Blog Post

Payroll diversion fraud starts with a routine request. An email asks HR to update an employee’s direct deposit before the next pay run, or a scammer quietly logs into an employee’s payroll portal and swaps in a new bank account. Nobody notices until payday, when the employee asks why the money never arrived.

This week is International Fraud Awareness Week, which the Association of Certified Fraud Examiners runs Nov. 15–21 to promote fraud prevention and education. Payroll is a good place for small and mid-sized businesses to start. Year-end bonuses, benefits enrollment emails, and holiday schedules give scammers plenty of cover, and the controls that stop them cost very little.

How Payroll Diversion Fraud Works

Payroll diversion is a form of business email compromise, the category the FBI’s Internet Crime Complaint Center tracks for email-based payment fraud. In its 2025 Internet Crime Report, the IC3 logged 24,768 business email compromise complaints with more than $3 billion in reported losses. Scammers reach paychecks in two main ways.

1. The impersonation email. A scammer emails HR or the payroll administrator, posing as an employee. The message is short and polite: new bank, new account, please update before Friday. It may come from a lookalike address or from the employee’s real mailbox if it has been compromised. If payroll makes the change, the next deposit goes to the scammer.
2. The portal takeover. The scammer phishes the employee directly, collects their login for the payroll or HR system, and changes the direct deposit information in self-service. The FBI warned employers about this scheme in 2018. It noted that criminals add rules to the employee’s account so they never see the alert confirming the change, and the money often goes to a prepaid card.

The technique has only gotten sharper. In October 2025, Microsoft Threat Intelligence described a “payroll pirate” campaign by a group it tracks as Storm-2657. The group used phishing links designed to capture multi-factor authentication codes, broke into employees’ email, set inbox rules to delete notifications from their HR platform, and redirected salaries. Microsoft observed 11 compromised accounts at three universities sending phishing emails to nearly 6,000 addresses across 25 institutions. Some lures used compensation and benefits themes, the same subjects your employees expect from HR this time of year.

Warning Signs to Watch For

Train HR, payroll, and managers to pause on any of these:

• A direct deposit change requested by email only, with no call or in-person confirmation
• Pressure to make the change before the next pay run or outside normal cutoffs
• A request that arrives from a personal email address or a domain one letter off from yours
• An employee who says they never received a change notification they should have gotten
• Logins to the payroll system at odd hours or from unfamiliar locations

Controls That Stop It

The fixes are mostly process, with a few technical settings behind them.

Verify every bank change by phone. Call the employee at the number already on file, never a number in the request. This single step, which we also recommend for vendor payments in our post on business email compromise in construction, stops the impersonation email cold.

Add a short hold on new accounts. Many payroll systems can delay a new deposit account by one pay cycle or require a second approver. Use it, especially in December.

Notify the employee through a second channel. When direct deposit details change, send a confirmation by text or to a personal address on file, in addition to work email. A scammer who controls the work mailbox can hide one notification. Two are harder.

Turn on multi-factor authentication for email and payroll. The FBI recommends two-factor authentication for systems handling sensitive information. Microsoft goes further and recommends phishing-resistant methods, such as passkeys or security keys, because codes sent by text or app can be phished. Our guide to multi-factor authentication for small business explains where to start.

Watch for suspicious inbox rules. A rule that deletes or hides emails from your payroll provider is a red flag. Your IT team or provider can alert on new rules like these and on sign-ins outside business hours. As we’ve noted before, attackers increasingly sign in rather than break in, so monitoring logins matters as much as blocking malware.

If It Happens: Act Within Hours

Speed decides whether the money comes back.

1. Call your bank and payroll provider immediately to stop or recall the deposit.
2. Reset the affected employee’s passwords, revoke active sessions, and review their MFA devices for anything they didn’t add.
3. Remove any suspicious inbox rules and check for other accounts that received the same phishing email.
4. File a complaint with the FBI’s IC3 at ic3.gov. The FBI asks victims to write “payroll diversion” in the body of the complaint.

Protect Your Payroll With Eclipse Networks

Eclipse Networks helps businesses across Atlanta and Georgia lock down the email accounts, payroll access, and monitoring that payroll diversion depends on. Our cybersecurity and incident response team can set up phishing-resistant MFA, alert on suspicious inbox rules, and help you respond fast if something slips through.

Through the end of the year, we’re offering free cybersecurity consultations. Contact us to schedule yours.