Direct deposit fraud
Direct deposit fraud, also called payroll diversion, is the redirection of an employee’s wages to an account the employee does not control.
The canonical attack impersonates an employee and requests a bank-account change shortly before pay date. The deposit lands with the attacker, and the real employee discovers the loss only when pay fails to arrive. Liability depends on the facts, the state, and the bank agreements involved, and no general rule decides it. You commonly still owe the employee wages while recovery from the receiving bank is attempted. Report a suspected diversion immediately, because recall options on an ACH payment narrow within days of settlement.
Which controls protect a bank-account change?
Several controls sit around a bank change, and layering them matters more than any single one. Watch for a brand-new account added shortly before payroll, or many accounts changed by one administrator in a short window. Urgency is itself a signal: a claim that payroll will fail unless bank details change immediately should increase scrutiny. A flagged signal triggers review, not an accusation.
| CONTROL | WHAT IT DOES |
|---|---|
| Authenticated access | Establishes that the request came through the employee’s own credentials, not an inbound email |
| Role permission | Limits which administrators may edit banking details at all |
| Step-up verification | Adds a second proof at the moment of the edit |
| Out-of-band confirmation | Reaches the employee through a channel the requester did not choose, typically a known phone number |
| Change notification | Tells the employee an edit occurred, so a real person can object before the run funds |
| Audit trail and risk review | Preserves who changed the account, when, and from what, and holds the highest-risk edits for a second look |
General information, not legal or tax advice. Apply current federal and state rules with qualified guidance.