Did Your Employee Really Change Their Direct Deposit?

The email looks totally normal

It comes from your office manager’s name. Maybe even her real email address. It’s short and polite.

Hi, I switched banks. Can you update my direct deposit before the next payroll? New info attached. Thanks!

Whoever runs payroll updates it, because why wouldn’t they? People switch banks all the time. Two weeks later your office manager comes to you asking where her paycheck went.

It went to a prepaid card or a throwaway account that got emptied the same day. And now you have a very upset employee, a payroll mess and probably no way to get the money back.

What payroll diversion is

This is a flavor of business email compromise, the same family as fake invoice scams. The difference is the target. Instead of going after a big vendor payment, the attacker goes after something that happens every two weeks like clockwork and nobody double checks.

It works so well on small businesses for a simple reason. In a lot of offices, one person handles payroll, they know everyone by name, and a request from a coworker feels safe. There’s no approval process because there’s never been a reason for one.

How they pull it off

There are two common ways.

The lookalike. The email comes from a free Gmail account with the employee’s name as the display name. On a phone, you only see the name, not the address. It looks legit at a glance.

The real account. This is the scary one. The employee’s actual email got taken over, usually through a phishing link. Now the request comes from their real mailbox, and the attacker often sets up a rule to hide any replies so the employee never sees the conversation happening.

Some attackers skip email completely and log into your payroll portal as the employee, because the employee reused a password from some other site that got breached. Then they change the bank info themselves. No request, no email, nothing for anyone to catch.

Red flags to train your payroll person on

• A bank change request that shows up right before a pay date
• Pressure to get it done quick, before this cycle
• The employee is out of office, traveling or hard to reach
• The new account is at an online-only bank or a prepaid card service
• The request asks you to keep it quiet or skip the usual form
• Replies come back fast but the tone is a little off

None of these prove anything alone. Two or more together should make someone stop and pick up the phone.

The fix is a process, not a product

You can’t buy your way out of this one. You fix it by making one rule and sticking to it every time.

Rule 1: No bank changes by email. Ever.

Direct deposit changes happen in the payroll system by the employee themselves, or on a signed form handed over in person. Email requests get a polite no and a pointer to the right process. Tell everyone this rule now, so when the real request comes, nobody’s offended.

Rule 2: Call back on a number you already have

If a change comes in any other way, the person running payroll calls the employee on the number in their file. Not the number in the email. Not a reply to the email. Thirty seconds on the phone stops this cold.

Rule 3: Tell the employee when anything changes

Most payroll platforms like Gusto, ADP and Paychex can send an alert to the employee when their bank info changes. Turn it on. If someone else changes it, the real employee finds out right away instead of on payday.

Rule 4: Lock down the payroll portal

Require MFA for every employee login to your payroll system. This one step kills the password reuse attack, which is a lot more common than people think.

Rule 5: Delay first deposits to a new account

Some businesses hold a new bank account for one pay cycle or send a paper check the first time. It’s a little annoying. It’s also a lot less annoying than losing someone’s whole paycheck.

If it already happened

Move fast. Minutes matter here.

• Call your bank and your payroll provider right away and ask for a recall on the deposit
• File a report at ic3.gov, the FBI’s internet crime site
• Reset the employee’s email password and check their mailbox for forwarding rules or hidden rules
• Look at who else that mailbox emailed recently, because the attacker may have tried more than one scam
• Talk to your employee and figure out how you’re going to make them whole

What this means for you

Your people are counting on that paycheck to pay rent. If it vanishes, it doesn’t matter to them that a hacker did it. It matters that it’s gone.

The good news is that this is one of the easiest scams to shut down. One rule, one phone call, one alert setting. Write it down this week and tell your team about it at the next meeting.

If you want a hand setting up MFA or checking your mailboxes for sketchy rules, reach out through yourtech.solutions. Securing systems, supporting people.