An employee emailed asking to change their direct deposit. Is it really them?

Payroll diversion gets less attention than wire fraud because the amounts are smaller, and that is precisely why it works. One paycheck going to the wrong account is not the kind of number that triggers a review, and it can repeat for several pay periods before anyone realizes.

The setup is the same as every other version. Someone gets into an employee's mailbox, or sends from a free email account claiming to be the employee writing from home. Then they email HR or payroll, usually a few days before the pay run, asking to update direct deposit details. The tone is casual, it is a routine request, and payroll handles routine requests all day.

How to handle it:

• Verify in person if you can. In a business where everyone is in one building, walk down the hall. It takes a minute and it is completely reliable.
• If you cannot, call the number in your HR file, not a number in the email. Same principle as everything else in this topic.
• Never action a banking change on an emailed request alone, however ordinary it looks and however senior the person appears to be.

The better fix, if your payroll system supports it: make employees change their own direct deposit details through the payroll self service portal, with multi-factor authentication on it, and have payroll decline emailed requests as a matter of policy. That removes the decision from a person under time pressure, which is where it goes wrong. Tell staff once that this is the rule and the emailed requests stop mattering.

Worth flagging to whoever runs payroll: if the request comes from a free email address with the employee's name, or says they lost access to their work email, that is the scam almost every time. A real employee who cannot get into their work email has a manager they can call.

Two related ones in the same family, since the same person is usually the target. A request from the owner or a senior person for an urgent wire or gift cards, which is the same trick aimed at a different button. And a request for copies of W-2s or employee records, which happens in the first quarter and is identity theft rather than payment fraud. Same rule applies to both: verify on a known number, no exceptions for seniority or urgency.