File No. 2026-002 The Campus Ghost

On paper, everything looked perfectly legitimate.

A security guard had worked the overnight shift. Their name appeared on the roster. Their security licence number was valid. A timesheet had been signed. An invoice had been submitted. The University of Sydney paid for the service.

There was just one problem.

The guard had never been there.

In some cases, they didn't even know their identity had been used.

When most people hear the term ghost employee, they picture someone who exists only on a payroll system, quietly collecting a salary that no one notices.

That certainly happens.

But one of Australia's most remarkable ghost employee frauds wasn't hidden inside payroll. It was hidden inside contractor invoices.

An investigation by the NSW Independent Commission Against Corruption uncovered a sophisticated scheme involving security contractors engaged by the University of Sydney. Over a number of years, employees within the contracting companies used the names and security licence details of legitimate guards to create "ghost shifts". Some shifts were never worked. Others disguised excessive overtime or made it appear that different people had performed the work when they hadn't.

The paperwork looked convincing. The reality was very different.

Fraud adapts

What makes this case so fascinating isn't simply the scale of the fraud. It's the way it evolved.

The perpetrators didn't hack computer systems or create fictitious companies. They learned how the University's security arrangements worked and used that knowledge to their advantage.

Security services were outsourced. Additional work was subcontracted. Special events required ad hoc security at short notice. 

Different organisations maintained different records. Invoices passed through several layers before payment.

Every one of those arrangements made perfect operational sense. Together, they created an environment where fraud could hide in plain sight.

The investigation found that false identities were used in several different ways. Sometimes names and licence numbers were used to claim payment for shifts that no one attended. Sometimes they concealed the fact that a guard had worked excessive hours. In other cases, the same person appeared to be working two different shifts at the same time using another guard's identity.

Some individuals claimed to have worked more hours in a week than physically exist. Others were paid for concurrent shifts at different locations.

Many of the identities belonged to genuine security guards working elsewhere who had no idea their credentials were being used.

The fraudsters were selective. They targeted weekends, overnight shifts and work performed outside normal business hours - times when fewer supervisors were present and fewer questions were likely to be asked.

They understood something every fraudster understands. The best opportunity isn't where there are no controls. It's where everyone assumes somebody else has already checked.

This wasn't just contractor fraud

It would be easy to dismiss this as the work of dishonest contractors. That would be a mistake.

Cases like this remind us that fraud rarely stays confined to one system. As organisations introduce new ways of delivering services -outsourcing, subcontracting, flexible workforces and complex supply chains -fraud evolves alongside them.

The controls designed to prevent payroll fraud weren't much use because this wasn't payroll fraud. 

The procurement process had been completed. The contract existed. The invoices matched the work that had supposedly been requested. The approvals had been given. 

Every step looked legitimate. 

The weakness wasn't in any single control. It was in the assumptions connecting them.

Each person relied on information provided by the previous step in the process. Very few people were in a position to independently determine whether the work had actually been performed.

That's an important distinction.

Good governance isn't about distrusting people. It's about recognising where your systems rely on assumptions rather than evidence.

Why this matters

Most organisations today rely on contractors to deliver essential services - cleaning, security, IT, maintenance, consultants, labour hire, facilities management.

Every outsourced service creates another point where your organisation is paying for work it didn't directly supervise.

That doesn't necessarily make outsourcing risky. But it does change the questions leaders should be asking.

Because the greatest risks are often found, not in the contract itself, but in the spaces between the contractor, the subcontractor, the invoice and the approval.

Questions Every Executive Should Ask

• If a contractor invoices us for work, how do we know it actually occurred?

• Which contractor services are performed when oversight is naturally at its lowest?

• Are subcontractors subject to the same scrutiny as our primary contractors?

• Where do we rely on paperwork when we should be relying on independent evidence?

• If someone deliberately manipulated contractor records, how likely is it that we would detect it?

• When was the last time we tested our contractor controls rather than simply assuming they were working?

  
  

Integrity Insight

Fraud doesn't stand still.

As organisations become more complex, fraud finds new ways to exploit that complexity.

The lesson from the University of Sydney isn't simply to tighten contractor management. It's to recognise that every operating model creates its own vulnerabilities.

The strongest organisations don't just ask whether the paperwork is complete. They ask whether it proves what they think it proves.