Payroll diversion fraud doesn’t look like a break-in. It looks like a routine email from an employee asking to update their direct deposit information before the next pay run. By the time anyone realizes the request wasn’t real, the money’s already gone — sent by ACH, cleared, and unrecoverable. For payroll processors handling thousands of direct deposit changes a year, this is one of the highest-frequency fraud types you’ll face, and it’s almost entirely preventable with the right verification habits.
What Payroll Diversion Fraud Actually Is
Payroll diversion fraud happens when someone impersonates an employee — usually through a compromised or spoofed email account — and requests a change to that employee’s direct deposit banking information. The new account belongs to the fraudster, not the employee. Once the change is processed and the next payroll runs, the employee’s pay lands in the criminal’s account instead of their own.
It’s a form of business email compromise (BEC), but aimed specifically at payroll instead of wire transfers or invoices. That makes it attractive to fraudsters for a simple reason: payroll changes are routine, frequent, and rarely questioned. Nobody thinks twice about an employee wanting to switch banks.
How a Typical Attack Unfolds
1. The Email Account Gets Compromised
An employee’s email is phished, or a fraudster registers a lookalike domain one character off from the real one — think a swapped letter or an extra dash. Either way, the request lands in HR or payroll’s inbox looking completely legitimate.
2. The Request Looks Routine
“Hi, I switched banks — can you update my direct deposit info before Friday’s payroll?” It’s short, plausible, and mirrors exactly the kind of request payroll teams field constantly. There’s often a manufactured sense of urgency, timed just before a payroll deadline so there’s less time to double-check.
3. The Change Gets Processed
If the request goes through without independent verification — a callback, a check against contact info already on file — the new account information gets entered, and the fraud is already complete before anyone notices anything wrong.
4. The Payroll Runs
Pay goes out as scheduled. Because it settles as ACH, it’s typically not something that can simply be reversed once it’s landed in the fraudulent account.
A Related Pattern: Fraudulent New-Client Onboarding
There’s a second flavor of this fraud that targets processors directly rather than individual employees, and it’s one NatPay has issued direct alerts about to our Professional Payroll Processor clients: criminals posing as a brand-new payroll client, using a fully compromised bank account that can pass basic verification checks like penny-verification.
The goal is to get a first payroll run approved and funded before the processor has had time to properly underwrite the account. Warning signs tend to cluster together:
- A new client rushing to run payroll immediately
- Unusually even pay amounts
- Employee names that look similar to one another
- Bank account numbers longer than 10 digits, which usually indicates a payroll paycard rather than a standard account. Money sent to a paycard generally can’t be retrieved.
Red Flags Worth Training Your Team On
- A direct deposit change request that arrives with unusual urgency, especially close to a payroll deadline
- A sender email address that’s almost right — one character different from the employee’s actual domain
- A request that comes in only by email, with no willingness or ability to confirm by phone
- A brand-new client pushing to run their first payroll before standard underwriting is complete
- Pay amounts across a new client’s roster that are suspiciously even, or employee names that look interchangeable
How to Stop It Before It Happens
Verify Every Direct Deposit Change With a Callback
This is the single most effective control against payroll diversion fraud, and it’s also the simplest: never process a banking change based on email alone. Call the employee back at a phone number already on file — not one provided in the request itself — and confirm verbally before making any change.
Watch for Lookalike Domains
Train payroll and HR staff to check the sender’s full email address, not just the display name. A domain that’s one letter off is the single most common tell in this type of fraud.
Underwrite New Clients Before Their First Payroll
Meet new clients before accepting their first direct deposit file. Several processors go a step further and require checks instead of ACH for a first payroll run entirely, giving time for proper account verification before real money moves.
Limit Who Can Approve Banking Changes
Restrict the ability to update direct deposit information to a small, specific set of people, and require a second person to confirm any change before it’s submitted. A single point of approval is a single point of failure.
Review Files Before Submission
A quick scan of a payroll file before it’s submitted — looking for round-number pay amounts, similar-looking names, or unusually long account numbers — can catch a fraudulent new account before funds ever move.
What to Do If It Happens Anyway
Contact NatPay and your bank immediately — the faster an ACH return can be initiated, the better the odds of recovering funds before they’re withdrawn from the fraudulent account. Document everything, including the original email and any communication with the employee, and notify the employee affected right away so their actual pay can be reissued.
Frequently Asked Questions
Is payroll diversion fraud the same as ACH fraud?
It’s a specific type of it. ACH fraud covers a broad range of schemes; payroll diversion fraud specifically targets direct deposit banking changes through email impersonation. For broader ACH fraud prevention, see our guide on ACH Fraud: Awareness, Prevention, and Solutions.
Can a payroll direct deposit be reversed once it’s sent?
Not reliably. Once an ACH payment settles into the fraudulent account, recovery depends on how quickly the return process is initiated and whether funds are still available in that account.
What’s the fastest way to catch this before it costs money?
A mandatory callback on every direct deposit change request, using a phone number already on file rather than one provided in the request. It’s a small amount of friction that closes the door on almost every version of this fraud.
Does this only affect large payroll processors?
No. Any business or processor running direct deposit payroll is a target, regardless of size — fraudsters often prefer smaller operations precisely because verification steps are more likely to be skipped under time pressure.
Protect Your Payroll From Diversion Fraud
NatPay works with Professional Payroll Processors to catch fraudulent activity before it becomes a loss — from new-client underwriting to ongoing account monitoring. Contact NatPay to talk through your current verification process, or explore our ACH and Direct Deposit solutions.
