Payroll details
Ilia Zavialov on the email that quietly moves a salary to another account
A payroll change request rarely looks like an attack. It arrives as a short, polite note from an employee who has switched bank, with an account number and an apology for the late notice. The person who opens it in accounts has no reason to doubt it and every reason to process it before the cut-off. The question here is narrow. What makes that message credible to a competent team, and which single control would have stopped the payment without slowing the department down.
English version for the United Kingdom.
01
How the request reaches the payroll inbox
Most organisations take payroll changes through a shared mailbox that several people can open. The address is published on the intranet, printed on forms and quoted in onboarding packs, so it is easy to find from outside. Messages land there all day: expense queries, tax code questions, requests for a copy of a payslip. A note asking to update bank details before the next run sits comfortably inside that traffic.
The sender reaches the mailbox by one of three routes. The cheapest is a free mail account with the employee's full name set as the display name, which most clients show in place of the address. The second is a domain registered days earlier that differs from the real one by a single character. The third, and the hardest to catch, is the employee's own mailbox after a stolen password, where the message is genuine in every technical sense.
The detail in the message comes from work done before it was sent. Public staff pages, conference listings and professional networks supply names, roles and reporting lines. Automatic replies give away who is on leave and who is covering. An old invoice or a job advert reveals the format of internal addresses and the house style of internal correspondence. By the time the request appears, the sender knows enough to sound like a colleague.
02
Why a careful person approves it
People change banks. They open accounts for a mortgage, close them after a separation, move to a provider with a better app. A payroll clerk handles several genuine change requests a quarter, and every one of them looked exactly like this. The request carries no threat, asks for no secret and involves no unfamiliar counterparty. It asks for the same salary to reach a different account belonging to the same person.
The second reason is the direction of the favour. Refusing an invoice protects the employer's money, and that feels like part of the job. Holding up a salary change puts a colleague at risk of a late payment, and that feels like obstruction. The clerk who asks for proof already pictures the answer coming back, a short line about rent leaving the account on the first of the month.
The third reason is structural. In many teams there is no written route for delaying a request of this kind. The clerk holds authority to make the change and no stated authority to pause it. Any delay becomes a personal decision that has to be defended later if the employee complains. Where the procedure stays silent, the fastest path wins.
03
The calendar does most of the work
Payroll runs on fixed dates, and those dates are easy to guess from outside. Cut-off usually falls a few working days before payday, and the days before cut-off are the busiest of the month. A request landing in that window inherits urgency from the calendar without a single urgent word in the body. The sender has no need to push, because the schedule pushes for them.
Holidays widen the gap. In August and around the end of the year the usual approver is away and a colleague covers the mailbox with partial context. Temporary cover holds the access and lacks the history, so a change that would have looked odd to the regular owner passes as routine. Handover notes seldom record who normally asks for what.
Timing also controls when the loss becomes visible. A salary leaves on payday and the employee notices its absence within a day, sometimes within hours. That sounds fast until it is measured against the movement of the money, which is usually withdrawn or forwarded the same morning. The window for recall is counted in hours, and it opens only after the payment has been made.
04
What the message looks like when you slow down
Opened properly, most of these messages carry a mismatch. The display name matches a real employee while the address behind it belongs somewhere else. The reply-to header points at an address the reader never sees in the message window. The signature is copied from a genuine mail, and the direct line it lists reaches the sender.
Lookalike domains defeat a quick glance because the eye reads words as shapes. A doubled letter, a swapped pair in the middle of a long name or a changed top level domain survives a scan by a busy reader. When the message comes from a compromised mailbox there is no mismatch at all. The only clue then sits in behaviour: a reply outside working hours, a thread reopening after months, a rule quietly filing the employee's own mail away.
Language has stopped working as a filter. Spelling and grammar once separated the forged request from the real one, and generated text removed that difference at no cost to the sender. Tone can be matched to an old thread in seconds. The channel and the record still carry a signal that survives this. The prose no longer does.
05
The scale behind an ordinary looking email
The volume shows up more clearly in national figures than in one company's inbox. The FBI complaint centre logged 1,008,597 complaints for 2025 with losses close to 21 billion dollars, a rise of 26 percent on the previous year. Business email compromise, the family that contains payroll diversion, accounted for 3.046 billion dollars and stood second only to investment fraud. Those are reported losses, so the real total sits above them.
The American consumer regulator counts the same behaviour from another angle. Impersonation of companies reached 1 billion dollars of losses across 2025, with the heaviest damage where the sender claimed to work at a bank. The same data shows that four out of five impersonation reports involved no money lost at all. Attempts run far ahead of successes, which tells you the model is volume, and volume reaches every inbox eventually.
The British picture confirms the shape. Payment fraud where the customer was persuaded to authorise the transfer produced 248,070 cases and 576.4 million pounds of losses over 2025. A payroll change request belongs to the same family, with one difference. The person persuaded to pay works in finance, and the money leaving the account belongs to the employer.
06
The confirmation call is weaker than it was
Many teams answer this risk with a phone call, and the call has quietly lost most of its strength. Current voice cloning produces a convincing copy from a recording of roughly three seconds and reaches around 85 percent accuracy. In controlled listening tests people separated a real voice from a synthetic one in 37.5 percent of attempts, worse than a coin toss. Recognising a colleague by ear has stopped being evidence.
The reporting reflects the change. For 2025 the complaint centre introduced a marker for cases connected to artificial intelligence and recorded over 22 thousand complaints with about 900 million dollars of losses under it. The marker counts what somebody noticed, so it measures attention as much as activity. Nothing in it separates a synthetic voice on a confirmation call from a human one.
This changes what a call can be used for. A call to the number printed in the request confirms only that the sender answers their own phone. A call to the number held in the personnel file reaches the employee whatever the message claimed. The value of the call sits entirely in where the number came from.
07
The control that closes the gap
One control removes almost all of this exposure. Before any change to payment details is saved, the request is confirmed through a channel taken from the organisation's own record, never from the request itself. The number, the messaging handle or the desk visit comes from the personnel file that existed before the message arrived. Everything else in the procedure exists to protect that single step.
The wording of the call matters. Reading the new account number aloud and asking whether it is correct invites a yes from whoever holds the phone. Asking the employee to state the bank and the last digits of the account forces the answer to come from their side. If it fails to match what arrived by mail, the change stops and the incident goes to the security contact the same day.
The check has to sit before the record is updated. Verification made after the change is saved protects the following month and leaves the current run exposed. The person who performs it records the time, the number dialled and the outcome in the ticket. That turns an act of care into evidence somebody can review later.
08
Turning the control into a written procedure
A control that depends on somebody remembering it fails on the busiest day of the month. The written version starts by naming one route for payment detail changes, usually a form inside the HR system that requires a login. Requests arriving by mail receive a standard reply pointing at that route, sent without judgement and without exception. The reply costs seconds and takes the decision away from the clerk.
The second line splits the work between two people. One records the requested change, a second performs the verification and approves it, and neither can do both. The split stays cheap in a team of five and hard to bypass politely, because the second person has no relationship with the message and no reason to hurry. In very small teams the approving role can sit with a director who sees only the confirmation step.
The third line fixes the timing. Changes to payment details are frozen for a defined number of working days before each run, and requests arriving inside the freeze take effect in the following month. A late change is a small inconvenience for one employee and it closes the whole attack window. Cover arrangements name who holds the approving role during leave, so the freeze survives August.
09
What the procedure gives the person on the desk
A written procedure changes the social position of the clerk. Asking for verification becomes an instruction being followed, and the clerk carries none of it personally. That difference decides whether the check actually happens on a busy afternoon. Staff who feel entitled to pause a request will pause it, and staff who feel awkward will process it.
The script belongs in the procedure as well. Two sentences explaining the callback, one sentence stating that the change applies from the following run if verification fails, and the name of the person to escalate to. Nobody should be composing that language while an impatient message sits open on the screen. Consistent wording also makes deviations visible when something later goes wrong.
The procedure needs rehearsal to stay real. A test request sent by the security contact once a quarter shows whether the route, the freeze and the split roles hold under normal pressure. The number worth tracking is simple. How many payment detail changes went through the verified route last quarter, and how many arrived another way. A department unable to answer that does not yet have the control.
10
The first hours after a payment has gone
When a salary has landed in the wrong account, the order of actions decides how much comes back. The bank is contacted first, by phone, with the payment reference and a plain statement that the payee details were altered by a third party. Banks can attempt a recall, and the chance falls sharply once the receiving account has moved the money on. That call goes out before the internal investigation begins.
Evidence gets preserved next. The original message with full headers, the mailbox audit log, any forwarding or filing rules created in the period, and the ticket showing who approved the change. The same review covers the rest of the queue, because a sender who succeeded once has usually submitted several requests. Supplier bank details deserve the same look as the payroll file.
The employee still needs paying, and the sooner that is settled the less the incident poisons the relationship. The loss sits with the organisation, and the exact position depends on the employment contract and local rules, which is where legal advice earns its fee. The report goes to the national fraud body, and the procedure gains the specific change that would have blocked this message. An incident that produces no procedural change will happen again.
| Step in the request | What the sender counts on | Control that closes the step |
|---|---|---|
| Message arrives in a shared payroll mailbox | Any address writing to payroll being treated as the employee | One published route for changes, everything else redirected to it |
| Sender looks familiar | The reader trusting the display name | Header check: full address, reply-to and sending domain |
| New account details given in the body | Detail that matches the record for name and role | Callback to the number held in the personnel file, before the change is saved |
| Urgency tied to the payroll cut-off | Fear of a colleague missing their wages | A change freeze in the days before each run, with no exceptions by mail |
| Change saved by whoever received it | One pair of eyes across the whole path | Split roles: one person records, a second verifies and approves |
| Follow-up call confirms the change | A voice that sounds right | Number taken from the record, with the caller asked to state the details |
| Change completed silently | Discovery only on payday | Automatic notice to the employee's known contact and to their line manager |
Questions and answers
How does payroll diversion fraud work?
Someone sends payroll a request to update an employee's bank details, using a lookalike address, a free account carrying the right display name, or the employee's own mailbox after a password theft. The change is saved, the next salary leaves for the new account, and the employee reports the missing payment on payday. The money is usually moved on within hours of arriving.
Can an employer refuse to change bank details sent by email?
Yes, and a written procedure makes that refusal routine. Requests arriving outside the published route get a standard reply pointing at the form or the verification step. That keeps the decision away from the personal judgement of whoever opened the message.
How do you verify a request to change salary payment details?
Call the employee on the number held in the personnel file, never the number in the message or the signature. Ask them to state the bank and the last digits of the account, and save the change only once the answer matches. Record the time, the number dialled and the outcome in the ticket.
Is a phone call enough to confirm a change of bank details?
A call is enough only when the number comes from the organisation's own record. Voice cloning now builds a convincing copy from about three seconds of recorded speech, and listeners in tests told real and synthetic voices apart in 37.5 percent of attempts. Recognising the voice therefore proves very little.
Can money paid to a fraudster's account be recovered?
Sometimes, and speed decides it. Phone the bank as soon as the payment is identified and ask for a recall, because recovery becomes unlikely once the receiving account has forwarded the funds. Report the case to the national fraud body and keep the original message with full headers.
Who loses the money when a salary is paid to the wrong account?
The employee has not received their wages, so in practice the organisation carries the loss and pays again. The exact position depends on the employment contract and local rules, so legal advice belongs at that stage and the finance meeting is the wrong place to settle it.