Payroll direct deposit phishing scam
Scammers send emails that look like they come from HR or payroll, asking employees to sign in and update direct deposit details. The fake page steals your login so they can redirect your paycheck.
How this scam works
With your login, scammers change your bank account in the payroll system and your next paycheck goes to them.
Common versions of the message
- A new payroll system
- An end-of-day deadline
- A sign-in with your work email and password
What the message looks like
Email from HR Payroll <payroll@hr-portal-update.top>: Action required: payroll update
Due to a new payroll system, all employees must update their direct deposit details by end of day or this week's pay will be delayed. Sign in with your work email and password to confirm: http://hr-portal-update.top/login
Fictional example based on common, publicly reported scam patterns.
The red flags
- 1
Payroll change: “update their direct deposit details”
Scammers redirect your paycheck to their account
Payroll changes by email link are a common way to steal paychecks.
- 2
Rushed deadline: “by end of day”
So you act before asking HR
The deadline keeps you from asking HR.
- 3
Asks for your password: “Sign in with your work email and password”
The fake page steals your login
The fake page steals your work password.
- 4
Unknown site: “hr-portal-update.top”
Use your real HR portal, typed in yourself
Use your real HR portal by typing its address yourself.
What to do
- Do not click the link.
- Ask HR directly, in person, by phone, or in a new email.
- Report the email to your IT or security team.
If you already replied, clicked, or paid
- Change your work password right away and tell IT.
- Ask HR to check that your direct deposit details were not changed.
- Watch for your next paycheck.
Got a message like this?
Paste it into TrustShield's free checker to see the warning signs in seconds. No sign-up needed to try it.