Direct deposit fraud is the diversion of an employee's pay to a criminal's account through a fake request to change bank details. The request usually arrives by email in the employee's name, or through a stolen payroll login. Payroll pays the correct amount on the correct day, so nothing looks wrong until the employee reports a missing paycheck.
What is direct deposit fraud?
Direct deposit fraud is a payroll scheme in which someone changes the bank account an employee is paid into, without the employee's knowledge, so that their net pay goes to an account the fraudster controls. The gross pay, the deductions and the payroll total stay the same. Only the destination changes.
Because the business still pays the right amount, the fraud does not show as a cost overrun or an unusual payment. The employee is the first to notice, often a day or two after payday, when the expected deposit is not in their account. By then the money has usually been withdrawn.
The scheme has two main forms. In the external form, a criminal impersonates the employee or takes over their payroll account. In the internal form, someone with access to payroll changes an account themselves, often for an employee who has left or one who rarely checks their pay. The tests below cover both.
How do fake direct deposit change requests arrive?
Fake direct deposit change requests arrive through three routes: an email to payroll or HR that appears to come from the employee, a change made directly in a self-service payroll portal using a stolen login, or a phone call to the payroll team. Email is the most common, because it is cheap to send and easy to act on.
Email to HR or payroll
The typical message is short: "I've changed banks, please update my direct deposit before the next pay date." It may come from a personal email address the employee "now uses", or from a look-alike company address. Some include a filled-in deposit form. The new account is often at an online bank or a prepaid card program, since those can be opened quickly.
Stolen portal logins
When employees manage their own bank details online, the criminal needs only their password. The FBI's Internet Crime Complaint Center warned about this in a 2018 public service announcement on payroll diversion: criminals phished employees' payroll logins, changed the deposit account, often to a prepaid card, and set rules so the employee did not receive the change alert.
Phone calls
Less often, a caller claims to be the employee and asks for the change by phone, sometimes with enough personal detail from social media to sound convincing. Any team that accepts phone changes needs a way to confirm who is calling.
Direct deposit fraud in the payroll register and change log
Direct deposit fraud shows in payroll records as a bank account change shortly before a pay date, followed by a payment to the new account. The payroll register looks normal. The change log, or audit trail, of the payroll system is where the evidence sits: who changed the account, when, through which channel and to what kind of account.
The table below is an example change log for one pay period, with made-up details.
| Employee | Changed on | Channel | Verified by | New account type | Outcome |
|---|---|---|---|---|---|
| E. Lopez | Mar 3 | Paper form in person | HR, ID shown | Checking, regional bank | Genuine |
| T. Ahmed | Mar 6 | Portal, office hours | Alert to old email confirmed | Checking, same bank | Genuine |
| R. Novak | Mar 11 | Email from personal address | None | Prepaid card | Fraud: employee did not ask |
| S. Chen | Mar 12 | Portal, 2:40 a.m. | Alert suppressed by mail rule | Online bank | Fraud: login phished |
| J. Burke | Mar 12 | Phone call | Called back on file number | Checking, credit union | Genuine |
The two fraud entries share features with each other and not with the rest. Neither was verified through a channel the requester did not control. Both moved pay to a quickly opened account type. Both landed two or three days before the March 14 pay date, which left little time for the employee to notice an alert.
What to pull from the system
Ask payroll for the full change history of bank details for the period you are testing, including the user or login that made each change, the timestamp and the IP address if recorded. Then compare it with a list of change forms HR actually holds. A change with no form, or a form with no callback note, is the first thing to test.
How a diverted direct deposit shows on the bank statement
A diverted direct deposit shows on the company's bank statement as a normal payroll debit. The payroll provider or the bank debits one total for the batch, and the total is the same whether a paycheck went to the employee or to a criminal. The company's statement alone will not reveal the diversion.
What the statement can reveal is the after-effect. A replacement payment to the same employee, by check or transfer, outside the normal payroll run is a sign that a deposit went astray. So is a reversal or return of a payroll entry if the receiving bank rejected the deposit. If you are reviewing the statements later, list every payment to an employee outside the payroll batch and ask what each was for.
Payments outside payroll to employees also have honest and dishonest explanations of their own. A run of transfers to one staff member could be expense reimbursements, or could be an owner paying private costs from the company account, which is covered in how personal expenses run through a business account.
When payroll comes from the wrong account
Check which account funds payroll. In some businesses it should only ever be the operating or payroll account. An insurance agency, for example, holds client premiums in a separate account that must not fund wages, and the review for that is in premium trust account reconciliation for insurance agencies. A payroll debit from an account that should never pay wages is its own finding.
Insider direct deposit fraud by payroll staff
Insider direct deposit fraud happens when a person with payroll access changes an employee's bank account to one they control. Targets are often employees who have left but are still on the active list, seasonal staff, or people paid irregularly who are unlikely to notice a missing deposit. The change log will show the insider's own login.
Tests for the insider version:
- Compare deposit accounts across employees. Two employees paid into one account, or an employee paid into an account in someone else's name, need an explanation.
- Match the payroll list to HR records. Anyone paid after their leaving date is a finding, and so is anyone with no personnel file.
- Review who changed what. If one payroll user made most bank-detail changes in the year, and some of those changes went unverified, sample them.
- Look at final pay and bonuses. A one-off payment to an account that was changed the day before is a sharp lead.
Insiders who control approval thresholds sometimes defeat them in other ways too, for example by breaking a large purchase into pieces, as described in split purchases made to stay under an approval limit. If one person can both change and approve payroll data, the same weakness is probably there elsewhere.
Verification checks for direct deposit change requests
Verification checks for direct deposit change requests confirm, through a channel the requester did not supply, that the employee really wants the change. The core control is a callback or in-person check, plus a notice to the employee's old account details or known contact so a real employee can object before payday.
A set of checks that suits a small or mid-sized employer:
- No changes by email alone. Accept changes only through the payroll portal with multi-factor sign-in, or on a signed form handed over in person.
- Call back on a number already on file for any change that does not come through the portal.
- Notify the employee of every change at their work address and their previous contact, with a clear line to report a change they did not make.
- Hold a change for one pay cycle, or pay the next check by the old method, when it arrives within a few days of a pay date.
- Flag prepaid card and new online accounts for an extra confirmation. Some are genuine, but they are favored by fraudsters.
- Separate duties. The person who changes bank details should not also release the payroll file.
- Review the change log each period, with someone outside payroll matching changes to forms and callback notes.
The FBI's 2018 notice also suggested extra scrutiny of change requests and watching for logins outside normal hours, which the example log above shows is a useful filter.
For the bank side of the review, PreciseBankFlow matches statement lines to your ledger and lists every payment that does not clear, which makes off-cycle payments to employees easier to pick out.
What to do after a diverted direct deposit is found?
After a diverted direct deposit is found, call the payroll provider and the company's bank at once to try to reverse the payment, lock the employee's payroll account, and restore the correct bank details. Pay the employee by another method while the investigation runs, and keep every record of the change request.
Steps, in order:
- Contact the payroll provider and ask whether the deposit can be recalled from the receiving bank. Ask your own bank too.
- Reset the employee's payroll login, end active sessions and confirm their correct bank details in person.
- Preserve the change request, emails with headers, and the payroll audit trail.
- Check whether other employees received similar requests or changes in the same period.
- Report it. The IC3 notice asks victims to file a complaint at ic3.gov and to mention payroll diversion, and to contact their local FBI field office.
Treat the employee's pay as a separate question from the investigation. They did the work, and leaving them unpaid while the facts are worked out damages trust in the payroll team.