Direct deposit fraud is a payroll scam in which criminals divert an employee’s wages to a bank account they control. The impact can be significant: an employee may miss a paycheck, lose access to needed funds, and discover that the stolen money is difficult—or sometimes impossible—to recover. Employers may also face reimbursement questions, bank investigations, employee trust concerns, and additional administrative work. These scams often begin when criminals use phishing tactics to steal payroll login credentials or impersonate an employee to request a direct deposit change. Because these scams can move quickly and create lasting financial harm, organizations should use clear procedures, verification steps, and employee awareness to reduce the risk.

Here are seven practical tips to help protect your firm:

1. Require verbal or in-person verification for any direct deposit change
   Never process a bank-account change based only on email. Call the employee using a known phone number already on file—not a number provided in the request.
2. Turn on multifactor authentication for payroll systems
   Passwords alone are not enough. Use MFA for payroll portals, HR systems, and email.
3. Train employees to spot phishing
   Warn staff not to click payroll, benefits, W-2, or “verify your account” links from unexpected emails.
4. Add alerts and review payroll changes before each pay run
   Payroll or HR should receive alerts for direct deposit changes and review them before payroll is finalized. Any request to change direct deposit information must be verified through a trusted out-of-band method, such as a phone call to the employee’s number already on file or in-person confirmation. Email alone should never be sufficient authorization
5. Watch for red flags
   Be suspicious of urgent requests, secrecy, grammar or tone changes, requests from personal email addresses, look-alike domains, or requests made right before payroll cutoff.
6. Use separate passwords for payroll and email
   If someone reuses passwords, one compromised account can lead to payroll access.
7. If fraud is suspected, act immediately
   Contact the payroll provider, your bank, and the receiving financial institution if known. Report the incident to the FBI IC3 at ic3.gov and to the FTC at ReportFraud.ftc.gov. The FTC also warns never to move money or share verification codes with someone claiming to “protect” your account.