Payroll-Diversion 'Update My Direct Deposit' BEC
A scammer poses as an employee and emails HR/payroll to change their direct-deposit account — rerouting that employee's paycheck to the fraudster.
Think a message like this reached you? You can check it right now.
What this scam is
Impersonating an employee (via a spoofed or hacked email), the scammer emails HR or payroll asking to update direct-deposit banking details before the next pay run. The employee's paycheck then lands in the fraudster's account. It's low-tech, effective, and often only discovered when the real employee reports a missing paycheck. Verifying direct-deposit changes with the employee directly (in person or by known phone) prevents it.
What it usually looks like
- An 'employee' emailing HR/payroll to change direct-deposit details.
- A request to update before the next pay run.
- A new bank account provided.
- A sender address that looks like the employee but is spoofed.
Common warning signs
- Direct-deposit changes requested by email only.
- Urgency tied to payday.
- New account details from a slightly-off address.
- No independent verification with the employee.
Example wording scammers use
“Hi, I switched banks — please update my direct deposit to the account below before Friday's payroll.”
“Change my paycheck deposit to this new account, thanks!”
These are illustrative examples written by ScamSplain, not real messages.
What the scammers want
- To reroute an employee's paycheck.
- To exploit HR/payroll trust.
- A quiet change before payday.
What to do
- Verify every direct-deposit change with the employee via a known phone/in person.
- Require identity verification for banking changes.
- Alert staff to this scam and set a control that holds new-account pay runs.
- Confirm sender addresses carefully.
What to do if you already responded
- Contact your bank/payroll provider immediately to attempt to stop/recover the deposit.
- Notify the affected employee and your security team.
- Report to ic3.gov and reportfraud.ftc.gov.