Payroll & Direct Deposit Scams

Imagine payday comes and your check never arrives because someone changed your direct deposit to their account. Payroll diversion scams hit construction companies, contractors and workers of every size. They usually start with a fake email or a stolen password.

• Workers
• Employers
• Office & payroll staff

How it works

• Impersonating the worker: a scammer emails payroll pretending to be you: “I changed banks, please update my direct deposit to this account.”
• Stealing your login: a phishing email or text sends you to a fake payroll or HR portal. Once they have your password, they change the bank account themselves.
• Impersonating HR: a message says you must “verify” your account to get paid or receive a bonus.
• W-2 and tax form scams: a fake “CEO” asks payroll staff for all employees’ W-2s, which are then used for identity theft and tax fraud.

For workers

• Log in to your payroll or HR portal only by typing the address yourself or using the official app, not through links in emails or texts.
• Use a unique password and turn on two-factor authentication for the payroll portal. See Two-Factor Authentication.
• Turn on alerts for changes to your direct deposit if your payroll system offers them.
• Check every pay stub. If your pay doesn’t arrive, tell payroll immediately.
• If you get a message asking you to “verify” payroll information, call HR to check.

For employers and payroll staff

• Never change bank details based on an email or text alone
• Verify every change by calling the worker at a number already on file, or in person
• Require changes through the secure payroll portal with two-factor authentication
• Send a notice to the worker’s known email or phone whenever bank details change
• Treat requests for W-2s or employee lists as suspicious, and verify by phone
• Train office staff on these scams

See Cybersecurity for Small Contractors and Spotting Phishing Emails.

If it happens

1. Tell your employer’s payroll and HR right away.
2. The employer should contact its bank and the receiving bank immediately to try to recover the money.
3. Change your payroll and email passwords and check for forwarding rules in your email.
4. Report it to the FBI at ic3.gov.

Your employer still owes you your wages for the work you did. If you have trouble getting paid, see Wage Theft.

Last updated: October 1, 2026