A payroll direct deposit scam is a form of fraud in which a criminal impersonates one of your employees and emails HR or payroll asking to reroute that person’s paycheck to a new bank account. If the change is made, the scammer collects the pay and the employer is often left to replace the lost wages. These schemes remain a serious threat, and convincing impersonation can make fraudulent requests hard to spot. The IRS has outlined how fake payroll direct deposit emails work.
Payroll direct deposit scams are a form of business email compromise (BEC), which the FBI ranked among the costliest cybercrimes of 2024. That year alone, the FBI’s Internet Crime Complaint Center logged more than 21,000 BEC incidents and about $2.77 billion in reported losses. These figures cover BEC broadly, not just payroll diversion. Small and midsize businesses are squarely in the target range.
The scam often starts with an email. A criminal poses as an employee, often borrowing the name of someone high up in the organization, and asks the HR or payroll contact to update the bank account used for direct deposit. The message uses the employee’s real name, a casual tone, and a believable reason for handling the change by email rather than through the usual process.
A typical message might say, “I switched banks. Can you update my direct deposit before the next payroll? I’m tied up in meetings and can’t call.” There is nothing dramatic about it, which is exactly why it works. The request looks routine, it arrives at a busy moment, and it asks for a small change that is easy to make.
If the request is accepted, the next paycheck is deposited into the scammer’s account. By the time the real employee notices a missing paycheck, the funds may be difficult to recover. Because the employee never actually requested the change, the employer still needs to address the employee’s unpaid wages promptly.
A few patterns show up again and again. Treat any of these as a reason to stop and verify:
Criminals go after the people who can move money and touch employee data, which usually means HR, payroll, and finance. Smaller teams are attractive precisely because they tend to be lean and fast-moving. When one person handles payroll, a single convincing email can be enough, because there is no second set of eyes required to approve a banking change. A larger finance department may have built-in separation of duties that a small business has not had the chance to set up yet.
These schemes also lean on familiarity. A request that appears to come from an owner or a well-known colleague carries a built-in reason not to push back. The good news is that the same controls that protect a large enterprise work just as well for a small one, and most of them cost nothing to put in place.
A simple rule goes a long way: never accept a direct deposit change based on an email or text alone. Pair that rule with a short list of controls that make unauthorized changes harder to pull off.
Payroll fraud is one piece of a broader set of threats small businesses face. For a wider view, see our guide to risk management for small businesses, and our guide to payroll cards, which weighs the security trade-offs of different employee payment methods.
Reporting an attempt helps authorities track these schemes and can help other businesses avoid the same trap. Use these channels:
Where to report it
When you report, keep the original email, including its full headers if you can retrieve them, along with any account and routing numbers the scammer provided. That detail helps investigators trace the attempt and connect it to related cases.
If a fraudulent change slipped through, act quickly. Contact your bank right away to ask whether the transfer can be recalled or frozen, and report the incident through the channels above. The sooner you move, the better your chances of limiting the loss.
From there, document what happened while the details are fresh, notify the affected employee, and let your payroll provider know so they can watch for related attempts on your account. Then review how the request got through. In most cases, the gap is in the process rather than the technology, and closing that gap reduces the risk of it happening again.
Helpside has seen many of these attempts come through, often passed along by clients who were not sure whether a request was legitimate. We have verification safeguards in place for direct deposit change requests and have caught many scam attempts before any money moved. Those safeguards work best alongside a clear internal policy and a payroll team that knows what to watch for, which is why we encourage clients to build the habits above into their own process.
A payroll direct deposit scam, also called payroll diversion fraud, is a type of business email compromise. A criminal impersonates an employee and emails HR or payroll asking to change the bank account where that employee’s pay is deposited. If the change goes through, the next paycheck lands in the scammer’s account instead of the employee’s, and the employer is often left to replace the lost wages.
Watch for a request sent by email or text instead of your normal payroll process, a sense of urgency or secrecy, wording or an email address that does not quite match the employee, and timing right before a pay run. When anything feels off, confirm the request in person or by phone using a number you already have on file.
Set a clear policy that direct deposit changes are never accepted by email or text alone. Verify every change directly with the employee through a trusted channel, require more than one person to approve banking changes, and route employees to update their own information through a secure self-service portal. Multifactor authentication on payroll logins adds another layer of protection.
Forward tax-related phishing emails to phishing@irs.gov, which is monitored by IRS cybersecurity staff. Report the direct deposit or business email compromise attempt to the FBI’s Internet Crime Complaint Center at ic3.gov. If money was already sent, contact your bank immediately and ask them to try to recall or freeze the transfer.
Recovery is difficult once funds are withdrawn, so speed matters most. Contacting your bank and filing a report with the FBI’s Internet Crime Complaint Center right away gives you the best chance of having the transfer frozen or recalled. Even so, prevention and quick verification are far more reliable than trying to recover wages after the fact.
These schemes target the people who handle money and employee data, usually HR, payroll, and finance staff. Criminals often impersonate executives or other employees because those requests are less likely to be questioned. The IRS and its Security Summit partners have specifically warned that payroll and HR offices are frequent targets.
To change banking information safely, encourage employees to update their direct deposit details themselves through Helpside Tools rather than by email. If you have questions about a direct deposit request, the Client Success Management team is here to help at service@helpside.com.