Beware: Payroll Diversion Scam Steals Employees’ Paychecks

A payroll diversion scam targets human resources and payroll professionals, claiming employees’ bank account information has changed

It’s no doubt you work hard for your paycheck, and you want the funds you earned to show up in your bank account on pay day. Still, there are scammers who hope to prevent that, instead taking those funds for themselves.

Iowa Attorney General Tom Miller warns consumers, along with payroll and human resources professionals, to be aware of payroll diversion scammers who aim to disrupt your paycheck deposits, rerouting them to their own accounts.

“We urge companies and organizations to discuss this scam with human resources, payroll and other employees,” Miller said. “The loss of a paycheck is devastating, and knowing the signs of a payroll diversion scam could save your employees’ hard-earned money.”

Payroll diversion scams occur when a schemer contacts a victim’s place of employment impersonating the employee and requesting a change to their direct deposit information. In most cases, the fraudster informs the HR or payroll specialist that there has been a change to their banking information.

They then provide forged documentation, including the new account information. In many cases, the  account is a prepaid card account that is not easily traceable or recoverable.

This type of scheme was the basis for a complaint received by the AG’s Consumer Protection Division.

According to the complaint, the victim discovered the scheme when her employer’s administrative services manager provided her with confirmation that her direct deposit account information had been successfully changed.

“These forms were forged, and [our account manager] doesn’t see my signature all the time, and the email appeared to be from me, so she went ahead and processed the change of direct deposit to the scam account,” the complainant said.

Indeed, the email requesting the change in account information included the employee’s full name as the sender. Additionally, the direct deposit forms attached to the request included the employee’s personal information and a Green Dot prepaid account, also in her name.

“Thankfully, [our account manager] emailed me to say the change was made, which was when I realized I’d been targeted by a scam, since I never requested a change in my direct deposit account,” the complaint states.

While payroll diversion scams aren’t necessarily among the most common schemes the AG’s office hears about, they do occur. In fact, both the Internal Revenue Service and Federal Bureau of Investigation have put out alerts about the costly scams in the past.

According to a 2018 alert from the IRS, these schemes are usually discovered rather quickly, but not before an employee loses one or two paychecks to the fraudulent account.

There are a few telltale signs that a payroll direct deposit change request is a scam:

• The email contains grammatical errors and spelling mistakes
• The email address and name do not match
• The request asks for deposit to a Green Dot account

Payroll professionals who receive an email requesting to update direct deposit information should make direct, oral contact with an employee before making changes.

File A Complaint:  

If you receive a payroll diversion email, or other email scam, forward the message to the Internet Crime Complaint Center, which is monitored by the FBI. Complaints can be filed at www.ic3.gov.

You should also report the suspected fraud to the Iowa Attorney General’s office Consumer Protection Division by calling 515-281-5926 (local in Des Moines), or toll-free, 888-777-4590 (outside the local Des Moines calling area), or via the online complaint form.