Payroll diversion fraud is the scam where an attacker poses as an employee, emails payroll or HR to change the direct deposit details on file, and quietly reroutes the next paycheck to an account they control. The request looks ordinary because it is the kind HR processes every week, and the theft stays invisible until an employee reports a missing paycheck, by which point the wages have already settled and drained. The scheme is not new, but its scale hid inside a larger number. The last time the FBI broke payroll diversion out on its own, it counted $8.3 million in losses across 1,053 complaints, with dollar losses up 815 percent and an average loss of $7,9041. Those figures now fold into business email compromise, which took $3.046 billion in 2025, with 86 percent of the money moving by wire or ACH2, and a payroll direct deposit is an ACH credit. This guide corrects two things most payroll advice gets wrong: the employee whose paycheck was stolen is almost never the one who absorbs the loss, and the self-service portal you were told prevents this does not. It also maps how the scam actually works and the verification that stops it before payday.
Anatomy of a payroll diversion
A payroll diversion runs on a single forged request timed to the pay cycle. The attacker sends an email that appears to come from a real employee, often from a lookalike address or a genuinely compromised personal account, asking payroll or HR to update the direct deposit details before the next run. The message is polite, unremarkable, and matches the kind of change HR handles routinely, so it gets actioned rather than questioned. When payday arrives, the wages route to the account the attacker supplied, settle on the ACH rail, and drain through intermediary accounts before anyone notices.
What makes the request convincing is that the attacker rarely needs to guess much. Names, roles, and reporting lines are on the company website and on LinkedIn, pay dates are predictable, and the tone of a routine HR email is easy to imitate. In the FBI’s original breakout, education, healthcare, and commercial transportation employers were the most affected1, all sectors with large, distributed workforces where a single banking-change email does not stand out. The mechanic is identical to the vendor version of this scam: a payment instruction changes, the change arrives by message, and nobody confirms it through an independent channel before the money moves.
- The setup: an impostor emails HR or payroll posing as an employee, using a lookalike address or a compromised personal inbox.
- The ask: update the direct deposit account before the next pay run, framed as a routine personal change.
- The approval: payroll actions the change from the email, because it looks like the kind of request it processes all the time.
- The payday: wages settle in the fraudster’s account and drain before the employee reports the missing paycheck.
Why the employer absorbs the loss, not the employee
The most common belief about this scam is also the most wrong: that the employee whose paycheck was diverted is out the money. In almost every case the opposite is true. Wage-and-hour law generally does not treat wages sent to a fraudster on a forged instruction as wages paid to the employee, so the employer remains obligated to make the worker whole and ends up paying the same paycheck twice, once to the impostor and once, correctly, to the employee. The stolen first payment becomes a straight fraud loss to the company. This is the same reason forums fill with worried employees and the consistent, correct answer from experienced payroll staff is that the company re-pays; the loss sits with the employer that authorized the change.
That reframes where the control has to live. The person with the most at stake is the employer, not the employee, and the moment of exposure is the approval of the banking change, not payday. Treating a direct-deposit update as an administrative task handled by whoever opens the email is what converts a routine request into a five-figure loss. The payment fraud league table shows the same pattern across every sector: the loss lands on whoever authorized the payment, which is exactly why the authorization step is where verification belongs.
Verification that beats a phished portal
The second piece of common advice, that a self-service portal where employees change their own details removes the risk, does not hold. If an attacker can phish or credential-stuff an employee login, the portal becomes the tool they use to make the change, and the update now carries the authority of a real account. The portal moves where the change is entered; it does not verify that the person entering it is the employee, and it does not confirm the new account belongs to that employee. A control that can be operated with stolen credentials is not a control against credential theft.
The verification that actually works is out-of-band confirmation of the change itself. Any new or changed direct deposit account is confirmed with the employee through a contact the company already had on file, a known phone number, never a number or reply address supplied in the request, and the first payment to the new account is held until that confirmation is complete. This is increasingly the baseline regulators expect. Nacha’s fraud-monitoring rules, whose second phase took effect on June 19, 2026 for all non-consumer ACH originators4, expect employers that originate payroll ACH credits to screen for payments induced under false pretenses. A paycheck rerouted on a forged banking change is exactly that.
- Confirm the change out of band: reach the employee on a number already on file, not one supplied in the request.
- Verify the account belongs to the employee, not just that a change was requested.
- Hold the first payment to new direct-deposit details until that confirmation is complete.
- Record a named approver for the change, so a diverted paycheck can be traced and defended later.
Where payroll diversion sits inside the BEC numbers
Payroll diversion looks small until you see where its numbers went. The FBI stopped publishing it as a separate category because it is a variant of business email compromise, and its losses now sit inside the BEC total rather than in a line of their own. That total is not small: $3.046 billion in 20252, with the majority of the money moving by wire or ACH. Reading the older standalone figure as the current ceiling badly understates the exposure, because the scheme grew into a bigger bucket rather than shrinking.
The broader payments-fraud picture confirms how routine this attack has become. The Association for Financial Professionals found that 76 percent of organizations experienced attempted or actual payments fraud in 2025, with 74 percent citing business email compromise3 as a method. Payroll diversion is BEC pointed at the one file every organization runs on a fixed schedule. You might also be wondering whether small employers are too small to target; they are not, because payroll runs everywhere and the attacker only needs one approved change to profit.
The verification gate in front of the payroll file
Every control above works, and every one fails the same way: on a busy payroll close, when a banking-change email looks like ten others and confirming it feels optional. The durable version is structural. Before a direct-deposit change takes effect, the employee is confirmed through a channel the requester did not provide, the first payment to new details is held until that confirmation lands, and a named approver is on record.
This is where RankShield Financial fits for payroll and disbursement payments. It is a verification and attestation layer in the authorization path, not a payroll processor or a bank, and it never takes custody of funds; your existing payroll system and rails still move the money. It holds a changed or unverified payee before a payment is released, requires proof that an authorized person approved the change, and seals a signed, tamper-evident record of that decision that an auditor or an examiner can independently verify rather than take on faith. That shared signal compounds as members join, rather than claiming a scale we have not yet reached. The honest boundary: verification does not replace employee security training or the pre-settlement verification disciplines your finance team already needs; it makes the unsafe change impossible to action casually and produces evidence of who approved what. If your organization runs payroll and wants that gate, you can see how it works or request access.
The change that keeps a paycheck from being paid twice
If a payroll office takes one action after reading this, make every direct-deposit change a verified event confirmed on a number already on file, and hold the first payment to new details until the verification is done. That single procedure defeats the whole scheme, because payroll diversion depends entirely on a banking change that nobody confirmed through a channel the requester did not control. The employee is not the one exposed, the portal is not the safeguard it was sold as, and the losses are folded into a BEC total measured in billions. The only question a controller needs answered is whether a direct-deposit change can take effect at this company without anyone confirming it with the actual employee. If the answer is provably no, the paycheck goes to the person who earned it, and it only gets paid once.
