BUSINESS

Payroll diversion

Payroll diversion is a scam where a criminal pretends to be an employee and asks to change where that person's paycheck is deposited. If payroll makes the change, the employee's next paycheck goes into the criminal's account. Small businesses, schools, churches, and local governments are common targets because they often process changes by email.

How this scam works

The scammer usually emails human resources or payroll using a look-alike address or the employee's real email account after hacking it. The message is short and friendly, saying the employee opened a new bank account and wants the next paycheck sent there. Some scammers instead trick employees into entering their login on a fake payroll portal page.

Once they have access or a change is approved, the criminal sends the money to a prepaid card or new account that they can empty quickly. Often no one notices until payday, when the real employee asks why their pay never arrived. By then, the money may already be gone, and the employer must sort out payroll records and next steps.

What it can look like

EXAMPLE · NOT A REAL MESSAGEHi, I recently switched banks and need my direct deposit updated before the next pay period. Here are my new routing and account numbers. I'm in meetings all day, so please just confirm by email when it's done. Thanks so much!

Warning signs

A direct deposit change request arrives by email instead of the normal process.
Sender asks for the change to take effect before the next payday.
Message says the employee is unavailable by phone or in meetings.
Email address is slightly off or replies go to a different address.
New account appears to be a prepaid card or online-only bank.
Employee reports a login page that looked unusual or asked for codes.

How to protect yourself

Never accept direct deposit changes by email alone; require a secure portal or in-person form.
Confirm changes with the employee using a phone number or in person already on file.
Send a notice to the employee's old contact details whenever deposit information changes.
Use multi-factor authentication on email and payroll systems.
Teach employees to type the payroll portal address themselves, not use emailed links.
Hold a short waiting period before new bank details take effect.

If you already responded

Contact your bank and payroll provider right away and ask whether the deposit can be stopped or recalled.
Switch the employee's deposit back to the verified account and lock further changes.
Reset passwords for any affected email or payroll accounts and review recent logins.
File a complaint with the FBI's IC3 with the dates, amounts, and emails involved.
If employee personal data was exposed, help them review IdentityTheft.gov for next steps.

Get step-by-step recovery help →

Where to report it

Common questions

What is payroll diversion fraud?

Payroll diversion fraud is when a criminal poses as an employee, often by email, and gets payroll to send that person's paycheck to a different bank account. The criminal may also steal the employee's login to the payroll site. The real worker usually finds out when their pay does not arrive.

How should employers verify a direct deposit change request?

Use a set process every time. Require the employee to make the change through a secure payroll system or in person, then confirm it by calling a phone number already in their file. Do not rely on contact details in the request. Notify the employee when their deposit information changes.

Who is responsible if a paycheck is sent to a scammer?

That depends on state law, your payroll contracts, and the facts, so it is worth asking an employment lawyer or your payroll provider. Either way, act fast. Contact your bank, fix the account, and report the incident to IC3. Quick action gives the best chance of limiting the damage.

Important: Scammers change tactics. No single warning sign proves fraud, and the absence of warning signs does not mean something is safe. This guide is general education, not legal or financial advice.