An email asking you to change an employee’s bank details is a request to redirect their pay. Check it before changing anything. A familiar name or an existing email thread does not establish that the employee authorized the change.
This matters even when a payroll provider handles the payment. The provider may correctly process the details your team supplied. That does not make those details legitimate.
Confirm the request through a trusted route
Use a contact method you already know belongs to the employee. Do not rely on a phone number supplied in the change request. If you cannot verify the request, escalate it through your payroll process rather than rushing an unverified change.
- Example control: A payroll staff member verifies a bank-detail change through an established contact route before submitting it.
- Evidence: Record who performed the check, when it happened and the outcome. Link that note to the protected payroll change record.
Keep full bank details inside the approved payroll system or other protected record. A general task tracker does not need another copy.
The FBI’s guidance on email payment scams recommends independently verifying changes to payment instructions. Urgency is a reason to be careful, not a reason to skip the check.
Review the change, not just the payroll total
A redirected payment can leave the total payroll amount unchanged. Looking only at the total will not tell you whether the destination is right.
- Example control: Before releasing payroll, an authorized reviewer checks bank-detail changes against the verified requests.
- Evidence: Retain the change report and the reviewer’s result in the restricted payroll records. Note unresolved items and who is handling them.
For a small team, the reviewer might be the owner or finance lead. They need enough information to challenge a change. A second click without a real check adds little.
If the same person must perform several steps, decide how another authorized person will review the sensitive changes before funds are released. Match the arrangement to the payroll system and the business’s risks.
What if employees update their own details?
Self-service removes some manual work. It does not remove the risk of an attacker taking over an employee’s account. IC3 has documented payroll diversion through stolen employee credentials.
- Protect payroll accounts with the available strong authentication controls.
- Find out how the system reports bank-detail changes.
- Decide who reviews suspicious changes and how employees can report them.
- Check whether a change to contact information also affects where alerts are sent.
Do not assume an automated notification reached the right person. Understand the notification settings and the account changes that could alter them.
If the pay has already gone to the wrong place
Contact the payroll provider and financial institution immediately through trusted channels. Ask what can be stopped or recovered. Preserve the original request and the relevant system records. Follow your incident process and notify the appropriate people inside the business.
In the United States, the FBI also directs victims to report the incident to IC3. Recovery is not guaranteed, so do not wait for the next routine payroll review.
Keep the process short enough to use
The core record can be simple: the change requested, who verified it, who approved it and what happened. Sensitive account information belongs in the protected payroll record rather than in a widely shared spreadsheet.
These are practical examples, not a universal legal checklist. Apply your actual payroll obligations and provider procedures. If you also review the provider’s SOC report, remember that your own responsibilities still matter.
One Response