may gain control of the practice's vendor account. In a Florida case reported in May 2026, a former payroll manager at an orthopedic practice was accused of posing as the owner to set up the practice's payroll processor account, which gave her full administrative access. According to the arrest report, she then paid herself unauthorized bonuses and raises worth about $1.09 million from 2021 to 2024.⁶ Whatever the vendor's role, the IRS holds the employer responsible for depositing federal employment taxes.⁷

The categories can overlap. An insider may use a vendor account to hide changes, and an outside thief may use a login stolen from an employee. When the source is unclear, call the bank first about any deposit that may have been diverted, because the window to recover it is short. Then follow the insider column.

The first 48 hours: stop the loss and keep the evidence

An administrator's first instinct may be to confront the suspected employee and demand an explanation. That conversation should wait. An early confrontation gives a suspect time to delete records, and it can make recovery harder.

1. Call legal counsel before acting on a suspect. An employment lawyer, or practice counsel who can bring one in, should set the order of the next steps. Counsel may also retain the forensic accountant directly so the investigation is conducted at counsel's direction.
2. Shut off access completely. Remove the person's rights in the payroll system, the payroll vendor portal, timekeeping, bank portals and email, and take away their ability to approve or release a payroll. Look for administrator accounts at the vendor that the practice did not knowingly create. Change any shared passwords and turn on two-factor authentication. Whether to suspend an employee during the investigation, and with or without pay, is a question for counsel.
3. Preserve records before anyone tidies up. Export the payroll system's change history, which shows who changed a bank account, pay rate or employment status, and when. Save timekeeping edits, payroll registers, bank statements and ACH files, and ask the vendor to preserve its records of calls, emails and account changes. Suspend routine deletion of email, and keep the person's devices intact.
4. Call the bank. For a deposit sent to the wrong account, ask whether it can be reversed. ACH rules allow a reversal for an incorrect receiver only if it reaches the receiving bank within five banking days of settlement, and recovery depends on whether the money is still there.⁸ Ask about tools that limit future losses, such as dual approval of payroll files and positive pay.
5. Notify the crime insurer in writing. Employee theft is covered, if at all, by commercial crime or fidelity insurance, not general liability. Crime policies generally require written notice as soon as practicable, often within 30 to 60 days of discovery, and proof of loss within several months; the policy's own wording controls.⁹ Courts have denied claims when notice came too late.¹⁰ Losses from an impersonator who tricked staff often require a separate social engineering endorsement.⁹
6. Keep the circle small. Limit the first briefings to the physician-owners or board chair, counsel and the outside accountant. Write down who was told, and when.
7. Leave final pay alone. Federal law does not allow deductions for theft that reduce pay below the minimum wage or required overtime, and many states set stricter limits.¹¹ Recovery belongs in the insurance claim, restitution or a civil action.

If an outside impersonator diverted an employee's pay, file a complaint at ic3.gov and mention payroll diversion in it.⁴ Most practices will also want to pay the affected employee promptly through a verified account. Ask counsel whether state wage law requires it.

The first 2 weeks: measure the loss and make the hard decisions

Reconstruct what happened. An outside CPA or forensic accountant should go back as far as the records allow. ACFE's median case ran 12 months before detection, and the Illinois scheme ran six years, so a single year's review can miss most of a loss.²^,³ The comparisons that find payroll fraud are specific:

• payroll registers against the HR roster, including hire and termination dates;
• bank account numbers across employees, looking for two names paid into one account or an employee's pay going to the suspect's account;
• off-cycle checks, bonuses, and pay-rate and status changes against written approvals;
• recorded hours against schedules and badge logs, with extra attention to timecards for employees on leave;
• Forms 941 against the practice's own EFTPS payment history and the payroll registers, which the IRS recommends employers check with their own EFTPS PIN;⁷
• benefit deductions against carrier invoices and retirement plan deposits.

These last two checks matter because payroll fraud can affect taxes and employee benefits, not just wages. The Illinois manager added relatives to the health plan, and the Labor Department's benefits agency was among the investigators in the Rhode Island case.¹^,³ Keep a dated record of each finding: amounts, accounts, pay periods and the people affected. Track investigation costs separately, since many crime policies exclude legal expenses.⁹

Interview the employee with a plan. Counsel should decide when the interview happens, who attends and what is documented. Union representation rights may apply. Any discussion of repayment should go through counsel, because promises not to prosecute in exchange for repayment can create legal problems of their own.

Decide on employment action. Termination, when it comes, should rest on documented facts. Agree with counsel in advance on what the practice will say to future reference checks.

Decide on referral. Physician-owners or the board decide, with counsel, whether to report the matter to police or prosecutors. In ACFE's 2026 study, 54% of cases were referred to law enforcement.² Criminal restitution can be an important route to recovery, as it was in Rhode Island. A practice should also expect that government agencies may become involved on their own. IRS Criminal Investigation handled the Illinois case, and the manager pleaded guilty to wire fraud and to filing a false federal income tax return.³ Check whether the crime policy requires a police report.

File the proof of loss on time. Use the accountant's reconstruction and supporting records, and meet the policy's deadline even if the investigation is still finishing. Ask the insurer in writing for an extension if one is needed.⁹

The first 90 days: correct the record and rebuild

Correct the tax filings. Fictitious or inflated pay misstates Forms 941 and W-2. Prior quarters are corrected on Form 941-X, and the IRS asks employers to file corrections as soon as errors are discovered.¹² Affected employees receive corrected Forms W-2c, which are also filed with the Social Security Administration.¹³ Some corrections to prior-year withholding are limited by IRS rules, and state filings need the same review, so the outside accountant should map each correction before anything is filed.¹² If a vendor failed to remit deposits, the practice still owes them.⁷

Take care of the employees caught in it. Several groups may need individual attention:

• employees whose W-2s show pay they never received;
• employees whose deposits went missing;
• employees whose names, Social Security numbers or bank details were used;
• employees whose benefit enrollments or deductions were changed.

Tell each group what happened in plain terms, what the practice is correcting, and when. Ask counsel whether the misuse of employee personal information triggers notice duties under state breach-notification law.

Brief the rest of the staff and the physicians. Keep the message short, factual and reviewed by counsel. Describe what changed in the payroll process rather than characterizing the person involved. Tell staff how to raise a concern. Tips were the most common way frauds were detected in ACFE's 2026 study, at 43% of cases, and more than half of those tips came from employees.²

Pursue recovery. Recovery can come through the insurance claim, criminal restitution or a civil action, and sometimes through more than one. In the Rhode Island case, the insurer that paid part of the practice's loss was among those repaid through restitution.¹

Report to the physician-owners or board. Cover what happened, the measured loss, recovery status, the control changes and who owns each change.

Rebuild the payroll controls. To prevent similar losses, put these safeguards in place:

• verify every direct-deposit or bank-account change through a separate, known channel before it is processed;⁵
• make sure the practice, not the payroll manager, controls the vendor account, and review its administrator list each quarter;
• register for EFTPS with the practice's own PIN and check federal deposits periodically;⁷
• have a second person review each payroll register before release, and compare the payroll roster to current staff each month;
• reconcile benefit deductions to carrier invoices and plan deposits;
• require people in payroll roles to take vacation, with someone else running payroll while they are out. Refusal to take vacations is among the behavioral warning signs ACFE tracks.²

Before it happens: a one-page response plan

Most of the first-48-hour work depends on information an administrator should not have to hunt for under pressure. A single page kept with the practice's compliance records can hold it:

• names and after-hours numbers for employment counsel, the outside accountant or forensic accountant, the crime insurer and broker, and the bank's fraud line;
• the crime policy number, where the policy is kept, its notice and proof-of-loss deadlines, and whether it includes social engineering coverage;
• who holds administrator access to the payroll vendor account, who can approve a payroll and who can change an employee's bank details;
• how to export the payroll system's change history and how long the vendor keeps it;
• who decides on a referral to law enforcement.

Review the page when payroll staff, vendors, banks or insurers change. The companion Payroll Fraud Response Checklist puts the 48-hour, two-week and 90-day steps on one page and includes a fillable version of this plan.

Summary

When payroll fraud surfaces, the first decisions protect evidence, money and options. Call counsel before speaking with a suspect, shut off access, preserve the records, and contact the bank and the crime insurer within their time limits. Then measure the loss across wages, taxes and benefits, and decide on employment action and referral with counsel.

Over the following weeks, the practice must correct tax filings, help affected employees, recover what money it can and fix the controls that failed. Preparing a one-page response plan in advance makes the first two days much easier to manage.

Additional resources

The companion Payroll Fraud Response Checklist turns the steps in this article into a working checklist with owners and dates, plus the one-page response plan.

The IRS pages "Outsourcing Payroll Duties" and "Correcting Employment Taxes" explain an employer's responsibility for deposits made by a payroll provider and how to correct filed returns. Complaints about payroll diversion and other online fraud go to the FBI's Internet Crime Complaint Center at ic3.gov.

Notes

1. U.S. Attorney's Office, District of Rhode Island. "Former medical practice administrator sentenced for stealing nearly $600,000 from her employer, TDI Benefits Program." Sept. 23, 2024. https://justice.gov/usao-ri/pr/former-medical-practice-administrator-sentenced-stealing-nearly-600000-her-employer-tdi
2. Association of Certified Fraud Examiners. Occupational Fraud 2026: A Report to the Nations. Press releases, May 2026. https://www.acfe.com/about-the-acfe/newsroom-for-media/press-releases/press-release-detail?s=occupational-fraud-2026-a-report-to-the-nations-pr  
3. U.S. Attorney's Office, Southern District of Illinois. "Embezzlement From Doctor's Office Sends Former Office Manager to Federal Prison for Nearly Three Years." Feb. 6, 2019. https://www.justice.gov/usao-sdil/pr/embezzlement-doctors-office-sends-former-office-manager-federal-prison-nearly-three
4. Federal Bureau of Investigation, Internet Crime Complaint Center. "Cybercriminals Utilize Social Engineering Techniques to Obtain Employee Credentials to Conduct Payroll Diversion." Public Service Announcement I-091818-PSA, Sept. 18, 2018. https://ic3.gov/PSA/2018/PSA180918
5. Federal Bureau of Investigation, Internet Crime Complaint Center. "Business Email Compromise: The $55 Billion Scam." Public Service Announcement I-091124-PSA, Sept. 11, 2024. https://www.ic3.gov/PSA/2024/PSA240911
6. WKRC (Local 12). "Payroll manager allegedly stole over $1.5 million from doctor's office." May 27, 2026. https://local12.com/news/nation-world/payroll-manager-stole-million-millions-doctors-office-doctor-back-neck-orthopedic-authorized-unauthorized-paymaster-administrative-access-discovered-arrest-fraud-steal-stealing-poor-miami
7. Internal Revenue Service. "Outsourcing Payroll Duties." Updated Mar. 4, 2026. https://www.irs.gov/businesses/small-businesses-self-employed/outsourcing-payroll-duties
8. Nacha. Nacha Operating Rules, "Reversals and Enforcement." https://www.nacha.org/rules/reversals-and-enforcement
9. Marsh. "Basics of Commercial Crime Insurance." https://www.marsh.com/pr/en/services/financial-professional-liability/insights/basics-of-commercial-crime-insurance.html
10. Wiley Rein LLP. "Notice and Discovery Provisions of Commercial Crime Policy Strictly Enforced." Newsletter, May 2008. https://www.wiley.law/newsletter-149 
11. U.S. Department of Labor, Wage and Hour Division. "Fact Sheet #16: Deductions From Wages for Uniforms and Other Facilities Under the Fair Labor Standards Act (FLSA)." https://www.dol.gov/agencies/whd/fact-sheets/16-flsa-wage-deductions
12. Internal Revenue Service. "Correcting Employment Taxes." https://www.irs.gov/correctingemploymenttaxes Internal Revenue Service. "About Form W-2 C, Corrected Wage and Tax Statements." https://www.irs.gov/forms-pubs/about-form-w-2-c