It usually begins with a short, polite email. An employee writes to HR or payroll asking to update their direct deposit to a new bank account before the next pay run. The message looks like it came from them. The new account is real, the request seems routine and a busy payroll clerk makes the change. The following week, the employee's paycheck is gone and the real employee has no idea why.
This is payroll diversion fraud, and it is a variation of business email compromise. Healthcare and senior living employers are attractive targets because they have many employees, high turnover and busy HR teams.
There are two common versions.
Spoofed email. The attacker sends a message that looks like it is from the employee, using a lookalike address or a display name that matches.
Compromised account. The attacker has actually broken into the employee's email, so the message truly comes from their address. Sometimes they also create inbox rules to hide your replies.
In both cases, the request often sounds urgent, mentions a recent bank change, and asks for confirmation by email only. Some attackers also target the payroll portal itself by logging in with stolen credentials and changing the deposit information directly.
A change request arrives close to payroll cutoff.
The employee is rarely contacted by email, or the tone does not sound right.
The new account is at an online-only bank or a prepaid card service.
The request avoids phone or in-person confirmation.
The message comes from a personal email address instead of the usual one.
A portal login occurs from an unusual location right before a bank change.
None of these proves fraud, but any of them should prompt extra care.
Write this down and apply it to every request, with no exceptions for managers or executives.
Do not act on email alone. Treat any banking change request received by email, text or phone as unverified.
Verify through a known channel. Call the employee at a phone number already on file, or speak with them in person. Do not use contact details provided in the request.
Use a standard form. Require a signed change form or a submission through your secured portal, which requires authentication.
Confirm the details. Ask questions only the real employee would answer, using information you already hold.
Hold the first payment. Consider a short delay or a small test deposit for changes close to payroll cutoff, if your system allows.
Notify the employee. Send a confirmation to the previous contact information that a change was made, so the real person can object.
Document it. Record who verified the change, how and when.
Require multifactor authentication for the payroll and HR systems, and for email.
Restrict who can change banking details and log all changes.
Alert on changes made right after unusual sign-ins.
Review mailbox rules for hidden forwarding, especially in HR and finance accounts.
Train HR and payroll staff on this scam specifically, with examples.
Act quickly.
Contact your bank to attempt to stop or recall the payment.
Reach the employee and help them secure their email and accounts.
Preserve emails and logs.
Reset credentials and check for further compromise.
Report to your payroll provider and consider reporting to law enforcement. Speak with counsel if employee personal data may have been exposed.
The best defense is a procedure that makes pausing normal. When staff know that every change is verified by phone, nobody feels awkward for asking, and a fraudster loses their advantage of urgency.
UnityCare IT can help secure the email and payroll accounts attackers target, add sign-in protections and alerts, and train your HR and payroll team to recognize these requests. A short, consistent verification routine paired with solid account security makes this scam far less likely to succeed.
An outsourced IT department with proactive maintenance and one number to call.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172