How to Respond to Payroll Diversion

Confirm what actually happened

Before anything else, confirm directly with the employee, by phone, whether they genuinely requested the bank account change. This single call tells you immediately whether you are dealing with fraud or simply an unusual but real request.

If you are not sure how this pattern usually starts, read how payroll diversion scams reach HR. If the employee did not make the request, treat this as an active fraud case and move to the next steps immediately.

Stop what is still moving

If the payroll run has not yet completed, pause the payment linked to the changed account before anything else. If it has already gone out, contact your bank’s fraud line straight away and ask about a recall, since how a bank recall works explains what is realistic in the first hours.

Speed matters here just as much as it does for any other business email compromise case, since the receiving account can be emptied quickly.

Support the affected employee

Tell the employee clearly that their salary did not reach them and explain what is being done, rather than leaving them to find out through a bounced payment or a bank query. Many businesses arrange an interim payment or move up the correction so the employee is not left without pay.

This is a practical, reasonable step that protects your relationship with the employee while the case is investigated.

Keep the employee updated as the recall and investigation progress, even when there is no major development to share. A short, honest update that the matter is still being worked on does more for trust than silence.

Report and preserve the trail

Make a police report and lodge it with the Commercial Crime Investigation Department, keeping the original request, the internal approval, and the payment confirmation together in order. This applies whether the request came by email, a message, or a call impersonating the employee.

This pattern falls under the wider category of business email compromise, and reporting it helps connect your case to similar attempts elsewhere.

Close the gap for next time

Require any future change to an employee’s bank details for payroll to be confirmed with that employee directly, never by reply email alone. Keep a record of who verified each change and when, so any future dispute has a clear trail.

This single control is one of the most effective changes a business can make after a fraud, and it sits within the wider BEC incident response your business should be working through.

Review this process from time to time rather than only once after an incident, since staff turnover and new payroll systems can quietly reopen the same gap. A short annual check is usually enough to keep the control working as intended.