Why HR Should Be Suspicious of Last-Minute Banking Changes

Human resources and payroll departments are frequent targets of business email compromise (BEC) scams because they handle sensitive employee information and have the ability to change direct deposit information. Cybercriminals know that a single fraudulent request can result in a paycheck being diverted to a criminal’s bank account.

These scams often begin with an email that appears to come from an employee requesting an urgent change to direct deposit information. The message may explain that the employee recently changed banks, lost access to an account, or needs the update processed before the next payroll. In many cases, the email address, writing style, or signature closely resembles the employee’s, making the request appear legitimate.

Before making any changes to payroll or banking information, HR should independently verify the request using a trusted communication method. Instead of replying directly to the email, contact the employee using a known phone number, speak with them in person, or require them to submit the request through your organization’s established self-service portal or documented process.

Employers should also watch for common warning signs, including requests marked “urgent,” changes submitted immediately before payroll processing, poor grammar or unusual wording, or requests to bypass normal procedures.

Establishing and consistently following verification procedures helps protect both employees and employers from payroll fraud. A few extra minutes spent confirming a banking change can prevent significant financial loss and help safeguard employee trust.