Payroll diversion scam emails: how to stop direct deposit fraud

A payroll diversion email is short and polite: "I've changed banks. Can you update my direct deposit before the next payroll?" It has no link, no attachment and no urgency beyond the pay date, so it looks like routine admin. This guide explains how the scam works, the red flags HR and payroll staff should know, and the controls that keep salaries going to the right account.

What is a payroll diversion scam?

Payroll diversion is a type of business email compromise. The goal is to redirect an employee's pay to an account the criminal controls. The FBI's Internet Crime Complaint Center (IC3) has described two versions.

The fake employee email. In its September 2019 PSA, the IC3 said that HR or payroll departments receive "spoofed emails appearing to be from employees requesting a change to their direct deposit account", usually timed for the current pay period. The PSA added that the new direct deposit details "generally" lead to a prepaid card account.

The hijacked employee login. In its September 2018 PSA, the IC3 described criminals phishing employees for their login credentials, then signing in to the payroll account and changing the bank details themselves. They also added rules to the employee's account so the employee wouldn't see alerts about the change. The PSA named education, healthcare and commercial airway transportation as the most affected sectors.

How common is payroll diversion?

There is no recent official count for payroll diversion on its own. The IC3 files it under business email compromise. Here's what the primary sources say:

• The 2019 PSA counted 1,053 complaints about this payroll variant between January 1, 2018 and June 30, 2019, with total reported losses of $8,323,354. It said the dollar loss from direct deposit change requests increased "more than 815 percent" over that period.
• The IC3's 2025 Annual Report recorded 24,768 BEC complaints in 2025, with reported losses of $3,046,598,558. That figure covers all BEC, not just payroll.
• In October 2025, Microsoft Threat Intelligence described a group it tracks as Storm-2657 running "payroll pirate" attacks. It observed "11 successfully compromised accounts at three universities" used to send phishing to "nearly 6,000 email accounts across 25 universities."

Individual losses look small next to invoice fraud, often one paycheck. But they hit an employee directly, and a payroll team that falls for one request can fall for several.

How does a payroll diversion attack work?

The fake employee email

1. Pick a target. The criminal finds a name and job title on your website, LinkedIn or a staff directory.
2. Choose a sending address. Options include a free webmail account with the employee's name as the display name, a lookalike domain, or spoofing your exact domain if you don't enforce DMARC.
3. Open a conversation. Many attackers start with a harmless question ("Who handles direct deposit?") to check that someone replies.
4. Send the request. New bank details, sometimes a voided-check image or a bank letter, timed just before the payroll cutoff.
5. Collect. The next paycheck lands in the new account, often a prepaid card, and is moved on quickly. The real employee only notices when their pay doesn't arrive.

The hijacked payroll login

Microsoft's write-up of Storm-2657 shows the modern version. The phishing emails used themes such as "2025 Compensation and Benefits Update", a fake misconduct report and an illness-exposure warning. They used adversary-in-the-middle (AiTM) phishing links to steal MFA codes as well as passwords. The attacker then signed in to the HR platform through single sign-on, enrolled their own phone numbers as MFA devices, changed the employee's bank details, and created inbox rules to hide or delete warning emails from the HR system.

Microsoft stressed that these attacks "don't represent any vulnerability in the Workday platform or products." They worked because accounts lacked MFA, or lacked phishing-resistant MFA. The same technique works against any HR or payroll service that stores bank details. Our guide to adversary-in-the-middle phishing explains how these kits get past one-time codes.

What are the red flags of a payroll diversion email?

Train HR, payroll and finance staff to slow down when they see any of these:

• A bank detail change requested by email. This is the biggest red flag on its own. Treat it as a request to start verification, not as an instruction.
• The sender address doesn't match. The display name is right, but the address is a personal webmail account or a domain that's one character off. Check the address, not the name. See how display-name spoofing works.
• Timing around the payroll cutoff. "Can this be done before Friday's run?"
• Reluctance to use the normal process. "I can't log in to the portal, can you do it for me?" or "I'm traveling, email is easiest."
• The new account is unusual for the employee. A prepaid card, an online-only bank or an account in a different name.
• Short, generic wording. No mention of anything only the real person would know. Phrases a colleague would never use.
• Replies go somewhere else. The Reply-To address differs from the From address. You can see this in the Email Header Analyzer.
• The employee says they never got a change notice. If your system emails a confirmation and the employee didn't see it, check their mailbox for hidden inbox rules.

None of these are proof. A request from a compromised mailbox can look perfect. That's why the procedure below doesn't depend on spotting anything.

How should HR verify a direct deposit change?

The IC3's 2019 advice was to "use secondary channels or two-factor authentication to verify requests for changes in account information." Turn that into a written procedure that applies to everyone, including executives.

A direct deposit change procedure

1. Don't accept bank details by email. Reply with a standard message: "For your security, we can only change bank details through the payroll portal" (or whatever your approved channel is).
2. Verify with the employee out of band. Use a phone number from the HR system that was on file before the request, a video call where you can see them, or an in-person check. Never use contact details from the email.
3. Ask a question the email can't answer. For example, confirm the last four digits of the old account or the date they joined.
4. Confirm to the old details. After any change, send a notice to the employee's existing email and phone number, not to anything supplied with the request.
5. Get a second approver. A different person signs off any bank detail change before the next payroll run.
6. Hold changes close to the cutoff. A change received within a few days of payroll waits for the next cycle unless it's verified in person.
7. Record what you did. Note who checked, how, when and on which number.
8. Escalate suspected fraud. Send the original email, as an attachment, to IT or security. Report the phishing email through your mail app as well.

Also tell employees how it works. If staff know HR will never change their bank details on an email, and will always call them first, a strange call from HR about a change they didn't ask for becomes an early warning.

Which technical controls reduce payroll diversion?

Protect the payroll and HR accounts

• Phishing-resistant MFA. Microsoft recommends methods such as "Windows Hello for Business, passkeys (FIDO2) and FIDO2 security keys, or certificate-based authentication (CBA)" (Microsoft Learn). The Storm-2657 report says these attacks succeeded where accounts had no MFA or no phishing-resistant MFA. Start with HR, payroll and finance staff, and the single sign-on account that reaches the payroll app.
• Separate credentials. The IC3's 2018 PSA advised using different login credentials for payroll than for other purposes, such as employee surveys.
• Change alerts that can't be hidden. Send bank detail change notices by text message or in-app as well as email, so an inbox rule can't hide them.
• Watch for odd sign-ins. The 2018 PSA recommended monitoring logins outside normal business hours. Also review new MFA methods registered shortly before a bank change.
• Hunt for hiding rules. Inbox rules that delete or move mail from your HR system are a strong sign of compromise. Our guide to malicious inbox rules and auto-forwarding shows where to look.

Reduce fake employee emails

• Enforce DMARC on your domain. At p=quarantine or p=reject, receivers can refuse mail that forges your exact domain, so "you@yourcompany.com" can't be faked from outside. The joint CISA phishing guidance recommends DMARC set to "reject". Check yours with the DMARC Checker.
• Tag external mail. A visible "External" label on a message that claims to come from a colleague is a strong prompt to check. See Outlook's external email tag.
• Filter impersonation. Inbound filtering that flags display names matching staff, and new lookalike domains, catches many of these requests before HR sees them.
• Make reporting one click. CISA's guidance stresses training staff to report suspicious emails and using the reporting tools built into the mail platform.

What should you do if a paycheck has already been diverted?

1. Call your bank now. Ask it to recall the payment. The IC3's advice is to contact your financial institution right away to request a recall of funds.
2. Tell the employee and pay them. It isn't their fault if your process accepted the change. Agree how they'll be paid while you investigate.
3. Report it. File at ic3.gov whatever the amount, with the transaction details. The 2018 PSA asked victims to note "payroll diversion" in the complaint.
4. Check the employee's accounts. If the change came through the portal, assume the login is compromised. Reset the password, revoke sessions, remove unknown MFA methods and delete suspicious inbox rules. Our checklist for a compromised email account covers each step.
5. Look for other changes. Review every bank detail change in the last few pay periods. Criminals rarely try only one employee.
6. Fix the process. Find the step that let the change through and close it before the next run.

Payroll diversion prevention checklist

Next steps

1. Write down your direct deposit change procedure and send it to everyone in HR, payroll and finance this week.
2. Tell all employees that HR will never change bank details because of an email, and will always confirm a change with them.
3. Turn on phishing-resistant MFA for HR, payroll and the single sign-on accounts that reach the payroll system.
4. Run the free Email Health Check to see whether your domain enforces DMARC. If you want impersonation and spoofing filtering in front of Microsoft 365, Google Workspace or cPanel mailboxes, see how iBlockSpam works.

Browse our other phishing and threat guides.