The email looks routine. It comes from an employee's real address. It's short and polite:
"Hi — I switched banks. Can you update my direct deposit before the next payroll? New account info is below. Thanks!"
Whoever runs payroll makes the change. Two weeks later the employee asks where their paycheck went. It went to a criminal's account, and it's not coming back.
This is payroll diversion. It's one of the quietest forms of business email compromise, and it's built for small businesses where one person handles payroll and knows everybody by name.
Why It's Hard to Spot
Business email compromise cost U.S. businesses more than $3 billion in 2025, according to the FBI's Internet Crime Complaint Center. Payroll diversion works for the same reasons the bigger wire scams do:
It often comes from the real mailbox
If the employee's Microsoft 365 account is compromised, the request comes from their actual address. No typos in the domain to catch.
The replies get hidden
Attackers set inbox rules that delete or hide anything mentioning payroll or deposits — so the real employee never sees the confirmation.
It's a small, normal request
People change banks. Nobody wants to make a colleague jump through hoops over something this ordinary.
Nobody notices for weeks
The loss only shows up on the next payday — long after the money has moved on.
This is exactly the behavior from the Microsoft 365 token-replay campaign earlier this week: hijacked mailboxes, hidden inbox rules targeting payroll and deposit emails, and at least one payroll-related email sent to an outside contact.
The Process That Stops It
You can't count on spotting a perfect fake. You can make a fake request fail anyway.
No banking changes by email. Ever.
Direct deposit changes go through your payroll portal (ADP, Gusto, Paychex and so on) where the employee logs in themselves — never through an email to HR or the office manager.
Verify by voice, on a number you already have
If a change request does come in another way, call the employee on the number in your HR file. Not the one in the email signature.
Add a waiting period
New bank details don't take effect on the very next payroll. A short delay gives the real employee time to notice.
Notify the old address
Make sure the employee gets a confirmation of every banking change — ideally by text or to a personal email, not just the work inbox an attacker might control.
Turn on MFA in the payroll portal
If attackers can log in to the portal itself, the email trick isn't even needed.
What IT Should Be Watching
- New inbox rules that delete or move mail containing "payroll," "direct deposit" or "bank"
- Sign-ins to Microsoft 365 from unusual locations right before a banking change request
- Mail forwarding to outside addresses
None of this is expensive. It's a written rule, a phone call and a few alerts. The paycheck it protects belongs to someone who's counting on it.
Free Payroll Fraud Readiness Check
We'll walk through how a direct deposit change actually gets made in your business, check your Microsoft 365 for the warning signs, and show you where a fake request would get through.
DM us "ASSESS" on LinkedIn or schedule a free consultation · (646) 791-2137