How to Prevent Payroll Change Impersonation Fraud and Employee Data Theft

What does payroll change impersonation look like?

Payroll change impersonation is a request that pretends to come from an employee and asks HR, payroll or the help desk to send that person's salary to a new bank account. Older versions arrived as a plain email from a lookalike address. Current versions add a voice message in the employee's voice, a short video explaining that they are locked out of the portal, or a scanned bank letter that looks official.

A related attack targets employee data instead of money. The caller asks for a W-2 or tax document, a payslip, a manager's name or the phone number on file. Each item seems harmless, but together they let the attacker pass knowledge checks at the bank, the mobile carrier or the company's own account recovery desk.

The pretexts are predictable: a new bank after a move, a lost phone while travelling, an urgent tax deadline, or a manager asking on someone's behalf. They share two features. They push the change outside the self-service portal, and they ask staff to skip a step because of time pressure.

What the FBI has documented about payroll diversion and fake employees

The FBI Internet Crime Complaint Center described payroll diversion in alert I-091818-PSA on 18 September 2018. Criminals phished employees for their payroll portal credentials, changed the direct deposit details, often to a prepaid card, and added rules to the employee's mailbox so the change alerts never arrived. The scheme needs no deepfake at all, which is why account-level controls matter more than media checks.

Synthetic media entered the hiring and employee side in 2022. Alert I-062822-PSA, issued on 28 June 2022, reported complaints about deepfakes and stolen personal information used to apply for remote jobs, including positions with access to customer data and financial systems. Interviewers noticed that lip movement did not always match the audio.

In alert I-012325-PSA on 23 January 2025, the FBI said North Korean IT workers had been observed using artificial intelligence and face-swapping technology during video job interviews, and recommended identity verification during interviewing, onboarding and throughout employment. Once a fake worker is on the payroll, payroll and HR data become an inside target.

Bind every bank change to the authenticated employee

The strongest control is architectural. Bank-detail changes happen only inside the employee portal after reauthentication with a phishing-resistant factor, such as a passkey or a hardware key. HR staff do not make changes on behalf of employees by email, phone or chat, whatever the reason given.

Every change triggers a notice to the contact details that existed before the change, both email and phone. A hold of a few business days before the first payment to a new account gives the real employee time to report it. Changes made from a new device, followed within minutes by a mailbox rule or a password reset, should be flagged for review.

If an employee truly cannot access the portal, recovery goes through the identity team with a fresh proofing step. NIST SP 800-63A-4 asks for controls against injected and manipulated media in remote proofing and notes that biometric comparison alone does not prevent forged-media attacks. Recovery should never be an email override from payroll.

• Reauthenticate with a phishing-resistant factor before payment details can be edited.
• Notify the old email and phone on every change and log who approved it.
• Hold the first payment to a new account long enough for a dispute.
• Watch for new devices, new mailbox rules and password resets clustered around a bank change.

Limit what HR and the help desk will confirm

Attackers collect employee data in small pieces. A caller who already has a name and employee number may ask staff to confirm the last digits of the phone on file or the date of the next pay run. Scripts should allow staff to take a message and call back on the registered number without confirming or denying any detail.

Log denied requests as well as granted ones. Repeated contacts about the same employee across payroll, benefits and IT support often mean one actor is mapping the recovery process. Requests for bulk exports, such as all W-2 forms or a staff contact list, should go to security for review.

Where deepfake detection fits in payroll fraud

Detection is useful when a request includes media that can be analysed: a voice note, a recorded video message, a selfie sent as proof of identity or a scanned bank letter. A synthetic finding gives HR a clear reason to stop and escalate, and the report becomes evidence for the incident file.

Neural Defend's NeuroDetect is a forensic workspace for exactly this case. An analyst uploads the authorized audio, video, image or document into a case, reviews heatmaps and attention views down to frames and audio segments, and exports a report that records observations, uncertainty, provenance and model context. The analyst makes the final call. Neural Defend holds ISO/IEC 27001, ISO/IEC 27701 and SOC 2 Type II certifications, which matters when the files contain employee personal data, and supports private cloud and on-premises deployment.

Detection does not replace the account control. A plain-text email with no media gives a detector nothing to analyse, and a clean result on a voice note does not prove the request is legitimate. The portal-only rule and the notice to the old contact stop most payroll diversion whether or not a deepfake is involved.

What to do after a fraudulent payroll change

Act on the money first. Stop pending payments if the payroll provider allows it, contact the receiving bank to request a recall, and restore the verified account. Pay the employee through a confirmed route so the fraud does not become their financial problem.

Then contain the account. Revoke sessions, reset credentials and recovery factors, remove any mailbox rules, and check whether the same actor touched tax forms, benefits or other employees. Preserve the request, any media, portal logs, the old and new values, timestamps and approver records. Report the incident to the FBI at ic3.gov and tell the affected employee what happened through a known channel, without blaming them for the misuse of their identity.