Payroll fraud: the email that redirects an employee's paycheck

It's a short, polite email to whoever runs payroll:

Hi, I've switched banks. Can you update my direct deposit before the next pay run? New details attached. Thanks!

It comes from the employee's name. Sometimes it comes from their real email account. It's a normal request, so it gets done. Then payday arrives, the employee asks where their money is, and it's gone to an account the criminal controls, often a prepaid card that's emptied the same day.

This is payroll diversion. It's small next to some frauds, one paycheck at a time, which is exactly why it keeps working.

The two ways it happens

1. The fake employee. The criminal emails or texts your office pretending to be an employee and asks you to change their bank details. It might come from a lookalike address, a personal Gmail ("my work email isn't working"), or the employee's real mailbox if it's been taken over.

2. The hacked payroll login. The FBI has warned about this version since 2018: criminals send employees phishing emails to capture their login for the payroll or HR portal, then sign in and change the deposit account themselves. They may also set up email rules so the employee never sees the "your bank details were changed" notice (FBI public service announcement, 2018).

Why it works

• It looks routine. People change banks. Payroll staff process these all the time.
• It's timed for pressure. Usually just before a pay run, so there's no time to check.
• It's small enough to go unnoticed. One paycheck doesn't trip the alarms a $50,000 wire would.
• Nobody owns the check. In a small business, payroll is often one person juggling five other jobs.

The rules that stop it

1. Bank detail changes are never made from an email or text alone. Confirm with the employee in person, or by calling the number you already have on file. Not the number in the message, and not by replying to it.

2. Changes are made only in the payroll system, by the employee, with two-step sign-in. Most payroll providers let employees update their own details. Require two-step sign-in on that portal for everyone, so a stolen password isn't enough.

3. Changes trigger a notice to the old details too. If your payroll system can email the employee's previous address or text their phone when banking details change, turn it on.

4. Hold new details for one pay cycle, or pay a test amount. If the change arrives two days before payday, it waits until the next one, unless it's been confirmed face to face.

5. Watch for the patterns: a change request right before payday, a "my work email isn't working, use this one" message, or several employees changing banks in the same week.

Write these down and give them to whoever handles payroll. A rule they can point to makes it much easier to say "I need to call you first" to someone who sounds like their manager.

If it's already happened

1. Call your bank and the payroll provider immediately. Ask them to try to recall the deposit. Speed matters; prepaid card accounts are often emptied within hours.
2. Pay the employee. It isn't their fault, and they have rent due. Sort out the recovery separately.
3. Check the employee's email account for rules that hide messages, forwarding to an outside address, or sign-ins from places they've never been. If you find any, follow what to do when a work email is hacked.
4. Report it at ic3.gov. The FBI asks victims to include "payroll diversion" in the complaint.
5. Check every other employee's banking details for recent changes.

What it costs, against what's at stake

	What it comes to
Our Business plan for ten people	$1,740 a month, with two-step sign-in set up, email security that catches phishing, account monitoring and staff training
One diverted paycheck	The full net pay, paid twice: once to the criminal, once to your employee
If the payroll login was taken over	Every employee's banking and personal details, which may mean notifying them under Florida's data breach law
Your employee's trust	The week they spent wondering whether they'd be paid

Next steps

1. Tell whoever runs payroll, in writing, that bank changes are confirmed by phone or in person.
2. Turn on two-step sign-in on your payroll portal for every employee.
3. For the same scam aimed at your suppliers and customers, see the call-back rule, and get our free payment change verification procedure. Or book a free Security Check.