The email asking to change where a paycheck goes

How it works

Someone sends an email to whoever handles payroll, appearing to come from an employee. It says they have switched banks and asks for their direct deposit to be updated before the next payday. Sometimes it comes from a lookalike address. Sometimes the employee’s real mailbox has been taken over, so it comes from the genuine address.

If the change is made, the next paycheck goes to the scammer. Often nobody notices until the employee asks why they were not paid.

A variation targets employees directly: a fake payroll or HR login page asks them to “confirm” their details, and the scammer changes the bank account through the real system.

How to stop it

• Never change bank details based on email alone. Confirm with the employee in person or by calling a number you already have on file.
• Use the payroll system’s own process. Employees should update their own details by signing in, with multi-factor authentication, instead of sending them by email.
• Watch the timing. Requests that arrive just before a payroll run deserve extra care.
• Notify on changes. Many payroll systems can email the employee when bank details change. Turn it on.
• Report attempts. If one employee was targeted, others may be too.