Angvlar Security Awareness
Payroll and direct-deposit change fraud
Prevent attackers from redirecting salary payments through impersonated employee requests.
Why this matters
Payroll changes are high-impact and often arrive shortly before processing deadlines. Strong verification should not rely only on email.
By the end of this lesson
- Recognise the main warning signs
- Choose a safe verification method
- Know when and how to report the situation
What to notice
- Employee requests new bank details by email
- Request comes from personal or changed address
- Urgency before payroll cut-off
- Form or identity document looks altered
- Employee asks to bypass portal
- Phone number is newly supplied in same message
What to do
- Require the approved payroll-change process
- Verify through existing employee contact details
- Use dual control for bank changes
- Notify the employee through a separate channel
- Document and report suspicious attempts
Frequently asked questions
Can an email alone authorise a payroll change?
It should not. Use the approved verified process.
Why not call the number in the request?
It may belong to the attacker.
When are these attacks common?
Near payroll deadlines or holidays.