Payroll Diversion Scam
In this scam, fraudsters pose as an employee emailing HR or payroll to change their bank details, diverting the next salary payment to an account they control before the real worker notices.
By the Scam or Safe Editorial TeamResearched & reviewed for accuracyQuick verdict
Understanding this scam
In this scam, fraudsters pose as an employee emailing HR or payroll to change their bank details, diverting the next salary payment to an account they control before the real worker notices.
Small-business and workplace scams target companies with fake invoices, supplier and CEO impersonation, payroll diversion, bogus directory or registration fees, and purchase-order fraud. Business email compromise is among the costliest of all frauds.
If you take one thing from this guide, make it this: An emailed request to change an employee's payroll bank details. Verify the change in person or by a known number, never by reply alone.
If your message looks slightly different, check the Invoice Redirection Scam or the CEO Fraud Scam, both are close cousins of this pattern. Every related guide lives in the Small Business & Workplace Scams guides, and the scam checker can scan the text you received.
A typical example
This is a fictional, anonymised example used to illustrate the pattern. It is not a verified real message, and any names are used only to show how the scam typically reads.
The tell here: An emailed request to change an employee's payroll bank details.
What the data shows
Warning signs
- An email asking to change payroll bank details
- A request that skips your normal change process
- Slight differences in the sender's email address
- Pressure to update before the next pay run
- Reluctance to verify by phone or in person
Your safest response
- Verify any bank change in person or via a known number
- Use a strict, documented process for payroll changes
- Confirm with the employee through a trusted channel
- Train staff to spot impersonation emails
If you have already engaged
- Contact your bank immediately to try to recall the payment
- Alert the real employee and reset the correct details
- Report it as business email compromise
- Review email security and change processes
What to avoid
- Do not change payroll details from an email alone
- Do not skip verification under time pressure
- Do not reply to the email to confirm the change
You might also see
Invoice Redirection Scam
In this scam, fraudsters posing as a supplier or contractor email that their bank details have changed, so your next invoice payment is diverted to the scammer's account instead of the genuine business.
Created by Scam or Safe Editorial Team
CEO Fraud Scam
CEO fraud, a form of business email compromise, involves a scammer pretending to be a senior leader and pressuring an employee to move money or buy gift cards quickly and quietly. The email often mimics the executive's name and writing style, claims they are busy or travelling, and stresses secrecy. Because it exploits authority and urgency, even careful staff can be caught out. Slowing down and verifying any unusual payment request through a known channel is the most reliable defence.
Created by Scam or Safe Editorial Team
Fake Purchase Order Scam
In this scam, fraudsters impersonate a university, large company, or government body, sending a convincing purchase order to obtain goods on credit, then redirect or collect the goods and never pay.
Created by Scam or Safe Editorial Team
Questions people ask
How do I prevent payroll diversion?
The email looked like a real employee. How?
We already paid the wrong account. What now?
Who do scammers target with this?
Last reviewed June 2026 · Written & reviewed by the Scam or Safe Editorial Team