The Plutus Payroll fraud: how a payroll company became a $105m tax scheme

Somewhere in the western suburbs of Sydney around 2014, someone worked out that the Australian Taxation Office trusts payroll companies to pass on the tax they withhold from workers' wages, and doesn't check in real time whether they actually do. That gap, sitting quietly in the plumbing of the PAYG withholding system, became the foundation for what the Australian Federal Police and prosecutors would later describe as one of the largest tax frauds in the country's history. By the time it collapsed in 2017, the scheme had diverted tens of millions of dollars in withheld tax and superannuation that should have gone to the Commonwealth.

I've sat through enough fraud sentencing hearings in Sydney and Brisbane to know that the ones which actually work are rarely dramatic. They're administrative. Plutus Payroll was administrative to the point of tedium, which is precisely why it took the ATO and the AFP years to unwind, and why it's still cited in compliance briefings as a case study in how much damage a well-designed structure can do before anyone notices.

The mechanics of the Plutus Payroll fraud

Plutus Payroll Australia Pty Ltd was, on its face, an unremarkable payroll and workforce management outsourcing business. Employers contracted Plutus to manage payroll for their contractors and staff; Plutus would receive funds sufficient to cover wages, superannuation and the PAYG withholding tax owed to the ATO, then distribute those amounts accordingly. That's the entire pitch of a payroll intermediary: convenience, compliance, no fuss. The fraud sat in what happened after the money landed. Rather than one company processing everything, the operation ran through a layered network of second-tier subcontractor entities, each one legally distinct from Plutus itself, each one nominally responsible for remitting withheld tax to the ATO. Court evidence and AFP briefings described these entities as being controlled by people acting as straw directors, often recruited without a full understanding of what they were signing up for. Funds would flow from client employers to Plutus, then down through these subcontractor companies, and the PAYG withholding component that should have been forwarded to the Tax Office was instead siphoned off before each entity was allowed to become insolvent and abandoned.

It's a version of what's sometimes called phoenixing, dressed up with more moving parts. Because the withholding obligation technically sat with the second-tier company rather than Plutus itself, and because each of those companies could be wound up and replaced before the ATO's ordinary compliance cycle caught up, the scheme could keep running new entities through the same pipeline for an extended period. The Australian Financial Review's contemporaneous coverage and later AFP statements put the amount of withheld tax and superannuation misappropriated at more than $100 million, a figure that has generally been reported in the vicinity of $105 million across the life of the scheme.

Who was involved and how it unravelled

The AFP's Operation Elbrus, its formal investigation into the scheme, led to raids across Sydney in mid-2017. Among those arrested was Adam Cranston, son of a former ATO deputy commissioner, Michael Cranston — a detail that guaranteed the case front-page treatment well beyond the trade press that normally covers tax administration. Michael Cranston himself was separately charged over allegations he had used his position to access information about the ATO's investigation into the scheme, though he was ultimately acquitted of the criminal charge against him following a trial, a distinction the reporting at the time was careful to preserve and one worth restating plainly here: an acquittal is not a footnote, it's the outcome. Others arrested and later prosecuted over their roles in the scheme included Jason Onley, Simon Anquetil, Patrick Willmott and Devyn Hammond, among a wider group of associates. The AFP's case, run in cooperation with the ATO's Serious Financial Crime Taskforce, alleged the group had used the proceeds to fund a lifestyle that included property, luxury vehicles and racehorses — the kind of detail that makes for a memorable court reporter's paragraph but which, I'd note, is exactly the sort of allegation that needs to be read as allegation until a jury or judge says otherwise.

What eventually broke the scheme open wasn't a whistleblower in the conventional sense so much as the ATO's own escalating debt-recovery activity against the second-tier entities, combined with AFP financial intelligence work tracing fund flows between the subcontractor companies and entities associated with the alleged principals. The investigation ran for an extended period before the 2017 arrests, and the subsequent prosecutions took years more to reach trial, which is fairly typical for financial crime matters of this complexity — the paper trail is the whole case, and paper trails take time to reconstruct properly.

What the courts found

The prosecutions arising from Operation Elbrus were run in the NSW courts, and the trials that followed were lengthy, reflecting the volume of financial and documentary evidence involved. Several of those charged were convicted on counts relating to conspiracy to defraud the Commonwealth, with sentencing proceedings that followed working through the relative culpability of each defendant, including questions of who had designed the structure and who had simply operated within it. Simon Anquetil and Jason Onley were among those convicted, with prison sentences handed down reflecting the scale of the fraud and each defendant's role in it. Adam Cranston was also convicted following trial. As is standard in matters of this size, sentencing outcomes were accompanied by proceeds-of-crime action aimed at recovering assets connected to the scheme, run separately from the criminal proceedings themselves. I'd flag here that sentencing details in cases this complex are often varied or clarified on appeal, and readers should treat any specific figures reported around the time of sentencing as a snapshot of that hearing rather than a permanently fixed outcome. Michael Cranston's acquittal is worth dwelling on for a moment, because it illustrates something the Plutus case did well by accident: it drew a hard line between people who ran the fraud and people merely adjacent to it. The presumption of innocence isn't a technicality reporters mention to cover themselves. In his case it was the actual outcome.

Why the scheme worked for as long as it did

Honestly, the more interesting question than "who did it" is "why did the system let them." PAYG withholding relies on employers and payroll intermediaries acting in good faith between BAS lodgement cycles, and the ATO's compliance architecture at the time wasn't built to catch a coordinated network of shell subcontractors being churned through in sequence. The Serious Financial Crime Taskforce, established in 2015 partly in response to exactly this kind of structuring risk, was still relatively new when Plutus surfaced. Since then the ATO has tightened director identification requirements and expanded real-time data matching on withholding obligations — the introduction of Director ID numbers under the Australian Business Registry Services regime is at least partly a policy response to phoenixing patterns of the sort Plutus exploited, even if it wasn't designed around this case alone. Whether that closes the gap fully is a fair question. I'd argue the incentive structure for phoenix operators hasn't changed nearly as much as the paperwork around it has, and the ATO's own phoenix taskforce data (available via the ATO's published compliance reporting) suggests this remains a live enforcement priority rather than a solved problem.

A pattern, not an outlier

Plutus wasn't the first Australian fraud built on exploiting the gap between how a regulator assumes a system works and how it actually operates in practice, and it won't be the last. Readers who found the mechanics of this one interesting might also look at how 7-Eleven's wage theft scheme exploited a different kind of oversight gap at the franchise level, or how the Firepower fuel pill scheme burned through investor money on a promise that never had substance behind it. Different mechanics, same underlying lesson: complexity is often the point, not an accident.

For the broader run of Australian corporate scandals and the court outcomes that followed them, our Scandals & Reckonings hub keeps a running account.