A payroll direct deposit scam is a form of fraud in which a criminal impersonates one of your employees and emails HR or payroll asking to reroute that person’s paycheck to a new bank account. If the change is made, the scammer collects the pay and the employer is often left to replace the lost wages. These schemes remain a serious threat, and convincing impersonation can make fraudulent requests hard to spot. The IRS has outlined how fake payroll direct deposit emails work.
Payroll direct deposit scams are a form of business email compromise (BEC), which the FBI ranked among the costliest cybercrimes of 2024. That year alone, the FBI’s Internet Crime Complaint Center logged more than 21,000 BEC incidents and about $2.77 billion in reported losses. These figures cover BEC broadly, not just payroll diversion. Small and midsize businesses are squarely in the target range.
How a payroll direct deposit scam works
The scam often starts with an email. A criminal poses as an employee, often borrowing the name of someone high up in the organization, and asks the HR or payroll contact to update the bank account used for direct deposit. The message uses the employee’s real name, a casual tone, and a believable reason for handling the change by email rather than through the usual process.
A typical message might say, “I switched banks. Can you update my direct deposit before the next payroll? I’m tied up in meetings and can’t call.” There is nothing dramatic about it, which is exactly why it works. The request looks routine, it arrives at a busy moment, and it asks for a small change that is easy to make.
If the request is accepted, the next paycheck is deposited into the scammer’s account. By the time the real employee notices a missing paycheck, the funds may be difficult to recover. Because the employee never actually requested the change, the employer still needs to address the employee’s unpaid wages promptly.
Warning signs of a fake direct deposit change request
A few patterns show up again and again. Treat any of these as a reason to stop and verify:
- The request comes by email or text instead of your normal payroll process.
- There is a sense of urgency, or a reason given for why it cannot be handled in person.
- The wording, tone, or email address does not quite match how that employee usually communicates.
- The email address is close to the employee’s real one but slightly altered.
- The message has small grammar or spelling mistakes that seem out of character.
- The banking details are unexpected or inconsistent with information you can independently verify.
- The request lands right before a scheduled pay run.
Why these scams target small and midsize businesses
Criminals go after the people who can move money and touch employee data, which usually means HR, payroll, and finance. Smaller teams are attractive precisely because they tend to be lean and fast-moving. When one person handles payroll, a single convincing email can be enough, because there is no second set of eyes required to approve a banking change. A larger finance department may have built-in separation of duties that a small business has not had the chance to set up yet.
These schemes also lean on familiarity. A request that appears to come from an owner or a well-known colleague carries a built-in reason not to push back. The good news is that the same controls that protect a large enterprise work just as well for a small one, and most of them cost nothing to put in place.
How to prevent payroll direct deposit fraud
A simple rule goes a long way: never accept a direct deposit change based on an email or text alone. Pair that rule with a short list of controls that make unauthorized changes harder to pull off.
- Verify every change directly with the employee through a trusted channel, such as a phone call to a number already on file or an in-person conversation.
- Require more than one person to review and approve any banking change, so no single inbox is a point of failure.
- Route employees to update their own banking details through a secure self-service portal rather than by request. That is a more secure way to submit a change than emailing banking information, and employees can add, edit, or remove their own direct deposit accounts through Helpside Tools, part of Helpside’s payroll services.
- Turn on multifactor authentication for payroll and HR system logins.
- Set a clear cutoff for changes before payroll, and promptly verify any last-minute request through a trusted channel.
- Train HR, payroll, and finance staff to recognize these requests, and remind employees to keep their Helpside Tools login information private.
Payroll fraud is one piece of a broader set of threats small businesses face. For a wider view, see our guide to risk management for small businesses, and our guide to payroll cards, which weighs the security trade-offs of different employee payment methods.
How to report a payroll direct deposit scam
Reporting an attempt helps authorities track these schemes and can help other businesses avoid the same trap. Use these channels:
Where to report it
- Forward tax-related phishing emails to phishing@irs.gov (monitored by IRS cybersecurity staff).
- Report the direct deposit or BEC attempt to the FBI’s Internet Crime Complaint Center (IC3) at ic3.gov.
When you report, keep the original email, including its full headers if you can retrieve them, along with any account and routing numbers the scammer provided. That detail helps investigators trace the attempt and connect it to related cases.
What to do if it already happened
If a fraudulent change slipped through, act quickly. Contact your bank right away to ask whether the transfer can be recalled or frozen, and report the incident through the channels above. The sooner you move, the better your chances of limiting the loss.
From there, document what happened while the details are fresh, notify the affected employee, and let your payroll provider know so they can watch for related attempts on your account. Then review how the request got through. In most cases, the gap is in the process rather than the technology, and closing that gap reduces the risk of it happening again.
How Helpside helps protect clients
Helpside has seen many of these attempts come through, often passed along by clients who were not sure whether a request was legitimate. We have verification safeguards in place for direct deposit change requests and have caught many scam attempts before any money moved. Those safeguards work best alongside a clear internal policy and a payroll team that knows what to watch for, which is why we encourage clients to build the habits above into their own process.
Frequently asked questions
What is a payroll direct deposit scam?
A payroll direct deposit scam, also called payroll diversion fraud, is a type of business email compromise. A criminal impersonates an employee and emails HR or payroll asking to change the bank account where that employee’s pay is deposited. If the change goes through, the next paycheck lands in the scammer’s account instead of the employee’s, and the employer is often left to replace the lost wages.
How can you tell if a direct deposit change request is fake?
Watch for a request sent by email or text instead of your normal payroll process, a sense of urgency or secrecy, wording or an email address that does not quite match the employee, and timing right before a pay run. When anything feels off, confirm the request in person or by phone using a number you already have on file.
How do you prevent payroll direct deposit fraud?
Set a clear policy that direct deposit changes are never accepted by email or text alone. Verify every change directly with the employee through a trusted channel, require more than one person to approve banking changes, and route employees to update their own information through a secure self-service portal. Multifactor authentication on payroll logins adds another layer of protection.
How do you report a payroll direct deposit scam?
Forward tax-related phishing emails to phishing@irs.gov, which is monitored by IRS cybersecurity staff. Report the direct deposit or business email compromise attempt to the FBI’s Internet Crime Complaint Center at ic3.gov. If money was already sent, contact your bank immediately and ask them to try to recall or freeze the transfer.
Can you get the money back after a direct deposit scam?
Recovery is difficult once funds are withdrawn, so speed matters most. Contacting your bank and filing a report with the FBI’s Internet Crime Complaint Center right away gives you the best chance of having the transfer frozen or recalled. Even so, prevention and quick verification are far more reliable than trying to recover wages after the fact.
Who do payroll scammers usually target?
These schemes target the people who handle money and employee data, usually HR, payroll, and finance staff. Criminals often impersonate executives or other employees because those requests are less likely to be questioned. The IRS and its Security Summit partners have specifically warned that payroll and HR offices are frequent targets.
To change banking information safely, encourage employees to update their direct deposit details themselves through Helpside Tools rather than by email. If you have questions about a direct deposit request, the Client Success Management team is here to help at service@helpside.com.
