What is Payroll Diversion Fraud?

Payroll diversion fraud is a type of business email compromise (BEC) in which attackers impersonate an employee and contact an organization's payroll or HR department to request a change to the employee's direct deposit bank account information, redirecting the employee's paycheck to an attacker-controlled account. The attack relies entirely on social engineering—no malware, no malicious links, and no technical exploits—making it exceptionally difficult for traditional email security tools to detect. The FBI classifies it as a subset of BEC/email account compromise (EAC).

How does payroll diversion fraud work?

The attack unfolds in six stages. First, attackers conduct reconnaissance, identifying the target organization's payroll or HR contact through LinkedIn, company websites, or prior breach data, and selecting a specific employee to impersonate. Second, the attacker creates an email from a free consumer email service (Gmail, Yahoo, iCloud) using the employee's name, or spoofs the employee's corporate email account. Third, they send a brief, conversational message to the payroll contact requesting a direct deposit change—typically something like "I need to update my direct deposit before the next pay cycle"—with no malicious links or attachments. Fourth, the attacker adds urgency and pretext, often timing requests to align with payroll cycles (the second and last weeks of the month are most popular), and may preemptively address verification controls by claiming they "cannot come to the office" or that "a paper check is not possible." If the payroll contact processes the change, the employee's next paycheck (and potentially subsequent ones) is deposited into the attacker's account. Finally, funds are immediately withdrawn from the attacker-controlled account, transferred to prepaid cards, or converted, making recovery nearly impossible.

Timing patterns reveal attacker sophistication: Monday and Tuesday are the most popular attack days, and the second and last weeks of the month are most popular, aligning with common bi-weekly and monthly pay cycles.

How does payroll diversion fraud differ from other attacks?

Why does payroll diversion fraud matter?

Payroll diversion fraud represents one of the largest financial threats to organizations. The FBI reported that dollar losses from payroll diversion fraud increased 815% between January 1, 2018 and June 30, 2019. According to the FBI IC3 "2024 Internet Crime Report," BEC attacks (the broader category that includes payroll diversion) caused $2.77 billion in losses across 21,442 complaints in 2024, and over $55 billion over the past decade. Trustwave SpiderLabs found that almost half of all observed BEC attacks use the payroll diversion tactic, with payroll diversion scams showing a month-over-month average growth of 14% from January 2022 to January 2023, and 180.53% total growth over the course of 2022. Proofpoint blocked over 35,000 payroll diversion scams in the first half of 2020 alone, protecting $2.2 million per day.

Education, healthcare, and commercial airway transportation are the most frequently targeted sectors, particularly education where large numbers of employees and sometimes decentralized HR processes create vulnerability. When payroll fraud is involved in a successful phishing attack, the average cost is $14.8 million per incident. The median loss from payroll fraud incidents is $50,000, according to the ACFE's "Occupational Fraud 2024: A Report to the Nations."

What are the limitations of payroll diversion fraud attacks?

Payroll diversion fraud, while prevalent, has several structural weaknesses. First, the attack relies on a single payroll contact—if that person follows proper verification procedures, the attack fails entirely. Second, per-incident returns are typically low; unlike invoice fraud or wire transfer BEC that can net hundreds of thousands or millions, payroll diversion captures a single paycheck ($2,000–$10,000), requiring either many targets or sustained undetected redirection over multiple pay cycles. Third, the legitimate employee discovers missing pay on payday, limiting the window of undetected theft to one pay cycle unless the attacker times it to maximize discovery delay. Fourth, consumer email origins (Gmail, Yahoo, iCloud) are a red flag that trained HR staff can recognize as suspicious, especially when contrasted with legitimate corporate email addresses. Fifth, simple process controls defeat the attack entirely—out-of-band verification (calling the employee at a known number) and self-service portals with MFA effectively block the attack without any advanced technology. Sixth, there is no technical exploit that grants the attacker ongoing system access; each attempt is a standalone social engineering event, meaning the attacker cannot persist or escalate access once initial compromise fails. Finally, a paper trail exists in all payroll diversion attacks: payroll changes are logged in HR systems, bank account changes are timestamped, and funds flow to identifiable accounts, all providing investigative leads for law enforcement.

How can organizations defend against payroll diversion fraud?

The single most effective defense is out-of-band verification. Organizations should require all direct deposit changes to be verified through a secondary communication channel—a phone call to the employee at a verified number, or in-person confirmation—and never process payroll changes based solely on an email request. This control eliminates the primary attack vector. Employee self-service portals with multi-factor authentication (MFA) are equally powerful, as they eliminate the email-based request vector entirely. According to security research from PrimePay and ConnectPay, MFA can block over 99.9% of automated cyberattacks.

Organizations should also implement a mandatory waiting period (e.g., 1–2 pay cycles) between a direct deposit change request and its implementation, with notification sent to the employee's known email. This gives employees time to discover and prevent unauthorized changes. Email authentication and anti-BEC tools, such as DMARC/SPF/DKIM, block domain spoofing, while behavioral AI tools (Proofpoint, Abnormal AI, IRONSCALES) can detect anomalous payroll change requests. Note that consumer-email-origin attacks bypass domain authentication, so behavioral detection is essential.

Payroll change alerts are critical: configure payroll systems to send automatic confirmation alerts to employees (via known corporate email and phone) whenever direct deposit information is changed. This creates immediate visibility of unauthorized modifications. Security awareness training tailored to payroll staff—specifically addressing payroll diversion tactics, the pattern of consumer email addresses, urgency cues, and claims that "I can't come to the office"—is essential. Organizations should include payroll-specific phishing simulations in training programs.

Segregation of duties ensures that payroll changes require approval from more than one person, especially for bank account modifications. For high-security environments, consider biometric identity verification (fingerprint, facial recognition) for payroll changes.