Protect payroll and employee bank details

Payroll diversion fraud sends an email ’from staff’ asking to change where their pay lands, just before payday. Treat every such request as suspect.

1. Treat any request to change an employee’s bank details as unverified until you confirm it in person or by known phone number.
2. Never action a bank-detail change from email alone, even if it looks like it’s from the staff member.
3. Be extra wary of requests timed just before a pay run — that urgency is deliberate.
4. Restrict who can edit payroll banking details and log every change.
5. Confirm the change with the employee through a channel you already trust.
6. Run staff awareness so people know to expect verification, not take offence at it.