What Is Direct Deposit Phishing?
Direct deposit phishing scams involve fraudsters tricking employees—or HR personnel—into altering bank account details for payroll deposits. Once the attacker gains access or approval, an employee’s paycheck is rerouted to an account controlled by the criminal. These scams typically rely on email spoofing, social engineering, and a sense of urgency to bypass normal verification procedures.
How the Scam Works
The most common tactics include:
- Impersonation of an Employee (Business Email Compromise - BEC):
- The attacker sends an email to HR or payroll posing as an employee.
- They claim to have changed banks and ask for the direct deposit details to be updated.
- The email appears legitimate, often spoofed to look like it’s coming from the employee’s actual address or with a very similar domain (e.g., jane.doe@company.com vs. jane.doe@cornpany.com).
- Phishing Links to Fake Portals:
- Employees receive emails claiming to be from payroll services, instructing them to “verify” or “update” their direct deposit information.
- Clicking the link brings them to a fake login page mimicking a payroll provider like ADP, Paychex, or Workday.
- Credentials are harvested and used to access the real payroll portal, change bank details, and redirect future paychecks.
- Exploiting HR Portals:
- Attackers breach poorly secured HR or payroll systems directly, often through stolen credentials or unpatched software.
- Once inside, they manipulate bank information without needing to phish individual users.
How to Protect Your Organization
- Enforce Out-of-Band Verification:
- Always confirm changes to banking details through a second channel (e.g., a phone call or in-person request).
- Enable Multi-Factor Authentication (MFA - already in place if you are Hybridge customer):
- Apply MFA for payroll systems and employee self-service portals to prevent unauthorized access.
- Conduct Regular Security Awareness Training - available for all Hybridge clients:
- Educate employees on phishing red flags and require periodic training refreshers.
- Monitor Payroll Change Logs:
- Implement alerts or regular audits for changes to sensitive fields like bank accounts or addresses.
- Warn New Employees:
- As soon as new employees change their status on LinkedIn, they will likely get an email or SMS from your Managing Partner asking them to buy gift cards, and you will likely get an email from them asking you to set up direct deposit to xxx account. Both will be attacks.
- Use Email Authentication Protocols (- already in place if you are Hybridge customer):
- Set up DMARC, SPF, and DKIM to reduce the risk of spoofed internal emails.
Direct deposit phishing scams are a dangerous evolution of traditional business email compromise. As payroll and HR processes become more digitized, it’s essential for organizations to stay one step ahead of attackers. Vigilance, layered security, and employee education remain your best defense.
If you are a Hybridge client, we have already put security controls in your infrastructure to mitigate the risk of these types of attacks. However, training your team is one of the best defense measures you can take, as users pose the biggest risk to any organization. Contact us at info at hybridge.com and schedule your team’s cybersecurity training.
Share this blog:
