# Payroll Tax Embezzlement: Withheld but Never Paid

- Author: PreciseBankFlow (https://www.precisebankflow.com)
- Published: 2025-05-30
- Updated: 2025-05-30
- Category: Embezzlement and fraud schemes
- Canonical: https://www.precisebankflow.com/blog/payroll-tax-embezzlement

> How payroll tax embezzlement works when withheld taxes are never paid, why it surfaces late through notices, and how to check tax debits in the bank.
Payroll tax embezzlement happens when income tax and Social Security and Medicare withheld from employees' pay are kept by the person handling payroll instead of being deposited with the IRS. Employees' pay stubs look right, so nothing seems wrong until tax notices arrive. Check the bank for an electronic tax deposit matching each payroll's liability.

## How does payroll tax embezzlement work when withheld taxes are never paid?

Payroll tax embezzlement diverts money that was meant for the Treasury. Each payroll, the business withholds income tax and the employee share of Social Security and Medicare, and adds its own share. Instead of depositing the total, the person in charge sends it to an account they control, or simply keeps it in the operating account and spends it.

The employees are paid their net wages correctly, so they have no reason to complain. Their pay stubs and year-end Forms W-2 show the tax withheld. The general ledger may even show the tax as paid, because the embezzler records a payment to the IRS that never went to the IRS.

Three common forms:

- **Redirected deposits.** The tax amount leaves the bank, but to the embezzler's account, coded as a tax payment.
- **Deposits never made.** The liability stays on the books or is cleared with a journal entry, and the money is used elsewhere.
- **Partial deposits.** Some tax is paid, enough to keep notices small and confusing, while the rest is taken.

Under the IRS rules on [depositing and reporting employment taxes](https://www.irs.gov/businesses/small-businesses-self-employed/depositing-and-reporting-employment-taxes), "federal tax deposits must be made by electronic funds transfer (EFT)," through options such as the Electronic Federal Tax Payment System (EFTPS) or the business tax account. That rule is what makes the bank test in this post work: every genuine federal deposit leaves an electronic debit with a recognizable description.

## Who commits payroll tax embezzlement: in-house staff and payroll providers

Payroll tax embezzlement is committed by whoever controls the money between withholding and deposit. In a small business that is often an in-house bookkeeper or office manager who runs payroll and pays taxes. It can also be an outside payroll provider or a single-person bureau that collects the tax from clients and is supposed to pass it on.

In-house risk is highest when one person:

- Runs payroll and approves it.
- Initiates the tax payments in online banking.
- Receives and opens mail from tax agencies.
- Reconciles the bank account.

Outside provider risk takes a different shape. Many payroll services withdraw the tax from the client's account into their own account and make the deposit for the client. That arrangement is legitimate and common. It also means the client's bank shows a debit to the provider, not to the IRS, so the client cannot see from its own statement whether the tax was paid. If the provider fails or steals, every client is affected at once.

Payroll tax theft rarely stands alone. An employee taking tax money may also be adding a ghost employee or inflating their own pay, so a review should cover the whole payroll, not only the tax.

## Why does payroll tax embezzlement surface so late?

Payroll tax embezzlement surfaces late because the IRS learns of unpaid tax through returns and missing deposits, and its letters go to an address the embezzler often controls. Deposits are due monthly or semiweekly, while Form 941 is filed quarterly. Months can pass before a notice is sent, and the first notices can be intercepted and hidden.

The IRS page on employment tax deposits says employers "must file Form 941, Employer's Quarterly Federal Tax Return, each quarter." The embezzler has choices at that point. They can file a correct return showing the tax owed and not paid, which triggers notices. They can file a return showing less tax, which does not match the W-2s at year end. Or they can file nothing, which also generates letters in time.

Typical ways the theft finally comes to light:

- **A notice the embezzler did not intercept**, sent to the owner's home or to a new address.
- **A levy or lien.** The IRS freezes a bank account or files a lien, which a lender or supplier notices.
- **A new employee in the role** who finds unpaid notices or unexplained tax liabilities.
- **The owner logging into the IRS business tax account** and finding no payments.
- **The annual audit or a loan application**, where tax payment evidence is requested.

The broader pattern of how theft is uncovered, often by accident or a tip rather than by a control, is covered in the post on [how embezzlement is discovered](/blog/how-embezzlement-is-discovered).

## Who owes the stolen payroll tax: the trust fund recovery penalty

The business still owes payroll tax that was withheld but stolen, and the IRS can also collect it from individuals. Withheld income tax and the employee share of Social Security and Medicare are trust fund taxes, held for the government. If they are not paid, the trust fund recovery penalty can make responsible people personally liable for the full amount.

[IRS Publication 15, the Employer's Tax Guide](https://www.irs.gov/publications/p15), states that "The penalty is 100% of the unpaid trust fund tax." It may be imposed on "all persons who are determined by the IRS to be responsible for collecting, accounting for, or paying over these taxes, and who acted willfully in not doing so." A responsible person may include "one who signs checks for the business or otherwise has authority to cause the spending of business funds." Willfully means "voluntarily, consciously, and intentionally," and the publication says that a person acts willfully if they know the payments are not being made or recklessly disregard obvious and known risks.

This matters for the owner. An owner who signs checks and ignores warning signs may be treated as a responsible person, even though someone else took the money. The embezzler can be responsible too. Get advice from a tax professional as soon as the theft is found, before responding to the IRS.

Interest and penalties for late deposit and late payment also accrue on the business's balance. The longer the theft runs, the larger that bill.

## Matching federal tax deposit debits to payroll runs

The direct test for payroll tax embezzlement matches each payroll run's tax liability to an electronic tax debit in the bank. List the federal tax due for each pay date in a quarter, then find the matching IRS debit on the statement. A payroll with no matching debit, or a debit that went elsewhere, is an exception.

The worked example uses invented figures for a business on a semiweekly schedule that runs payroll every two weeks.

| Pay date (example) | Federal tax liability | Expected debit | Bank debit found | Description on statement | Result |
| --- | --- | --- | --- | --- | --- |
| Jan 9 | $6,840 | By Jan 14 | $6,840 on Jan 13 | IRS USATAXPYMT | Matched |
| Jan 23 | $6,910 | By Jan 28 | $6,910 on Jan 27 | IRS USATAXPYMT | Matched |
| Feb 6 | $6,875 | By Feb 11 | $6,875 on Feb 10 | ONLINE TRANSFER TO CHK 4471 | Wrong payee |
| Feb 20 | $7,020 | By Feb 25 | None | None | Missing |
| Mar 6 | $6,950 | By Mar 11 | $2,000 on Mar 10 | IRS USATAXPYMT | Short by $4,950 |
| Mar 20 | $6,990 | By Mar 25 | None | None | Missing |

The expected-debit column is illustrative; check the actual due dates for the business's schedule in Publication 15. The description shown for genuine payments also varies by bank. The test is whether each liability has a debit to the tax agency, not the exact wording.

### Steps for the test

1. **Get the payroll register** for the period from the payroll system, showing tax withheld and employer share per pay date.
2. **Get the bank statements directly** from the bank, for the same period plus a few weeks.
3. **List every tax-related debit.** Search the descriptions for the IRS, EFTPS, the state revenue agency and the payroll provider.
4. **Match each liability to a debit** by amount and date.
5. **Log in to the IRS business tax account or EFTPS** and compare the payments the IRS shows with the debits you found.
6. **Request account transcripts** from the IRS for the quarter if the two disagree.
7. **Follow every debit that went elsewhere** to the receiving account.

Steps 3 and 4 are line matching. PreciseBankFlow reads the statements into lines and matches them to your ledger, listing the lines that do not clear, so a tax liability with no debit behind it is easier to see. Step 5 is the step that matters most, because it uses a record the embezzler cannot edit.

## Fake deposit confirmations and other ways stolen payroll tax is hidden

People who steal payroll tax usually show the owner something that looks like proof of payment. Common tools are altered payment confirmations, returns marked as filed that were never sent, and IRS letters hidden or explained away as routine. Each one fails against a record taken directly from the IRS or the bank.

What to watch for:

- **Confirmations without matching bank debits.** A confirmation number and date, but no debit on the statement that day.
- **Returns prepared but never filed.** Copies of Form 941 in the file with no IRS acceptance.
- **Tax liabilities cleared by journal entry.** The payroll tax payable account goes to zero through an adjustment rather than payments.
- **A mail rule.** Only one person opens mail from tax agencies.
- **Cash moved in small amounts.** Some embezzlers take the tax money out in cash or through deposits elsewhere kept below reporting thresholds. The post on [structured cash deposits and how they show in statements](/blog/structured-cash-deposits) describes that pattern.

The answer to all of these is to check a source the embezzler cannot control. The owner should have their own login to the IRS business tax account or EFTPS and look at it every quarter.

## When a missing payroll tax debit is not embezzlement

A missing payroll tax debit is not always embezzlement. Businesses on a monthly deposit schedule make one deposit for several payrolls. Payroll providers pay the tax from their own accounts. Some small employers file annually or pay with the return. Before treating an absent debit as theft, confirm which schedule and arrangement the business uses.

Innocent explanations:

- **Monthly schedule.** Two or more payrolls are covered by one deposit due the following month.
- **Provider pays the tax.** The bank shows one debit to the provider covering wages and tax. Ask the provider for proof of each deposit and compare with the IRS record.
- **Combined deposits.** One deposit covers several pay dates or includes state tax.
- **Different account.** The tax is paid from a separate payroll account rather than the operating account.
- **Timing at quarter end.** A deposit for the last payroll of a quarter appears in the next month's statement.

A debit to a payroll provider is not proof the tax was paid. It proves only that the provider received the money. The proof is in the IRS's own record of deposits.

If the test points to theft, the steps on [what to do if you suspect embezzlement](/blog/what-to-do-if-you-suspect-embezzlement) explain how to protect the records before anyone is confronted. Firms that need to match a year of payroll tax debits for a client can [request a spot in PreciseBankFlow's early access](/get-started).