Payroll Was Diverted to a Scammer's Account

How the request usually arrives

An email or an internal message, made to look like it comes from an employee, asks HR to update the bank account used for salary. It may explain the change with a reason like a new bank or a closed account.

The message often uses the employee’s real name, job title, and sometimes their actual writing style copied from earlier emails. It rarely raises suspicion on its own.

In some cases the scammer has compromised the employee’s real email account, so the request truly comes from their address.

Why it slips past HR teams

Payroll changes are usually treated as routine administrative requests, processed quickly to avoid delaying salary. HR staff handling many such requests may not have a habit of calling to confirm each one.

The request often arrives close to the payroll cut-off date, adding pressure to process it fast rather than pause and verify.

What to do once payroll has gone out

Contact your bank at once to ask about a recall, since how a bank recall works explains the process and how quickly you need to move. Tell the affected employee immediately, since their real salary has not reached them and they may need an interim arrangement.

File a police report and report to the Commercial Crime Investigation Department. Keep the original request, the internal approval, and the payment confirmation together in order.

This pattern sits within the wider category of business email compromise, and recognising it helps your HR and finance teams spot related attempts.

How to close the gap

Require any change to an employee’s bank account for payroll to be confirmed with that employee directly, by phone or in person, not by reply email. This single step removes the opening the scam depends on.

Keep a record of every payroll bank detail change and who verified it, so any dispute has a clear trail to point to.

What to do next

Report through the official channels first, since a documented report supports the bank dispute and any later step. Keep every document connected to the change, from the first message to the payment confirmation.

If the amount is significant, a first assessment of whether legal action is worth it can help your company understand realistic next steps before spending further.