Payroll Diversion Scams: How Fraudsters Redirect an Employee's Direct Deposit

Imagine checking your bank account on payday and finding nothing there, not a glitch, not a delay, but a deliberate theft. A cybercriminal silently logged into your company's payroll portal days earlier, changed your direct deposit details to their own account, and walked away with your entire paycheck.

This is a payroll diversion scam, and it's one of the most financially precise and emotionally devastating forms of identity fraud targeting workers today. The FBI's Internet Crime Complaint Center (IC3) reported an 815% increase in payroll diversion incidents between January 2018 and June 2019, with losses totaling at least $8.3 million in that 18-month period alone, according to an IC3 public service announcement, and experts believe the real figure is far higher due to widespread underreporting. Meanwhile, the broader category of Business Email Compromise (BEC), the family of attacks payroll diversion belongs to, cost Americans $2.77 billion in reported losses in 2024 alone, according to the FBI's IC3 2024 Annual Report.

The worst part? These scams often go undetected until payday. By the time you realize your money is gone, it's already been withdrawn from a mule account.

What is a payroll diversion scam?

A payroll diversion scam is a type of account takeover fraud where a cybercriminal gains unauthorized access to an employee's HR or payroll portal and secretly changes the direct deposit banking information to an account they control. On the next pay cycle, the employee's wages are routed straight to the fraudster instead of their own bank account.

Unlike traditional fraud that targets a company's vendor payments or financial accounts, payroll diversion targets individual employees. Every worker with a direct deposit is a potential victim, and the scam works by exploiting the routine, and largely unguarded, act of updating payroll information.

At its core, this is Business Email Compromise (BEC) aimed at wages instead of invoices. Rather than redirecting a supplier payment, the attacker redirects a salary, and the change often involves nothing more suspicious than updating a single field in a self-service portal.

How does a payroll diversion scam work? (step-by-step)

Fraudsters follow a precise, repeatable playbook. Here's exactly how a payroll diversion attack unfolds:

Step 1: The phishing hook

The attack almost always begins with a phishing email. The fraudster sends a convincing message that appears to come from the company's HR department, payroll provider (like ADP, Workday, or Paychex), or an internal system. The email typically creates urgency:

"Action Required: Your direct deposit information needs to be reconfirmed to avoid a delay in your upcoming paycheck."

The email contains a link to a realistic-looking fake login page, a near-perfect clone of the company's HR portal.

Step 2: Credential theft

The employee enters their username and password into the fake site, believing they're logging into the real portal. In reality, those credentials are captured immediately by the attacker.

Step 3: Account takeover

With the stolen credentials in hand, the fraudster logs into the actual payroll self-service system. They now have full access to the employee's profile, including pay stubs, personal information, and banking details.

Step 4: The redirect

The attacker quietly changes the direct deposit account number to a bank account they control, often a prepaid debit card or a "mule account" opened specifically to receive and quickly funnel stolen funds.

To cover their tracks, fraudsters may also:

• Suppress notification emails by setting up inbox rules that auto-delete any alerts about account changes
• Make the change right before a pay period closes to minimize the detection window

Step 5: Payday theft

When payday arrives, the payroll system processes the deposit exactly as instructed, to the fraudster's account. Funds are typically withdrawn within hours, often funneled through additional accounts or converted to gift cards, cryptocurrency, or wire transfers, making recovery nearly impossible.

The employee usually doesn't realize anything is wrong until they check their bank account and find it empty.

Who does payroll diversion target?

Payroll diversion attacks can strike any employee at any organization, but certain groups face elevated risk:

• Remote workers who manage everything digitally and rarely interact with HR face-to-face
• New employees who are still learning company systems and may not recognize a suspicious request
• Employees at companies with self-service HR portals where bank details can be updated online without secondary verification
• HR and payroll staff themselves, who may receive spoofed employee requests asking to update direct deposit details on someone else's behalf

Small and mid-sized businesses are especially vulnerable because they often lack the layered security controls of large enterprises, but no organization is immune. The FBI has documented payroll diversion attacks across education, healthcare, government agencies, and private businesses of all sizes.

Red flags: how to recognize a payroll diversion attempt

Awareness is your first line of defense. Watch for these warning signs:

In your inbox:

• An email from "HR" or your payroll provider asking you to verify or update your banking information
• Urgent language threatening a delayed paycheck if you don't act immediately
• Links that, on hover, show a slightly different URL than your real HR portal (e.g., payroll-company-secure.com instead of company.com/payroll)
• Email addresses with subtle misspellings (hr@cornpany.com vs. hr@company.com)
• A request to update direct deposit details during an unusual time, right before a pay cycle

In your payroll account:

• A login notification from an unrecognized device or location
• A confirmation email about a direct deposit change you didn't make
• Missing payroll notification emails you usually receive

For HR and payroll teams:

• An employee email (especially from a free webmail address like Gmail) requesting a bank account change
• Multiple employees at one company submitting direct deposit changes in a short time window
• Direct deposit change requests sent from a mobile device in a new location

What happens after the scam? Who eats the loss?

This is one of the most painful realities of payroll diversion fraud: employers are legally required to pay their employees, even if the paycheck was stolen due to fraud.

Under employment law, the obligation to pay wages falls on the employer, not the bank, not the payroll provider. This means:

• The employer must reissue the paycheck to the affected employee, even while trying to recover the stolen funds
• The employer typically absorbs the loss, since banks and payroll providers are generally not liable unless their own systems were at fault
• Recovery is difficult: By the time the fraud is discovered, the funds have usually been moved through multiple accounts, converted to gift cards or cryptocurrency, or wired overseas

Employers can attempt to:

• File a complaint with the FBI IC3 at ic3.gov
• Work with their bank to recall the ACH transaction (success depends on speed, recalls within 24-48 hours have the best chance)
• File a claim through a cyber insurance policy or crime coverage policy
• Pursue legal action if the fraudster is identified

But speed is everything. The faster you act, the better the odds of partial or full recovery.

How to protect yourself from payroll diversion scams

For employees

1. Never click links in payroll-related emails

Go directly to your company's HR portal by typing the address into your browser. Don't trust links in emails, even if the message looks authentic.

2. Enable two-factor authentication (2FA)

If your payroll or HR portal supports 2FA, enable it immediately. Even if a fraudster steals your password, they can't log in without the second factor.

3. Monitor your accounts regularly

Don't wait for payday. Check your payroll account periodically for any unauthorized changes to your banking details.

4. Verify unexpected requests by phone

If you receive any email asking you to update your direct deposit, even one that looks like it's from your own company, call HR directly at a verified number (not one in the email) to confirm.

5. Use strong, unique passwords

Reusing a password across your email, social accounts, and payroll portal creates a single point of failure. Use a password manager to maintain unique credentials for every system.

6. Stay alert to phishing triggers

Urgency, threats of delayed pay, unusual sender addresses, and requests for credentials are all red flags. When in doubt, stop and verify before clicking.

For employers and HR teams

1. Require out-of-band verification for all direct deposit changes

Any request to change banking details, whether submitted by an employee online or via email, should require secondary verification: an in-person visit to HR, a video call, or a phone callback to a known number on file. Email alone is not sufficient.

2. Enforce multi-factor authentication on payroll portals

Make MFA mandatory for all employees and HR staff with payroll access. A stolen password should never be enough to access payroll systems.

3. Send automatic alerts for any account changes

Configure your payroll system to immediately notify the employee's primary email (and ideally phone) whenever banking details are updated. This creates a detection window before the next pay run.

4. Restrict and audit payroll access

Apply the principle of least privilege: only staff who need payroll access should have it. Audit access logs regularly for unusual login times, locations, or device types.

5. Run phishing awareness training

Regular simulated phishing campaigns keep employees sharp. The more realistic the training, the better prepared your team will be to identify a real attack.

6. Have a response plan ready

Know in advance who to call (bank, payroll provider, FBI IC3) if a diversion is suspected. Time is the most critical factor in fund recovery.

What to do if you've already been victimized

If you discover your paycheck was diverted:

1. Contact HR and your payroll provider immediately, they may be able to intercept or recall the ACH transfer if it's recent enough
2. Call your bank and ask about an ACH return or fraud recall
3. Change your payroll portal password and enable 2FA right away, the attacker may still have access
4. File a complaint with the FBI IC3 at ic3.gov, this helps law enforcement track and investigate fraud patterns
5. Check your other accounts, if your credentials were phished, attackers may have tried to access your email, banking, or other accounts with the same login
6. Notify your employer if you haven't already, they need to know so they can issue a replacement payment and alert other employees to a possible phishing campaign

The bigger picture: payroll diversion as part of Business Email Compromise

Payroll diversion doesn't exist in isolation, it's part of a broader wave of Business Email Compromise attacks that cost Americans $2.95 billion in 2023 and $2.77 billion in 2024, according to the FBI's IC3 2024 Annual Report, a slight year-over-year decline, though BEC remains one of the costliest categories of cybercrime the FBI tracks. BEC encompasses a range of scams, from fake vendor invoices to CEO wire fraud, but payroll diversion is uniquely insidious because it harms individual employees directly and personally.

What makes payroll diversion especially dangerous is its precision and quietness. Unlike ransomware or large wire fraud, this attack touches a single field in a self-service portal. No alarm bells. No suspicious large transfers. Just a routine payroll deposit, to the wrong account.

Fraudsters are also becoming more sophisticated. Some now combine payroll diversion with:

• Deepfake audio or video impersonating executives to override HR verification steps
• AI-generated phishing emails that are far more convincing than the 'Nigerian prince' scams of old
• Multi-stage attacks that compromise an employee's email first, then use it to send believable internal requests to HR

The threat is real, it's growing, and it's targeting ordinary workers, not just executives or corporations.

How Guardio helps protect you

Payroll diversion attacks typically start with a phishing email and a fake login page. That's exactly where Guardio steps in.

Guardio monitors your web activity in real time, on both your browser and your phone, detecting and blocking malicious websites, including the fake HR and payroll portal lookalikes that fraudsters use to steal your credentials. When you click a link in a suspicious email and it tries to take you to a credential-harvesting site, Guardio aims to flag it before you enter your credentials.

Beyond blocking bad sites, Guardio's identity protection alerts you when your personal information, including email addresses and passwords, appears in data breaches or on the dark web. Because many payroll diversion attacks begin with credentials stolen in a prior breach, knowing your data is compromised early gives you the chance to change your passwords before an attacker can exploit them.

For small businesses managing their own payroll and HR, Guardio for Business extends these safeguards across your team, ensuring that the phishing email targeting your newest hire doesn't become a company-wide crisis.

Payroll diversion is a sophisticated scam, but it starts with a simple trick. Don't let a fake login page cost you your paycheck.

Get a free security scan with Guardio today

Conclusion

Payroll diversion is sophisticated, targeted, and built to stay invisible. But it almost always starts the same way: a convincing phishing email and a fake login page. That's a human problem with a human solution.

Check your payroll account for unauthorized changes. Enable MFA today. And if your paycheck ever doesn't show up when it should, treat it as an emergency, not an inconvenience.

Get a free security scan with Guardio today