Hi, It’s Marcus. I Need to Change My Bank Account.

What follows is an illustrative scenario, not a real case. But versions of this direct deposit fraud play out in payroll and HR inboxes every day.

It’s 4:47 p.m. on a Thursday, two hours before payroll cutoff. Dana in the HR department receives a message: “Hi, it’s Marcus. I just got a new bank and need my direct deposit details changed before tonight. Can you take care of it?”

The sender includes Marcus’s employee ID, start date and mentions his manager by name. The details are accurate, but the person sending them isn’t Marcus. It’s one of the fraudsters behind direct deposit scams.

How Fraudsters Research Their Targets Before Making Contact

The message didn’t come out of nowhere. Before reaching out, the fraudster did their research. Some of it may have come from a past data breach, a public social media profile, a company directory or earlier phishing emails. Stolen login credentials and personally identifying information are often easy to buy or find.

By the time they contact Dana, they don’t sound like a stranger. They sound like someone you’d expect to hear from.

That’s the idea at the center of this scenario: knowing information about someone isn’t the same as proving you’re that person.

Don’t treat accurate personal details as proof of identity. Employee IDs, start dates and manager names are often easy to find, or may already be in a fraudster’s hands.

3 Red Flags in a Fraudulent Direct Deposit Request

Though they’re easy to miss in the moment, look closely at the request and a few things stand out:

1. It’s an urgent request. Payroll cutoff is hours away, and the deadline is designed to rush Dana into acting before she has time to question it.

2. It came through a different channel. Marcus normally handles changes through the employee portal. This request arrived by personal email, with a note that he “couldn’t log in right now.”

3. It asks for an exception. There’s a reason the usual process doesn’t apply, and the exception just happens to involve money.

None of these red flags is proof of fraud on its own. Together, they’re a pattern. Urgency, a new channel and a reason to skip the process are three of the most common signs of impersonation.

When a request combines all three flags, treat it as your cue to verify, no matter who it appears to come from.

Why Pressure Makes Payroll Teams Skip Verification

Dana is good at her job, which means she’s responsive, helpful and aware of what a missed paycheck means to someone. She doesn’t want to be the reason Marcus goes without pay.

So, she suggests confirming the request first.

The reply comes quickly. “I really don’t have time for this. Can you just do it this one time? I’ll be stuck without my pay.”

This is another red flag, and it’s easy to overlook: resistance to verification is a warning sign. A real employee may be frustrated by a delay. That doesn’t change the need to verify the request. Pushing to skip it may tell you something.

What does independent verification look like? Dana calls Marcus at the number already on file to confirm he requested the change. She uses the contact information on record before the message arrived, rather than any details supplied in the request. It takes a few minutes.

Always verify through contact details that were on file before the request. Make verbal confirmation a standard step for all direct deposit requests so no one feels awkward asking.

What Happens When a Request Is Approved vs. Verified

In the first version, Dana wants to help and the deadline is close. She makes the change. The contact information updates in the payroll system, then the account numbers. Payroll runs, and the deposit lands in an account the fraudster controls.

Days later, the real Marcus notices his paycheck never arrived. Now there’s a missing payment, a frustrated employee, potential financial losses and a scramble to figure out how it happened.

In the second version, Dana pauses. She reaches Marcus through the number on file, and he has no idea what she’s talking about. The request is flagged, the account is secured and payroll runs as normal.

It’s the same request, deadline and pressure. The only difference is one deliberate pause.

Why Impersonation Works Without Hacking Anything

Notice what didn’t happen in this scenario: nobody cracked a password or bypassed a firewall. The attack worked because it appealed to trust, urgency and good intentions. This pattern is a form of business email compromise (BEC), a scheme the FBI has long tracked, in which cybercriminals pose as a trusted person to redirect money. In payroll, it can also lead to account takeover, where a fraudster gains control of an employee’s payroll access.

That’s why strong technology controls, such as multi-factor authentication (MFA), aren’t the whole picture, even though they’re essential. A fraudster who can simply ask someone inside to make the change doesn’t need to break in. They need a believable story and a person willing to help.

The takeaway is simple: authority, urgency and familiarity should never override verification. When something involving identity or payroll doesn’t look right, slowing down may be the fastest, most effective way to stop direct deposit fraud.

And that’s just one of seven schemes that target payroll and the people around it. Others include:

• Fake or synthetic employees who never actually existed

• Fraudulent business identities

• Executive impersonation, including AI-enhanced attempts

• Individuals with legitimate access who misuse it

• Phishing scams that use suspicious links to steal credentials

Each one works differently, with its own warning signs. Employers and payroll service providers need several safeguards, including identity checks, access controls, monitoring and employee training.

Join isolved for Fraud Prevention Week

Want to learn more about all seven schemes? Join Steve Lenderman, isolved’s Head of Fraud Prevention, in our upcoming webinar, Your Payroll Is a Target: 7 Fraud Schemes Every Employer Should Know. He will demonstrate how each scheme unfolds, what warning signs to look for and how layered controls help reduce risk.