A supervisor with a clipboard facing a line of construction workers in hard hats and hi-vis vests at a morning roll call.

Workforce & finance × Research note

Payroll leakage on construction sites: what the fraud research says, and how to find it

Occupational fraud typically runs for a year before anyone notices, and most of it is found by a tip, not a control. Site labour payroll, with its contractors, crews and manual attendance, is where the patterns hide.

5 min read
3 sources
Atul Iwale

5%: of revenue: the share organisations lose to fraud each year, as estimated by the ACFE^[1]
12 mo: the typical duration of an occupational fraud before it was detected^[1]
43%: of frauds were first detected by a tip, more than three times any other method^[1]

Key takeaways

The ACFE’s 2024 study of 1,921 cases in 138 countries found a median loss of $145,000 per case, with total losses above $3.1bn.
The typical fraud ran about 12 months before detection, and 43% were first found by a tip, more than half of them from employees.
Construction site labour is exposed: labour contractors, large crews, manual attendance, overtime and frequent rate changes.
Fixed audit rules miss context. Comparing each wage line with its site, its crew and the worker’s own history separates a concrete-pour weekend from padded overtime.
In my synthetic-data test, an Isolation Forest found 73% of seeded issues by reviewing 5% of lines, against 41% for audit rules.

01What the fraud research says

The Association of Certified Fraud Examiners publishes the largest regular study of occupational fraud: fraud committed by people against the organisations that employ them. Its 2024 Report to the Nations analysed 1,921 cases from 138 countries and territories, with total losses of more than $3.1bn^[1].

The median loss per case was $145,000.
The ACFE estimates that organisations lose about 5% of revenue to fraud each year.
A typical fraud lasted about 12 months before it was detected.
43% of frauds were first detected by a tip, and frauds were at least three times more likely to be found by a tip than by any other method. More than half of those tips came from employees.

A typical fraud runs for a year, and it is more often found by a tip than by a control.

The last two numbers matter most for controls. If routine checks were catching fraud early, tips would not dominate and frauds would not last a year. The implication is that many organisations’ detective controls are not looking in the right way.

02Why site labour payroll is exposed

Staff payroll in a head office is relatively easy to control. Site labour payroll is not. On many construction projects, especially where labour is supplied by labour contractors, the payroll combines:

large crews that change week to week;
attendance recorded partly by biometric devices and partly by hand;
overtime and Sunday work that is legitimately heavy around concrete pours and deadlines;
rates that are revised on a schedule, and sometimes outside it;
approvals by site staff who are also under pressure to keep the job moving.

The typical leakage patterns follow from that: ghost workers on the roll, proxy attendance, padded overtime, unauthorised rate increases and wages paid after a worker has left. Each one looks normal as a single line. It only looks wrong in context.

03Why fixed audit rules miss it

The usual first control is a checklist of rules: flag overtime above a threshold, flag manual attendance, flag rate changes. Rules are transparent, but they have two weaknesses on site payroll. They fire constantly in legitimate situations (a whole crew working a Sunday pour will trip every overtime rule), and people who know the rules can stay just inside them.

Unsupervised anomaly detection takes a different approach. Instead of fixed thresholds, it asks how unusual each line is compared with similar lines. The Isolation Forest, introduced by Liu, Ting and Zhou in 2008, works by randomly partitioning the data; unusual records get isolated in fewer splits than normal ones, which gives a simple anomaly score with no need for labelled examples of fraud^[2].

04Case study: Construction Payroll

From my portfolio · project 07 of 15

Synthetic data

Problem: Site-labour payroll leaks through ghost workers, padded overtime and unauthorised rate increases.
Decision supported: Which wage lines an auditor should review before release each month.
Data: 2,400 staff timesheet rows and 12,397 monthly site-labour wage lines over a year.
Method: Pre-release calculation rules, then peer-relative features and six anomaly detectors at a fixed review budget.
Result: Isolation Forest finds 73% of seeded issues by reviewing 5% of lines (audit rules: 41%).
Limits: Synthetic data; catches only 8% of proxy attendance, which needs a physical control.

Live app Anomaly model Code and README

05What my test showed

I built a synthetic site-labour payroll of 12,397 monthly wage lines over a year, with realistic seasonality (festival absences, monsoon slowdowns, April wage revisions, weekend pours, biometric device failures) and seeded leakage patterns. I compared a seven-rule audit checklist with several anomaly detectors, measuring what an auditor would find by reviewing only the top 5% of lines each month^[3].

Figure

Share of seeded payroll issues found by reviewing the top 5% of lines

Random review5%
Audit rules (count of rules hit)41%
Isolation Forest, peer-relative features73%

Recall at a 5% monthly review budget. Synthetic data with seeded issues; source: [3].

By type, the Isolation Forest caught 100% of pay after exit, 87% of rate increases, 85% of ghost workers and 74% of padded overtime, but only 8% of proxy attendance. That last number is the honest limit: when one worker signs in for another, the wage line itself can look perfectly normal. Some fraud needs a physical control, such as a headcount on site, not a better model.

The most useful output was not the list of lines but the pattern behind them. Three labour contractors were flagged at more than twice the average rate, and they were exactly the three that had placed ghost workers; two approvers accounted for every mid-year rate increase. That turns an anomaly list into a control finding.

06How strong is the evidence?

Not every finding in this note rests on the same kind of evidence. This is how I would weigh each one before acting on it.

Strong: large official data sets or peer-reviewed studies. Moderate: a single study or a specific population. Indicative: surveys, vendor-backed reports or synthetic tests.
Finding	Evidence	Strength	Main caveat
Frauds run about a year and are found mostly by tips	ACFE study of 1,921 cases in 138 countries	Moderate	Cases investigated by fraud examiners
Organisations lose about 5% of revenue to fraud	ACFE survey estimate	Indicative	Survey-based estimate, not measured
Isolation Forest isolates anomalies efficiently	Peer-reviewed method (ICDM 2008)	Strong	Finds unusual lines, not proof of fraud
Peer-relative features beat audit rules on payroll	My test with seeded issues	Indicative	Synthetic data; misses proxy attendance

07Controls worth putting in place

Reconcile headcount physically, with periodic unannounced roll calls against the payroll, especially for labour-contractor crews.
Compare each line with its peers (site, crew, trade, own history) rather than only with fixed thresholds.
Review a fixed budget of the riskiest lines each month and record the outcome, so the ranking improves over time.
Aggregate findings by contractor and approver. Patterns across lines reveal the control weakness.
Lock rate changes to the revision calendar and require a second approver outside it.
Make tipping-off easy and safe. Tips remain the most common detection method; a hotline workers trust is a control.

NotesSources

Association of Certified Fraud Examiners (2024). Occupational Fraud 2024: A Report to the Nations.
Liu, F. T., Ting, K. M. and Zhou, Z.-H. (2008). Isolation forest. Proceedings of the 8th IEEE International Conference on Data Mining (ICDM).
Iwale, A. (2026). Construction Payroll: site-labour anomaly detection on synthetic data. GitHub.

Figures are quoted from the sources above as published; where a source reports a range or a survey estimate, it is described that way. Results from my own projects say whether they use real public data or synthetic data.