Business payment fraud (BEC) · Also called direct deposit fraud, payroll redirect scam, salary diversion, employee self-service phishing

Payroll diversion

Payroll diversion is a scam in which criminals redirect an employee's pay to their own account. They either email HR or payroll pretending to be the employee, or steal the employee's login to a payroll or self-service site and change the direct deposit details themselves. The next paycheck goes to the criminals.

How it works

1. Criminals phish the employee's login, sometimes with fake search ads that lead to a copy of the payroll or self-service site.
2. They sign in and change the direct deposit details, and may add rules so the employee does not see the change alerts.
3. Alternatively, HR or payroll receives an email that appears to come from the employee, asking to update direct deposit details before the next payday.
4. The pay goes to an account the criminals control, often a prepaid card account.

Red flags

• An email from an employee asks to change their direct deposit details, especially for the current pay period.
• The new account turns out to be a prepaid card account.
• A search ad for your payroll or benefits site leads to an address with a small misspelling.
• The employee suddenly receives a flood of spam emails, which can hide a warning that their account was changed.

If you are targeted

• Stop: freeze further changes to the employee's payment details until the account is secured.
• Contact the bank or payroll provider straight away and ask for a recall or reversal of the diverted payment.
• Reset the employee's password, remove any unknown email rules, and check multi-factor authentication settings.
• Report it. Our Report a scam page lists where to report in your country, such as ic3.gov and ReportFraud.ftc.gov in the US.

Where to report, by country

Prevention

For individuals

• Reach your payroll or benefits site through a bookmark or by typing the address, not through a search ad.
• Use a password for payroll that you do not use anywhere else.
• Never enter your login details in response to an email.

For organisations

• Verify every direct deposit change with the employee directly, using contact details already on file, before it takes effect.
• Turn on multi-factor authentication for payroll and self-service systems, and alert on logins outside normal hours.
• Tell the employee through more than one channel, such as email and text, whenever their bank details change.

By the numbers

Figures are for the reporting category this scam falls under, not this scam alone.

Real cases

No documented case in the atlas yet. New cases are added as they are sourced.

Delivered through: Email phishing, Malvertising and SEO poisoning

How official datasets classify it

FBI IC3

Business Email Compromise

Scamwatch

Business email compromise scams

MITRE ATT&CK

T1684.001, T1657

Questions

What is payroll diversion?

It is a scam in which criminals change where an employee's pay is sent, either by stealing the employee's payroll login or by emailing HR while posing as the employee.

How can HR tell if a direct deposit change request is fake?

Treat every change request made by email as unconfirmed. Check it with the employee using contact details already on file before it takes effect.

Related scams

• Vendor invoice and payment redirection
• CEO fraud (executive impersonation)
• Account takeover through fake bank support

Read more

• Corporate account takeover attacks: detecting and preventing them
• Glossary: multi-factor authentication (MFA)
• Phishing attacks: how to identify and avoid phishing scams