Your employees trust that their salary will arrive on time, to the right account, every month. That trust - and the automated systems built around it - is exactly what fraudsters exploit.

Payroll platforms process some of the most sensitive data in any organization: employee bank details, salaries, national insurance or social security numbers, tax information, and personal identifiers. When that system is compromised - through account takeover, insider manipulation, or social engineering - the fraud can run for months before detection.

How fraudsters target payroll systems:

🔀 Direct deposit redirect attacks - An attacker gains access to an employee's HR portal or payroll self-service system - through credential stuffing, phishing, or MFA bypass - and changes the bank account for direct deposit to one they control. The employee believes their salary arrived; it went to a mule account instead. These attacks can persist for multiple pay cycles before the employee notices something is wrong.

👻 Ghost employee fraud - A payroll administrator (or an attacker with payroll access) creates fictitious employees in the HR system, assigns them bank accounts, and collects regular salary payments. Without regular payroll audits that cross-reference active employees against access lists and physical presence records, ghost employees can collect salaries for years.

💼 Insider manipulation of pay rates and hours - Employees with payroll processing access inflate their own hours, add unauthorized bonuses, or grant pay raises to themselves or confederates. In 2023, the ACFE estimated that payroll fraud accounts for 9% of all workplace fraud cases and takes an average of 24 months to detect.

🎣 Phishing targeting HR and payroll staff - Spear-phishing emails impersonating the CEO or CFO instruct payroll teams to urgently process a bank account change for a specific employee - typically timed for just before payday. The "request" comes from a spoofed executive email address, creating pressure to act quickly without verification.

🏢 Third-party payroll provider compromise - Outsourced payroll platforms and HR technology providers are themselves targeted. A breach of a payroll vendor - such as the 2021 ADP or 2022 Kronos breaches - can simultaneously expose employee data and payment details for thousands of client organizations, providing both identity theft material and bank account diversion opportunities.

📱 SIM-swap enabling payroll account takeover - MFA on HR portals is commonly delivered via SMS. SIM-swap attacks that redirect an employee's phone number to an attacker's SIM can bypass SMS-based MFA and enable payroll redirect fraud even on accounts with two-factor authentication enabled.

What can we do:

For organizations:

- Implement out-of-band verification for any bank account change request. A phone call to the employee at their verified number (not the number in the change request) is the minimum standard.

- Conduct quarterly payroll audits: compare active employees against HR records, verify physical existence, and reconcile against access logs.

- Segregate payroll processing duties - the person who can create or modify employee records should not be the same person who approves and processes payroll runs.

- Restrict payroll self-service portal access by IP range where operationally feasible, and alert on access from new devices or locations.

- Use app-based MFA (not SMS) for payroll platform authentication, and implement step-up authentication for sensitive changes like bank account updates.

For employees:

- Verify your payslip against your bank statement every pay period. A missing salary payment is detectable - catching it immediately reduces total losses.

- Never respond to HR or payroll emails that request sensitive information or claim to need bank account details urgently without calling back to verify.

Payroll is where every employee's trust lives. Fraudsters know which door that opens.