{"id":2223,"date":"2026-10-26T06:15:09","date_gmt":"2026-10-26T11:15:09","guid":{"rendered":"https:\/\/www.supportadistance.com\/payroll-diversion-fraud\/"},"modified":"2026-10-26T06:15:09","modified_gmt":"2026-10-26T11:15:09","slug":"payroll-diversion-fraud","status":"publish","type":"post","link":"https:\/\/www.supportadistance.com\/en\/payroll-diversion-fraud\/","title":{"rendered":"Payroll fraud: when a fake employee hijacks their direct deposit"},"content":{"rendered":"\n<style>\n.alt-article{--alt-teal:#279989;--alt-teal-dk:#1F7A6D;--alt-orange:#DA291C;--alt-ink:#13262D;--alt-muted:#4A5563;--alt-bg:#F6F5F1;--alt-line:#DAD6CC;font-family:Calibri,Carlito,\"Segoe UI\",Arial,sans-serif;color:var(--alt-ink);font-size:18px;line-height:1.6;max-width:820px;margin:0 auto;padding:0 16px}\n.alt-article *{box-sizing:border-box}\n.alt-article h2{font-size:clamp(23px,3.5vw,29px);line-height:1.25;margin:44px 0 14px;color:var(--alt-ink);padding-left:14px;border-left:5px solid var(--alt-teal)}\n.alt-article h3{font-size:20px;line-height:1.3;margin:0 0 6px;color:var(--alt-ink)}\n.alt-article p{margin:0 0 14px}\n.alt-article a{color:var(--alt-teal-dk)}\n.alt-article .alt-eyebrow{text-transform:uppercase;letter-spacing:2px;font-size:14px;font-weight:700;color:var(--alt-orange);margin:0 0 8px}\n.alt-article .alt-lead{font-size:21px;color:var(--alt-muted)}\n.alt-article ul,.alt-article ol{padding-left:24px;margin:0 0 14px}\n.alt-article li{margin-bottom:6px}\n.alt-article .alt-stats{display:grid;grid-template-columns:repeat(auto-fit,minmax(200px,1fr));gap:14px;margin:24px 0}\n.alt-article .alt-stat{background:#0F1F26;color:#EEF1F4;border-radius:12px;padding:20px;border-top:5px solid var(--alt-teal)}\n.alt-article .alt-stat b{display:block;font-size:32px;line-height:1.1;color:var(--alt-teal);margin-bottom:6px}\n.alt-article .alt-stat span{font-size:16px;color:#C7D0DA}\n.alt-article .alt-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px;margin:14px 0 20px}\n@media (max-width:600px){.alt-article .alt-grid{grid-template-columns:1fr}}\n.alt-article .alt-card{border:1px solid var(--alt-line);border-top:5px solid var(--alt-orange);border-radius:12px;padding:16px 18px;background:#fff}\n.alt-article .alt-card p{margin:0;font-size:16px;color:var(--alt-muted)}\n.alt-article .alt-mail{border:1px solid var(--alt-line);border-radius:12px;overflow:hidden;margin:20px 0;background:#fff;box-shadow:0 2px 12px rgba(19,38,45,.08)}\n.alt-article .alt-mail-head{background:var(--alt-bg);padding:14px 18px;font-size:16px;border-bottom:1px solid var(--alt-line)}\n.alt-article .alt-mail-head div{margin:2px 0}\n.alt-article .alt-mail-body{padding:18px;font-size:17px}\n.alt-article .alt-flag{background:rgba(232,71,42,.14);border-bottom:2px solid var(--alt-orange);padding:0 2px}\n.alt-article .alt-n{display:inline-flex;align-items:center;justify-content:center;width:22px;height:22px;border-radius:50%;background:var(--alt-orange);color:#fff;font-size:13px;font-weight:700;margin-left:4px;vertical-align:middle}\n.alt-article .alt-notes{background:#0F1F26;color:#C7D0DA;padding:16px 18px;font-size:16px}\n.alt-article .alt-notes ol{margin:0;padding-left:22px}\n.alt-article .alt-notes b{color:#EEF1F4}\n.alt-article .alt-timeline{border-left:3px solid var(--alt-teal);margin:16px 0 20px 12px;padding-left:22px}\n.alt-article .alt-timeline div{position:relative;margin-bottom:16px}\n.alt-article .alt-timeline div:before{content:\"\";position:absolute;left:-31px;top:6px;width:14px;height:14px;border-radius:50%;background:var(--alt-teal);border:3px solid #fff;box-shadow:0 0 0 1px var(--alt-teal)}\n.alt-article .alt-timeline b{display:block}\n.alt-article .alt-callout{background:var(--alt-bg);border-left:5px solid var(--alt-orange);border-radius:8px;padding:18px 20px;margin:20px 0}\n.alt-article .alt-callout.teal{border-left-color:var(--alt-teal)}\n.alt-article .alt-callout p:last-child{margin:0}\n.alt-article .alt-urgent{background:#0F1F26;color:#EEF1F4;border-radius:14px;padding:22px 26px;margin:20px 0}\n.alt-article .alt-urgent h3{color:var(--alt-teal);margin-bottom:10px}\n.alt-article .alt-urgent ol{margin:0}\n.alt-article .alt-cta{background:#0F1F26;color:#EEF1F4;border-radius:12px;padding:28px;margin:40px 0 24px;text-align:center}\n.alt-article .alt-cta p{margin:0 0 14px;font-size:20px}\n.alt-article .alt-btn{display:inline-block;background:var(--alt-orange);color:#fff;text-decoration:none;font-weight:700;padding:12px 26px;border-radius:999px}\n.alt-article .alt-sources{font-size:15px;color:var(--alt-muted);border-top:1px solid var(--alt-line);padding-top:16px}\n.alt-article .alt-sources ul{padding-left:20px}\n<\/style>\n<article class=\"alt-article\">\n<p class=\"alt-eyebrow\">Fraud \u00b7 Appelez le tech<\/p>\n<p class=\"alt-lead\">An email from an employee reaches payroll: she switched banks and asks to update her direct deposit before the next pay run. The request is polite, routine, and handled in two minutes. Two weeks later, the real employee asks where her pay went. Payroll fraud doesn\u2019t go after one large wire transfer: it diverts one paycheque at a time, often unnoticed until payday.<\/p>\n\n<div class=\"alt-stats\">\n<div class=\"alt-stat\"><b>US$3B<\/b><span>in business email compromise losses reported to the FBI in 2025, a category that includes payroll fraud<\/span><\/div>\n<div class=\"alt-stat\"><b>\u2248 6,000<\/b><span>email accounts at 25 universities targeted in 2025 by a single group specializing in salary diversion, according to Microsoft<\/span><\/div>\n<div class=\"alt-stat\"><b>1 email<\/b><span>is often enough: no malware, no technical flaw, just a request that looks normal<\/span><\/div>\n<\/div>\n\n<h2>What is payroll fraud?<\/h2>\n<p>Also called payroll diversion, it is a form of business email compromise. The fraudster impersonates an employee, or takes over their account, to get their direct deposit details changed. The following paycheques land in an account the fraudster controls, often a hastily opened online account or a prepaid card, and are emptied within hours.<\/p>\n<p>Favourite targets: well-paid employees (executives, professionals, managers) whose name and title are easy to find on the website or LinkedIn, and businesses where a single person handles payroll.<\/p>\n\n<h2>Two ways to divert a paycheque<\/h2>\n<div class=\"alt-grid\">\n<div class=\"alt-card\"><h3>The fake employee<\/h3><p>The fraudster writes to payroll or HR from a personal address in the employee\u2019s name (often Gmail or Outlook.com), or from their real, compromised mailbox, and simply asks to change the deposit account.<\/p><\/div>\n<div class=\"alt-card\"><h3>The hijacked employee account<\/h3><p>The fraudster phishes the employee\u2019s credentials, signs in to the self-service payroll portal and changes the bank account directly. HR never sees a request.<\/p><\/div>\n<\/div>\n\n<h2>How the attack unfolds<\/h2>\n<div class=\"alt-timeline\">\n<div><b>1. Reconnaissance<\/b>Website, LinkedIn, \u201cOur team\u201d page: the fraudster picks an employee, finds out who runs payroll and guesses the email address format.<\/div>\n<div><b>2. Access or impersonation<\/b>They create a free address in the employee\u2019s name, or phish their Microsoft 365 account. Organized groups even use pages that steal MFA codes in real time.<\/div>\n<div><b>3. The request or the change<\/b>A short, polite email to payroll, or a direct change in the payroll portal, just before the processing cut-off.<\/div>\n<div><b>4. The cover-up<\/b>With a hijacked account, they create an inbox rule that automatically deletes \u201cyour bank details have changed\u201d notices. They may also add their own phone as an MFA method to keep access.<\/div>\n<div><b>5. The cash-out<\/b>The pay lands in the fraudster\u2019s account. The employee only notices on payday, sometimes after two or three pay runs.<\/div>\n<\/div>\n\n<h2>The typical email, dissected<\/h2>\n<div class=\"alt-mail\">\n<div class=\"alt-mail-head\">\n<div><b>From:<\/b> Sophie Tremblay &lt;<span class=\"alt-flag\">sophie.tremblay.pay@gmail.com<\/span>&gt;<span class=\"alt-n\">1<\/span><\/div>\n<div><b>To:<\/b> payroll@abcroofing.com<\/div>\n<div><b>Subject:<\/b> Account change for my pay<\/div>\n<\/div>\n<div class=\"alt-mail-body\">\n<p>Hello,<\/p>\n<p>I switched banks this week. Could you update my direct deposit <span class=\"alt-flag\">before Thursday\u2019s pay<\/span><span class=\"alt-n\">2<\/span>? <span class=\"alt-flag\">Here are my new banking details<\/span><span class=\"alt-n\">3<\/span>: transit, institution and account number.<\/p>\n<p><span class=\"alt-flag\">I\u2019m in training all week and can\u2019t take calls<\/span><span class=\"alt-n\">4<\/span>, <span class=\"alt-flag\">a confirmation email is all I need<\/span><span class=\"alt-n\">5<\/span>.<\/p>\n<p>Thanks so much!<br>Sophie<\/p>\n<\/div>\n<div class=\"alt-notes\"><ol>\n<li><b>Personal address<\/b>: the name is right, but the email doesn\u2019t come from the company address. With a hijacked account, the address would be the real one, so this check alone is not enough.<\/li>\n<li><b>Tight deadline<\/b>: the request arrives just before the payroll cut-off.<\/li>\n<li><b>Banking details in the email<\/b>: no signed form, no verification.<\/li>\n<li><b>Unreachable<\/b>: you are prevented from checking by voice.<\/li>\n<li><b>Workaround<\/b>: you are invited to reply to the fraudster themselves.<\/li>\n<\/ol><\/div>\n<\/div>\n<p style=\"font-size:15px;color:#4A5563\">Fictitious example.<\/p>\n\n<h2>Why it works so well<\/h2>\n<ul>\n<li><strong>The request is routine.<\/strong> People change banks every day. The email is short, polite and error-free, so it gets past spam filters.<\/li>\n<li><strong>The amount is modest.<\/strong> One paycheque raises no alarm, unlike a large wire transfer abroad.<\/li>\n<li><strong>Time is on the fraudster\u2019s side.<\/strong> With a biweekly pay cycle, the money is long gone before the employee complains.<\/li>\n<li><strong>The employer often pays twice.<\/strong> As Saskatoon police point out, the employer is responsible for making sure the employee gets paid, so the loss often falls on the business.<\/li>\n<\/ul>\n\n<h2>How to protect your business<\/h2>\n<h3>Procedures first<\/h3>\n<ul>\n<li><strong>Never change banking details by email alone.<\/strong> Every direct deposit change is confirmed by voice or in person with the employee, at a number already on file, not the one provided in the email. This check works even when the email comes from the real address.<\/li>\n<li><strong>A signed form<\/strong> plus a void cheque or a direct deposit form from the financial institution. A void cheque can be forged: it complements the call, it doesn\u2019t replace it.<\/li>\n<li><strong>An automatic notice to the employee<\/strong> through another channel (phone or personal address already on file) as soon as their banking details change.<\/li>\n<li><strong>A second approval<\/strong> before the first pay goes to the new account, and a one-pay-period delay if the request comes in at the last minute.<\/li>\n<li><strong>A simple check before every pay run<\/strong>: list of accounts changed since the last run, and a flag if two employees point to the same account.<\/li>\n<\/ul>\n<h3>Technical safeguards<\/h3>\n<ul>\n<li>Phishing-resistant MFA (security keys, Windows Hello for Business, passkeys) on Microsoft 365 <em>and<\/em> on the payroll portal. Ideally, the payroll portal signs in with the employee\u2019s Microsoft 365 account (single sign-on) to benefit from the same protections.<\/li>\n<li>Alerts on suspicious inbox rules, especially those that delete or move payroll notices.<\/li>\n<li>Alerts when a new phone or MFA method is added to an account.<\/li>\n<li>An \u201cexternal email\u201d banner and detection of external emails using an employee\u2019s name.<\/li>\n<li>In your payroll provider\u2019s portal, turn on banking-change notifications and MFA for all employees.<\/li>\n<\/ul>\n<h3>Informed people<\/h3>\n<p>Tell your employees that payroll will never ask for their credentials by email, and that any banking-change notice they didn\u2019t request must be reported right away. The people who run payroll should know this scenario by heart. The logic is the same as for <a href=\"\/en\/ceo-fraud\/\">CEO fraud<\/a>: new banking details are always a red flag. To go further, see our <a href=\"\/en\/12-steps-protect-business-2026\/\">12 steps to protect your business in 2026<\/a>.<\/p>\n\n<div class=\"alt-callout\"><p><strong>The golden rule: the two-minute call.<\/strong> Before changing a direct deposit, call the employee at a number you already had, or talk to them in person. If the request is legitimate, they\u2019ll thank you. If it isn\u2019t, you\u2019ve just avoided paying twice.<\/p><\/div>\n\n<div class=\"alt-urgent\">\n<h3>A paycheque was diverted? Act fast<\/h3>\n<ol>\n<li><strong>Call your financial institution and your payroll provider<\/strong> right away: ask for the deposit to be cancelled or recalled and for contact with the receiving bank. The faster you call, the better the chance of recovering the money.<\/li>\n<li><strong>Restore the correct account<\/strong> and freeze any other change until verified.<\/li>\n<li><strong>Alert your IT support<\/strong>: if an account was compromised, the password must be changed, open sessions revoked, added MFA methods removed and malicious inbox rules deleted.<\/li>\n<li><strong>Report<\/strong> the fraud to local police and the Canadian Anti-Fraud Centre, and notify your insurer.<\/li>\n<\/ol>\n<\/div>\n\n<div class=\"alt-cta\"><p>Want to check the security of your Microsoft 365 accounts and your payroll process?<\/p><a class=\"alt-btn\" href=\"tel:+18334441041\">Appelez le tech \u00b7 1 833 444-1041<\/a><\/div>\n\n<div class=\"alt-sources\"><p><strong>Sources<\/strong><\/p><ul>\n<li><a href=\"https:\/\/www.ic3.gov\/PSA\/2018\/PSA180918\" target=\"_blank\" rel=\"noopener\">FBI IC3 \u2013 Payroll diversion through stolen employee credentials<\/a><\/li>\n<li><a href=\"https:\/\/thehackernews.com\/2025\/10\/microsoft-warns-of-payroll-pirates.html\" target=\"_blank\" rel=\"noopener\">The Hacker News \u2013 Microsoft warns of \u201cPayroll Pirates\u201d (Storm-2657)<\/a><\/li>\n<li><a href=\"https:\/\/www.cbc.ca\/news\/canada\/saskatoon\/direct-deposit-fraud-saskatoon-police-1.5245789\" target=\"_blank\" rel=\"noopener\">CBC \u2013 Saskatoon police warn of direct deposit fraud<\/a><\/li>\n<li><a href=\"https:\/\/www.mcdonaldhopkins.com\/insights\/news\/the-sobering-truth-of-the-fbis-2025-internet-crime-complaint-center-report\" target=\"_blank\" rel=\"noopener\">McDonald Hopkins \u2013 FBI 2025 IC3 report<\/a><\/li>\n<\/ul><\/div>\n<\/article>\n","protected":false},"excerpt":{"rendered":"<p>An \u201cemployee\u201d asks to change their direct deposit, and the next paycheque goes to the fraudster. How payroll diversion fraud works, how to spot it and how to protect your business.<\/p>\n","protected":false},"author":2,"featured_media":2218,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[55],"tags":[],"class_list":["post-2223","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog-and-news"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.7 (Yoast SEO v28.8) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Payroll diversion fraud: fake employee, hijacked deposit<\/title>\n<meta name=\"description\" content=\"Payroll diversion fraud: a fake employee asks to change their direct deposit and the pay goes to the fraudster. Warning signs, procedures and what to do.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.supportadistance.com\/en\/payroll-diversion-fraud\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Payroll fraud: when a fake employee hijacks their direct deposit\" \/>\n<meta property=\"og:description\" content=\"Payroll diversion fraud: a fake employee asks to change their direct deposit and the pay goes to the fraudster. Warning signs, procedures and what to do.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.supportadistance.com\/en\/payroll-diversion-fraud\/\" \/>\n<meta property=\"og:site_name\" content=\"Online and on-site IT Support | 1-833-444-1041\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/Supportadistance\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-26T11:15:09+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.supportadistance.com\/wp-content\/uploads\/2026\/10\/payroll-fraud.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Fabrice Blanchet\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fabrice Blanchet\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/payroll-diversion-fraud\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/payroll-diversion-fraud\\\/\"},\"author\":{\"name\":\"Fabrice Blanchet\",\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/#\\\/schema\\\/person\\\/36d1bceaa54d6f2cd235b9c853fb7c64\"},\"headline\":\"Payroll fraud: when a fake employee hijacks their direct deposit\",\"datePublished\":\"2026-10-26T11:15:09+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/payroll-diversion-fraud\\\/\"},\"wordCount\":1166,\"publisher\":{\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/payroll-diversion-fraud\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.supportadistance.com\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/payroll-fraud.png\",\"articleSection\":[\"Blog and news\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/payroll-diversion-fraud\\\/\",\"url\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/payroll-diversion-fraud\\\/\",\"name\":\"Payroll diversion fraud: fake employee, hijacked deposit\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/payroll-diversion-fraud\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/payroll-diversion-fraud\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.supportadistance.com\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/payroll-fraud.png\",\"datePublished\":\"2026-10-26T11:15:09+00:00\",\"description\":\"Payroll diversion fraud: a fake employee asks to change their direct deposit and the pay goes to the fraudster. Warning signs, procedures and what to do.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/payroll-diversion-fraud\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/payroll-diversion-fraud\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/payroll-diversion-fraud\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.supportadistance.com\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/payroll-fraud.png\",\"contentUrl\":\"https:\\\/\\\/www.supportadistance.com\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/payroll-fraud.png\",\"width\":1200,\"height\":630,\"caption\":\"Employee paycheque diverted to a fraudster\u2019s account\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/payroll-diversion-fraud\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Payroll fraud: when a fake employee hijacks their direct deposit\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/\",\"name\":\"Support informatique en ligne et sur place | 1-833-444-1041\",\"description\":\"#1 Computer Repair in Canada\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/#organization\",\"name\":\"IROUTENETWORKS INC.\",\"url\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.supportadistance.com\\\/wp-content\\\/uploads\\\/2016\\\/09\\\/IROUTENETWORKS-LOGO-2016-1.png\",\"contentUrl\":\"https:\\\/\\\/www.supportadistance.com\\\/wp-content\\\/uploads\\\/2016\\\/09\\\/IROUTENETWORKS-LOGO-2016-1.png\",\"width\":800,\"height\":80,\"caption\":\"IROUTENETWORKS INC.\"},\"image\":{\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/Supportadistance\\\/\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/iroutenetworks-inc\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/#\\\/schema\\\/person\\\/36d1bceaa54d6f2cd235b9c853fb7c64\",\"name\":\"Fabrice Blanchet\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/6ad1349124dd95cc70e869189bf1758ed878ccd5c2ee57913d77c2028e889ccb?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/6ad1349124dd95cc70e869189bf1758ed878ccd5c2ee57913d77c2028e889ccb?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/6ad1349124dd95cc70e869189bf1758ed878ccd5c2ee57913d77c2028e889ccb?s=96&d=mm&r=g\",\"caption\":\"Fabrice Blanchet\"},\"sameAs\":[\"http:\\\/\\\/www.supportadistance.com\"]}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Payroll diversion fraud: fake employee, hijacked deposit","description":"Payroll diversion fraud: a fake employee asks to change their direct deposit and the pay goes to the fraudster. Warning signs, procedures and what to do.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.supportadistance.com\/en\/payroll-diversion-fraud\/","og_locale":"en_US","og_type":"article","og_title":"Payroll fraud: when a fake employee hijacks their direct deposit","og_description":"Payroll diversion fraud: a fake employee asks to change their direct deposit and the pay goes to the fraudster. Warning signs, procedures and what to do.","og_url":"https:\/\/www.supportadistance.com\/en\/payroll-diversion-fraud\/","og_site_name":"Online and on-site IT Support | 1-833-444-1041","article_publisher":"https:\/\/www.facebook.com\/Supportadistance\/","article_published_time":"2026-10-26T11:15:09+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.supportadistance.com\/wp-content\/uploads\/2026\/10\/payroll-fraud.png","type":"image\/png"}],"author":"Fabrice Blanchet","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Fabrice Blanchet","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.supportadistance.com\/en\/payroll-diversion-fraud\/#article","isPartOf":{"@id":"https:\/\/www.supportadistance.com\/en\/payroll-diversion-fraud\/"},"author":{"name":"Fabrice Blanchet","@id":"https:\/\/www.supportadistance.com\/en\/#\/schema\/person\/36d1bceaa54d6f2cd235b9c853fb7c64"},"headline":"Payroll fraud: when a fake employee hijacks their direct deposit","datePublished":"2026-10-26T11:15:09+00:00","mainEntityOfPage":{"@id":"https:\/\/www.supportadistance.com\/en\/payroll-diversion-fraud\/"},"wordCount":1166,"publisher":{"@id":"https:\/\/www.supportadistance.com\/en\/#organization"},"image":{"@id":"https:\/\/www.supportadistance.com\/en\/payroll-diversion-fraud\/#primaryimage"},"thumbnailUrl":"https:\/\/www.supportadistance.com\/wp-content\/uploads\/2026\/10\/payroll-fraud.png","articleSection":["Blog and news"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.supportadistance.com\/en\/payroll-diversion-fraud\/","url":"https:\/\/www.supportadistance.com\/en\/payroll-diversion-fraud\/","name":"Payroll diversion fraud: fake employee, hijacked deposit","isPartOf":{"@id":"https:\/\/www.supportadistance.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.supportadistance.com\/en\/payroll-diversion-fraud\/#primaryimage"},"image":{"@id":"https:\/\/www.supportadistance.com\/en\/payroll-diversion-fraud\/#primaryimage"},"thumbnailUrl":"https:\/\/www.supportadistance.com\/wp-content\/uploads\/2026\/10\/payroll-fraud.png","datePublished":"2026-10-26T11:15:09+00:00","description":"Payroll diversion fraud: a fake employee asks to change their direct deposit and the pay goes to the fraudster. Warning signs, procedures and what to do.","breadcrumb":{"@id":"https:\/\/www.supportadistance.com\/en\/payroll-diversion-fraud\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.supportadistance.com\/en\/payroll-diversion-fraud\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.supportadistance.com\/en\/payroll-diversion-fraud\/#primaryimage","url":"https:\/\/www.supportadistance.com\/wp-content\/uploads\/2026\/10\/payroll-fraud.png","contentUrl":"https:\/\/www.supportadistance.com\/wp-content\/uploads\/2026\/10\/payroll-fraud.png","width":1200,"height":630,"caption":"Employee paycheque diverted to a fraudster\u2019s account"},{"@type":"BreadcrumbList","@id":"https:\/\/www.supportadistance.com\/en\/payroll-diversion-fraud\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.supportadistance.com\/en\/"},{"@type":"ListItem","position":2,"name":"Payroll fraud: when a fake employee hijacks their direct deposit"}]},{"@type":"WebSite","@id":"https:\/\/www.supportadistance.com\/en\/#website","url":"https:\/\/www.supportadistance.com\/en\/","name":"Support informatique en ligne et sur place | 1-833-444-1041","description":"#1 Computer Repair in Canada","publisher":{"@id":"https:\/\/www.supportadistance.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.supportadistance.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.supportadistance.com\/en\/#organization","name":"IROUTENETWORKS INC.","url":"https:\/\/www.supportadistance.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.supportadistance.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/www.supportadistance.com\/wp-content\/uploads\/2016\/09\/IROUTENETWORKS-LOGO-2016-1.png","contentUrl":"https:\/\/www.supportadistance.com\/wp-content\/uploads\/2016\/09\/IROUTENETWORKS-LOGO-2016-1.png","width":800,"height":80,"caption":"IROUTENETWORKS INC."},"image":{"@id":"https:\/\/www.supportadistance.com\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/Supportadistance\/","https:\/\/www.linkedin.com\/company\/iroutenetworks-inc"]},{"@type":"Person","@id":"https:\/\/www.supportadistance.com\/en\/#\/schema\/person\/36d1bceaa54d6f2cd235b9c853fb7c64","name":"Fabrice Blanchet","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/6ad1349124dd95cc70e869189bf1758ed878ccd5c2ee57913d77c2028e889ccb?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/6ad1349124dd95cc70e869189bf1758ed878ccd5c2ee57913d77c2028e889ccb?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/6ad1349124dd95cc70e869189bf1758ed878ccd5c2ee57913d77c2028e889ccb?s=96&d=mm&r=g","caption":"Fabrice Blanchet"},"sameAs":["http:\/\/www.supportadistance.com"]}]}},"_links":{"self":[{"href":"https:\/\/www.supportadistance.com\/en\/wp-json\/wp\/v2\/posts\/2223","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.supportadistance.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.supportadistance.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.supportadistance.com\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.supportadistance.com\/en\/wp-json\/wp\/v2\/comments?post=2223"}],"version-history":[{"count":1,"href":"https:\/\/www.supportadistance.com\/en\/wp-json\/wp\/v2\/posts\/2223\/revisions"}],"predecessor-version":[{"id":2224,"href":"https:\/\/www.supportadistance.com\/en\/wp-json\/wp\/v2\/posts\/2223\/revisions\/2224"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.supportadistance.com\/en\/wp-json\/wp\/v2\/media\/2218"}],"wp:attachment":[{"href":"https:\/\/www.supportadistance.com\/en\/wp-json\/wp\/v2\/media?parent=2223"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.supportadistance.com\/en\/wp-json\/wp\/v2\/categories?post=2223"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.supportadistance.com\/en\/wp-json\/wp\/v2\/tags?post=2223"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}