The email looks routine. An employee wants to switch their direct deposit to a new bank before Friday’s payroll. Or a note from the CEO asks for a quick copy of everyone’s W-2s.
Requests like these land in HR and payroll inboxes all the time, and that’s exactly why scammers copy them. HR and payroll teams handle the two things criminals want most: money and personal information.
The good news is that most of these scams can be stopped with a few simple habits.
Why HR and Payroll Teams Are Targets
HR and payroll sit at the center of an organization’s most sensitive information: Social Security numbers, bank account details, tax forms, and the ability to change where paychecks go. These roles also involve responding quickly to employees and leadership, which is exactly what scammers count on.
The financial stakes are significant. In the FBI’s 2025 Internet Crime Report, business email compromise, the category that covers impersonation schemes like fake executive and employee requests, ranked as the second-costliest type of cybercrime, with more than $3 billion in reported losses.
These scams are also getting more convincing. The FBI notes that criminals are using AI chat tools to write emails that sound like company leaders, and voice cloning to request payments. Businesses reported more than $30 million in losses to AI-involved email compromise scams in 2025.
The Scams to Know
Direct deposit change requests. HR or payroll receives an email that appears to come from an employee, asking to update their direct deposit before the next pay period. The FBI has reported that the new account in these requests often leads to a prepaid card. In some cases, the company received phishing emails beforehand, which helped the request look legitimate.
Fake payroll and self-service login pages. Employees get an email, or click a search result, that leads to a site that looks like their payroll or employee self-service portal. Once they log in, criminals use those credentials to change direct deposit details. In an April 2025 alert, the FBI warned that scammers are buying search engine ads that mimic legitimate employee self-service sites, often with web addresses that differ by a small misspelling. Some also try to get the employee’s multi-factor code, sometimes by calling and posing as a bank representative.
W-2 and employee data requests. Someone posing as an executive emails payroll or HR asking for copies of employee W-2s or a list of employees and their Social Security numbers. The IRS notes these messages often open with something casual, like “Hey, you in today?” Because staff believe they’re helping a leader, it can take weeks to discover the theft, and criminals may file fraudulent tax returns within a day or two.
Executive requests for money. A similar version targets whoever handles wire transfers, with an urgent request that appears to come from a company leader.
Fake job applicants. The FBI has also flagged online interviews where applicants appear to use voice spoofing or deepfakes, with lip movements that don’t line up with the audio. The goal in these cases often appears to be getting access to company systems.
Warning Signs
Most of these scams share a few tells.
- Urgency. “Before this payroll,” “ASAP,” or “I need this in the next hour.”
- A request to skip the usual process or keep something quiet.
- A sender address that’s slightly off, or a reply that goes somewhere other than the name shown.
- Bank changes requested only by email, with no other confirmation.
- Links asking you to log in, especially ones with small misspellings in the web address.
- Requests for bulk sensitive data, like every W-2 or a full list of Social Security numbers.
- Anyone asking for a multi-factor code, by phone, text, or email.
- Video interviews where the audio and the person’s lip movements don’t match.
Simple Habits That Stop Most of These
Verify bank changes by phone. The FBI recommends giving extra scrutiny to any request to change direct deposit information. Call the employee at a number already on file, and never at a number provided in the request itself.
Route changes through a secure system. Ask employees to update banking details through your payroll portal with multi-factor authentication turned on. It also helps to confirm with the employee through a second channel, such as a text or a phone call, whenever banking information changes, so an unexpected update gets caught quickly.
Add a second check for sensitive data. Before anyone shares W-2s or employee Social Security numbers, confirm the request by phone or in person. Having two people sign off on bulk data requests adds a simple safeguard.
Go to login pages directly. The FBI recommends bookmarking payroll and self-service login pages or typing the address in yourself, and being cautious with search ads, since scammers pay for ads that mimic real sites. The FBI also points out that multi-factor authentication can’t protect an account once someone enters their details on a fake login page.
Protect multi-factor codes. Make it clear that your IT and payroll teams will never ask for a login code, and that anyone who does should be treated as a red flag.
Train everyone, and make reporting easy. The FBI recommends educating employees about these schemes and asking them to forward suspicious requests to IT or HR. A quick reminder before open enrollment and W-2 season can go a long way.
If Someone Clicks, Shares, or Pays
Mistakes happen, and when they do, speed matters.
If money was sent, contact your bank right away and ask about recalling the transfer. Then file a complaint at ic3.gov, whatever the amount. In 2025, the FBI’s Recovery Asset Team helped freeze about $679 million in funds tied to fraudulent transfers, and fast reporting is a big part of that.
If login details were entered, change the password immediately, alert IT, and review the account for any recent changes to banking or contact information.
If W-2 or employee data was shared, the IRS asks employers to email dataloss@irs.gov with “W2 Data Loss” in the subject line, without attaching any employee information. Forward the scam email to phishing@irs.gov with “W-2 Scam” in the subject line, and file a complaint with IC3. Let affected employees know quickly so they can take protective steps, and point them to identitytheft.gov for guidance.
One more tip: type ic3.gov directly into your browser. The FBI has warned that scammers create fake versions of the complaint site itself.
A Little Friction Goes a Long Way
Most of these scams work because they look like everyday requests and arrive at busy moments. A short phone call, a second set of eyes, or a pause before clicking a link is often all it takes to stop one. Building those small steps into your routine protects your employees’ paychecks and personal information, and it protects the trust they place in HR.
If you’re reviewing how your team handles payroll changes or employee data requests, now is a good time to do it, before year-end and W-2 season. HR On Call can help you put simple verification steps in place that protect your employees and your business.