A routine email asking you to confirm your direct deposit details or review an urgent update to company benefits may look like standard office housekeeping. When that message comes from an imposter, clicking the link can hand criminals direct control over your paycheck.

Close-up of a folded pay stub, pen, and coffee mug on a sunlit kitchen table.
A fraudulent payroll login page designed to mimic an employer self-service portal.

Payroll diversion schemes rely on social engineering to trick workers into handing over internal system credentials. Once an attacker gains access to your employee profile, they can swap your routing and account numbers for their own before anyone notices an issue.

According to security alerts from the FBI Internet Crime Complaint Center (IC3), these campaigns often involve fake emails crafted to resemble human resources or payroll staff. The messages create a false sense of administrative urgency, directing workers to cloned login pages that harvest user credentials.

Understanding how payroll impersonators operate, what technical barriers keep them out, and how to verify internal communications can help you protect your earnings before your next direct deposit processes.

How payroll impersonation works

Payroll diversion schemes do not typically exploit software flaws in the payroll platforms themselves. In an analysis of attacks targeting university staff, Microsoft Threat Intelligence observed that attackers rely on social engineering to compromise accounts that lack multifactor authentication or use weaker authentication methods.

Once a criminal secures login credentials through a deceptive link, they enter the employee self-service system. From there, they update the direct deposit settings to route incoming earnings to an account they control, often tied to a prepaid debit card. Prepaid accounts make it harder for investigators to trace where the funds travel once deposited.

Attackers often take extra steps inside the portal to cover their tracks. According to the IC3, criminals may create inbox rules or alter notification preferences so the legitimate employee never receives an automated confirmation about the banking change. As a result, the diversion may go undetected until payday arrives and your expected deposit fails to clear.

The threat is not confined to dedicated payroll software. Any cloud-based software as a service platform storing human resources, benefits, or banking information can become an entry point if employee credentials are leaked.

Verify before you act

The most effective defense against payroll impersonation is an out-of-band verification habit. If an email, text message, or chat asks you to verify personal data, change your direct deposit account, or log in to view an urgent document, do not click the links provided in the notification.

Instead, verify the request through a trusted internal path:

  • Look up your HR or payroll representative in the internal company directory rather than replying to the sender.
  • Reach out by phone, via verified internal chat, or in person to confirm whether the department sent the notice.
  • Navigate to your employee self-service platform directly using a saved browser bookmark or by typing the verified URL yourself.
  • Forward suspicious messages directly to your organization's internal IT security desk for analysis.

The IC3 recommends hovering your mouse cursor over hyperlinks before clicking to reveal the true destination URL. If the web address does not match your employer's legitimate domain or the official address of your payroll provider, do not interact with the link. Deceptive messages may display convincing logos and accurate manager names, but the underlying destination web address reveals the mismatch.

Protect your login

Because these schemes depend on compromised credentials, strengthening your sign-in protocols reduces exposure across all employee portals. According to Microsoft's investigation into targeted payroll attacks, the primary weakness across compromised accounts was the absence of multifactor authentication (MFA) or the lack of phishing-resistant authentication methods.

MFA requires anyone logging in to provide a second form of verification, such as an authenticator prompt or a hardware token, in addition to a password. If a scammer acquires your password through a fake form, strong MFA can stop them from signing into the system.

Review your work accounts to confirm whether multifactor settings are active on every HR and payment system your company uses. If you are uncertain about your setup, ask your internal IT support team for guidance on turning on additional login safeguards. Never approve an unexpected authentication prompt that appears on your phone when you are not actively logging in yourself.

Warning signs to watch for

Impersonation messages often share specific red flags that signal an unauthorized attempt to access company profiles. While no single clue proves fraud on its own, spotting these signals warrants an immediate halt and internal check:

  • Urgent requests asking you to enter login credentials, Social Security numbers, or banking information in response to an email.
  • Links whose displayed text does not match the actual destination web address when you inspect the URL.
  • Unsolicited notifications indicating that your direct deposit details or mailing address have changed when you submitted no such request.
  • A sudden stop in receiving regular administrative emails or payroll alerts, which can happen if an intruder created mail-forwarding or deletion rules.
  • Unusual account login alerts showing access attempts outside your normal work hours or from unfamiliar geographic locations.

Guidance from the Federal Trade Commission on phishing scams highlights that scammers often create artificial urgency, claiming an account will be suspended or pay will be delayed if you fail to act immediately. Taking a moment to confirm the notice through official internal channels breaks that pressure tactic.

What to do if you think you were scammed

If you realize you entered credentials on a suspicious page or notice that your pay was misdirected, speed is essential. Notify your internal HR, payroll, and IT security teams immediately so administrators can freeze the compromised account, revoke active sessions, and review recent direct deposit changes.

Next, contact your financial institution to report potential exposure, especially if banking details or account numbers were entered into an unverified form. The Federal Trade Commission provides step-by-step guidance for consumers who have interacted with scammers, including steps for securing accounts and monitoring personal information.

Federal authorities also collect intelligence on these operations to disrupt criminal networks. The IC3 instructs victims to contact their local FBI field office and file a complaint online at ic3.gov, including the phrase "payroll diversion" in the body of the report. Keep documentation of the deceptive messages, headers, dates, and direct deposit update confirmations, as these records provide necessary context for corporate incident response and law enforcement reviews.