Payroll Diversion Fraud

Payroll is built on trust. Employees trust that their wages will reach the right account, and payroll teams trust that requests to update direct deposit information are legitimate. Criminals exploit that routine process through payroll diversion fraud.

The threat is part of the broader business email compromise (BEC) landscape. According to the FBI’s 2025 Internet Crime Report, BEC generated approximately 24,768 complaints and more than $3 billion in reported losses during 2025. Payroll diversion is one variation of this fraud, with criminals targeting employee pay instead of a vendor invoice or one-time wire.

How Payroll Diversion Fraud Works

A typical scheme begins when a criminal impersonates an employee or gains access to the employee’s email or payroll account. The criminal then asks human resources or payroll personnel to replace the employee’s legitimate bank information with an account the criminal controls. The request may arrive shortly before payroll closes and may claim that the change is urgent. If the update is processed without independent verification, the employee’s next paycheck is redirected. The fraud may not be discovered until payday, after the funds have moved.

These requests can look ordinary. A message may use the employee’s name, job title and writing style, or it may come from the employee’s real email account. In other cases, a stolen password allows the criminal to make the change directly through a payroll portal. Because the individual transaction may be smaller than a fraudulent vendor payment, repeated payroll diversions can escape notice.

What warning signs should your business watch for?

  • A request to change direct deposit information arrives by email instead of through the normal payroll process.
  • The sender asks for the change to be completed just before an approaching payroll deadline.
  • The email address or domain differs slightly from the employee’s usual address.
  • The employee asks to bypass a form, approval or verification step.
  • Several employees request deposit changes within a short period.
  • Multiple employees’ wages are directed to the same account.
  • An employee reports that a paycheck did not arrive or that payroll information changed without authorization.

Prevention Techniques

Consider requiring employees to submit direct deposit changes through an authenticated payroll system or a documented internal process. If a request arrives by email, independently contact the employee using a phone number already on file. Do not rely on the telephone number included in the request.

Consider requiring one employee to enter a change and another to approve it. Notify the employee through an established contact method when banking information is changed. Use multifactor authentication for email and payroll systems, limit payroll access to employees who need it and review access regularly.

Before each payroll run, review changes made since the prior pay period. Look for duplicate deposit accounts, unusual routing information, changes involving former employees and last-minute updates. A short review before funds are released can prevent a loss that may be difficult to recover later.

Respond Quickly to Suspected Fraud

If your business receives a suspicious payroll-change request, pause the change and verify it directly with the employee. If a paycheck has already been redirected, contact your financial institution and payroll provider immediately to determine whether the payment can be stopped or recovered. Preserve emails, login records and change logs, reset affected credentials and report the incident to law enforcement.

Payroll diversion can disrupt operations and leave an employee without expected wages. Clear procedures, independent verification and prompt action can help protect both your business and your employees.