Daily Maverick
Dailymaverick logo

Opinionistas

This is an opinion piece. The views expressed are not that of Daily Maverick.....

Labour Appeal Court ruling a significant step in fighting ghost employee fraud

Marthinus van Staden
By Marthinus van Staden
12 Feb 2025
Facebook
3
In the corridors of the South African public service, a different kind of haunting unfolds. These spectres don’t rattle chains or whisper in darkened hallways — they draw salaries.

Like any good ghost story, this tale involves mysterious appearances, unexplained occurrences and the lingering question: who really controls these spirits that haunt our public sector payrolls?

But unlike traditional ghost stories, these phantoms leave very real holes in South Africa’s public purse, their presence felt not in midnight chills but in depleted budgets and compromised service delivery.

A January 2025 Labour Appeal Court decision in the Gauteng Department of Education vs General Public Service Sectoral Bargaining Council case offers a fascinating window into one of South Africa’s most persistent public sector challenges: ghost employee fraud.

This case, involving approximately R2-million in fraudulent payments, illustrates both the sophistication of modern payroll fraud and the complexities of proving culpability in such schemes.

At its heart, the case revolved around a deceptively simple question: How did a principal personnel officer, Kenneth Mothlang, repeatedly obtain and use his colleagues’ regularly updated Persal (the government’s payroll and human resource system) passwords over two years to facilitate ghost employee appointments?

The Labour Appeal Court’s analysis of this question has profound implications for public sector accountability and system security.

In this case, the Gauteng Department of Education (the employer) dismissed four employees (Maluka, Tshabalala, Ntombela and Sibi) for alleged misconduct involving ghost employee fraud. The department alleged that between January 2014 and November 2015 these employees were involved in the fraudulent appointment and salary adjustment of two ghost teachers at Isiqalo Primary School.

Additionally, one employee was accused of extending these ghost contracts, while another was alleged to have appointed two more ghost employees at both Isiqalo and Munsieville primary schools.

Criminally convicted


The fraud was perpetrated using the employees’ Persal system credentials. Over nearly two years, approximately R2-million was fraudulently paid into bank accounts belonging to Mothlang, a principal personnel officer who reported to one of the accused employees. Mothlang was later criminally convicted for the fraud.

The case’s trajectory through South Africa’s labour dispute resolution system is particularly instructive. The initial arbitration at the General Public Service Sectoral Bargaining Council focused narrowly on whether the department had proved “actual theft”, essentially missing the forest for the trees.

The arbitrator’s emphasis on the physical location where fraudulent transactions occurred — Braamfontein, Johannesburg and Pretoria rather than the employees’ Krugersdorp workstations — reflected a fundamental misunderstanding of modern digital fraud.

The Labour Court similarly adopted what the Appeal Court would later characterise as an overly technical approach. By focusing on whether employees had been specifically charged with sharing their Persal credentials, rather than their broader involvement in the fraudulent scheme, the court failed to engage with the practical realities of how such fraud operates.

The Labour Appeal Court’s decision represents a significant shift in how such cases might be approached in future. By focusing on the improbability of Mothlang repeatedly obtaining updated passwords without cooperation, the court demonstrated a more sophisticated understanding of system security and human behaviour.

This approach aligns with what we know about complex fraud schemes, which rarely leave direct evidence of collusion.

The Labour Appeal Court held that employees were unable to explain how their monthly updated passwords were repeatedly obtained over two years. Given a 2013 policy requiring password protection and the reasonable assumption that employees in their positions would understand the importance of credential security, the probabilities supported their involvement in the misconduct.

An unduly narrow and technical approach


The court also held that the arbitrator had materially misdirected himself by taking an unduly narrow and technical approach to the charge sheet.

The arbitrator’s error lay in focusing on whether “actual theft” was proved rather than examining the broader allegation of involvement in fraudulent appointments. This approach, combined with the arbitrator’s failure to properly weigh crucial undisputed evidence, had a “distorting effect” on the outcome.

The timing of this judgment is particularly relevant. As Letlhokwa George Mpedi recently noted in Daily Maverick, the Passenger Rail Agency of South Africa (Prasa) identified potentially 3,000 ghost employees in 2021, leading to savings of R200-million through Project Ziveze.

The Gauteng Department of Education case provides valuable insights into how such schemes operate and, crucially, how they might be detected and proven.

The court’s emphasis on password security as an indicator of complicity is particularly significant. In an era where public sector employees are increasingly aware of cybersecurity risks, the regular sharing of updated passwords over two years cannot be dismissed as mere carelessness. The court’s willingness to draw adverse inferences from this pattern of behaviour may influence how similar cases are approached in future.

However, the judgment also raises important questions about public sector controls. If four employees’ credentials could be used over two years to facilitate fraud worth R2-million, what does this suggest about the broader vulnerability of the Persal system?

The fact that transactions could be processed from locations different from the credential holders’ workstations points to significant system design flaws.

The case also highlights the challenge of balancing procedural fairness with practical justice. The Labour Appeal Court’s criticism of overly technical approaches to charge sheet interpretation reflects a growing recognition that workplace discipline must adapt to the realities of digital-era fraud.

Traditional concepts of location-based evidence and direct proof of theft may need reconsideration in cases involving system-based fraud.

Looking forward, this judgment should prompt a thorough review of public sector payroll systems. While the Persal system requires regular password updates, this case demonstrates that password changes alone are insufficient protection against determined fraudsters. Multi-factor authentication, biometric verification, and transaction location monitoring might need consideration.

Need for better training and accountability measures


The case also suggests the need for better training and accountability measures. Public sector employees need to understand that system credentials are not merely administrative tools, but critical security measures. The court’s willingness to draw adverse inferences from unexplained password sharing might help drive this message home.

Ultimately, the Labour Appeal Court’s decision marks a significant step forward in addressing ghost employee fraud. By focusing on the practical impossibility of credential misuse without cooperation, rather than requiring direct evidence of fraud, the court has provided a template for future cases.

However, the real test will be whether this approach prompts meaningful reforms in public sector payroll systems and employee accountability.

The ghosts in South Africa’s public sector payroll system may be invisible, but their impact is all too real. As this case demonstrates, exorcising them will require not just better systems but also a more sophisticated approach to detecting and proving fraud.

The Labour Appeal Court has shown the way — it’s now up to public sector administrators to follow through. DM

Categories:

Tags: