08/12/2026
This insidious four-step fraud uses urgency and trust to siphon company funds. Here’s how fraudsters deploy it, Rober Siciliano, CEO, Safr.me, national Cyber Security Speaker and Security Awareness Trainer, told AIPB members.
Step 1: Impersonates your coworker. You get a convincing email from what looks like a company employee. Often, a scammer researches the real employee on social media or public sources, so the email may include:
• the employee’s real name in the “From” field and an almost correct email address, slightly altered with a subtle misspelling or a different domain;
• the employee’s writing style and tone, if the scammer was able to research this; and
• your company’s email signature format.
Step 2: Makes an urgent request. You are urgently requested to update the employee’s direct-deposit information. For example:
• “Hi [your name], I need to update my direct-deposit information immediately.”
• “Good morning, below is my new bank account.
• Please use it for my next paycheck.”
• “Urgent! My bank has a new system, so my account has a new name. Please update as follows.”
Step 3: Provides you with the fraudulent deposit data—the scammer’s bank account name, number and routing number.
Step 4: Repeatedly confirms the deception. Additional emails reinforce the urgency or ask if you have made the changes—usually around the time you are processing your payroll—to increase the odds of your fulfilling the request without thorough verification.
The scam is often successful for obvious reasons. The email(s) seem to be from a known employee; if you are like most employees, you trust internal company communications; employees often need to update their banking information; and if you are trying to get out your payroll at the last minute, you are more likely to skip thorough verification.
Preventing the payroll diversion scam
This scam can be headed off in several ways:
1. Strict verification protocols that must be followed to change direct deposit information. Key step: Never rely solely on an email, no matter how valid it looks. Always confirm the change directly with the employee using a separate communication channel—e.g., don’t respond by email; call the employee’s known phone number.
2. Establish secure internal communication channels for sensitive information, such as changes in payroll direct deposit.
3. Require two-factor authentication (2FA) for your email account. Enable 2FA for employee emails sent to you.
Send a message to learn more