Payroll diversion · checked 16 October 2026

The payroll direct deposit change scam

An email that looks like it's from an employee asks HR or payroll to switch their pay to a new account "before this payroll". The employee notices on payday, and the money is gone.

Check a direct deposit email Set up call-backs and approvals

Typical signs

• Sent from a personal address (Gmail, Outlook) or a name that's slightly off, not the company email.
• Asks for the change "before this payroll" or "today".
• The employee "can't talk" or is "travelling".
• The new account is a prepaid card or online-only bank.
• Sometimes it starts with an innocent question ("can you tell me how to change my direct deposit?") to make the next message look normal.

The routine that stops it

1. Never accept new pay details by email. Ask the employee to submit them through your payroll portal or a secure link.
2. Confirm with the employee in person or on the phone number in their HR file from before the request.
3. Have a second person approve.
4. Tell the employee by their work email and their old contact details that their pay account changed.
5. Consider a one-payroll delay before new details are used.

If pay was already diverted

Call your bank immediately to recall the payment, pay the employee (they're still owed their wages), and report it: US ic3.gov; UK Action Fraud (0300 123 2040); India 1930 or cybercrime.gov.in. Check whether the employee's email account was hacked.

PayeeGuard handles employees and suppliers the same way: secure link, call-back on the number on file, second approval, and a record.

Check a suspicious email free Set up call-backs and approvals