Interestingly, both payroll fraud stories I have were by middle managers.
In one case the manager had “rehired” a former employee on a casual basis with an established EEId and SIN. The bank deposit form was filled out manually rather than including a cheque – the bank account ended up corresponding to the managers account on file for expense reimbursement (they used a different account for payroll deposit). Deposits had occurred for a couple of months before anyone caught on. Manager was dismissed, and verification reports started to go to 2nd level mgrs bi-weekly.
The second situation was where the manager, on compassionate grounds, continued to approve salary for an employee on sick leave. Employee apparently had no idea how much sick time they were entitled to and didn’t realize there was an issue. Manager was given escalated warning, employee’s sick bank was exhausted to payback a partial of what was owed, employee was not required to pay it all back.