A scam that reroutes an employee's direct deposit to the fraudster's account by faking a bank-detail change request.
In payroll diversion, an attacker impersonates an employee (or a new hire) and emails HR or payroll asking to “update” direct-deposit details — sending the next paycheck to an account the scammer controls. For new hires, the reverse also happens: a fake “employer” collects bank details during “onboarding.”
It's a targeted form of business email compromise aimed squarely at the paycheck, and it often surfaces right around a start date when processes are still unfamiliar.
Red flags
- Emailed request to change bank details, especially near payday
- Onboarding that collects banking info before a verified offer
- Pressure to update details urgently or confidentially
Deep-dive guide
Brand Impersonation & CEO Gift-Card Scams (BEC) in Hiring
Frequently asked questions
How do I protect my paycheck from diversion?
Only submit or change direct-deposit details through your employer's official payroll system, and confirm any change request in person or by phone through a known contact — never by replying to an email alone.