5th November 2026
Imagine a dedicated employee logs into their bank account on payday, only to find it completely empty. When they contact HR, the records show their salary was successfully processed but sent to an entirely different bank account.
This isn't a hypothetical glitch. It is Payroll Diversion Fraud, a rapidly growing cybercrime targeting both private businesses and public sector organisations worldwide. High-profile audit reports, including those from major public bodies like The Highland Council, frequently highlight how easily gaps in payroll administration and bank mandate processing can be weaponised by external scammers.
If your organisation relies on email requests or unverified self-service portal changes to update banking data, you are exposed. Here is how the fraud works, and the protocols you must implement immediately to block it.
How the Scam Unfolds
Fraudsters rarely try to hack a bank; instead, they hack the human element of your workflow. They typically use two entry points:
The Spoofed Email (Bank Mandate Fraud): A scammer creates an email address that looks identical to your employee’s or a trusted supplier's name. They send a polite, urgent message to HR: "I’ve recently changed banks. Can you please update my salary details before the upcoming pay cycle?"
Self-Service Compromise: If your company uses an employee self-service platform, fraudsters use phishing emails to steal an employee’s login credentials. Once inside, they quietly swap the BACS or routing details a few days before payday.
Because the payroll software executes the command flawlessly, the system behaves exactly as instructed—meaning the fraud isn't discovered until the actual employee realizes they haven't been paid.
The Cost of Weak Protocols
When this fraud succeeds, employers face a brutal reality. Not only is the original salary lost to an untraceable account, but the employer is often still legally obligated to pay the actual employee. Furthermore, a successful attack exposes deeper systemic weaknesses, leading to:
• Destructive hits to employee morale and workplace trust.
• Severe regulatory scrutiny regarding data protection and internal financial controls.
• Expensive, time-consuming internal audit investigations to recover or track the losses.
Bulletproof Protocols: How to Protect Your Payroll
To stop payroll diversion, you must shift your mindset from efficiency to verification. Implement these non-negotiable protocols immediately:
Enforce "Out-of-Band" Verbal Verification
Never accept a bank detail change purely over email or text. Your payroll team must have a mandatory policy to call the employee back using a pre-existing, trusted phone number from their official HR file—not the number listed in the suspicious email—to verbally confirm the change.
Implement Automated "Change Triggers"
If an employee or an admin alters banking information in your system, configure your HR platform to instantly trigger an automated text message or email alert to the employee's original contact points. It should explicitly state: "Your payroll details have been changed. If you did not authorise this, contact HR immediately."
Establish a System Lockdown Window
Introduce a "cooling-off" period. Block any changes to employee banking information within 7 to 10 days of the upcoming payroll execution date. If an employee misses the window, the change is held until the following month, giving your team ample time to review and verify the request.
Mandatory Dual-Authorisation
Treat bank details with the same security classification as high-value wire transfers. No single HR clerk should be able to input and approve a bank detail change. Require a second manager or auditor to review and sign off on any routing adjustments before they go live in the system.
The Bottom Line
Fraudsters exploit the natural desire of HR and payroll teams to be helpful and efficient. By formalising strict, multi-layered verification protocols, you remove the human vulnerability that scammers rely on. Don't wait for an empty bank account on payday to audit your workflow—lock down your payroll controls today.
Note
On 11 November 2026 The Audit Committee of Highland council will review a Payroll Bank Mandate Fraud carried out in 2025 on their payroll system.
Payroll Bank Mandate Fraud
The diversion of £3,321.41 in salary payment to a
fraudster.
• The unauthorised disclosure of an employee’s personal data to the fraudster
Full details can be found in the committee papers https://www.highland.gov.uk/meetings/meeting/5431/audit-committee