Business email compromise is usually discussed in terms of vendor payments, but payroll is a target too. In a payroll diversion scam, a criminal pretends to be an employee and asks HR or payroll to change direct deposit details. The next paycheck goes to an account the criminal controls, and the employee finds out when the money does not arrive.
Construction firms have features that make this worse: many employees, frequent turnover, seasonal crews, field workers who rarely visit the office and payroll teams under deadline pressure.
How the Scam Works
- The attacker obtains information about an employee, such as a name, work email and employer, from public sources, a data breach or a compromised mailbox.
- They send a message to payroll or HR, either spoofing the employee's address or from a lookalike account, asking to update bank details before the next pay date.
- In some versions, they have taken over the employee's real mailbox, which makes the request look entirely legitimate.
- Payroll updates the record. The funds are deposited into an account, often a prepaid card or an account that is quickly emptied.
- The employee reports a missed paycheck, and by then funds may be gone.
A variant targets the employee: a fake message from "HR" or the payroll provider asks them to log in to a convincing but fake portal to update their information, which captures their credentials.
The FBI's Internet Crime Complaint Center has published guidance describing business email compromise schemes broadly, and payroll diversion fits the same pattern of impersonation and urgency.
Why Field Crews Are Vulnerable
- Workers may not check company email often, so changes can go unnoticed.
- Employees use personal email and phones, which are less protected.
- Lots of turnover means payroll staff may not know everyone.
- Pay is often weekly, so the window to catch fraud is short.
Controls That Work
Verify every change by a second channel
Require that any direct deposit change be confirmed using contact information already on file, not information in the request. A phone call to a known number, or in-person confirmation, is far stronger than replying to the email.
Use self-service with strong authentication
Let employees update their own details in the payroll system, protected by multi-factor authentication, rather than sending requests by email. This removes the email channel the attacker relies on.
Send confirmation notices
Whenever bank details change, send a notification to the employee's previously registered contact methods, such as their prior email and a text. Include instructions to report unexpected changes immediately.
Add a waiting period
Consider holding the first payment after a banking change for a short verification window, or using a prenote, a small test deposit, where your bank and payroll provider support it. Even a one-cycle delay can allow time to catch fraud, though weigh this against employee needs.
Restrict and log access
Limit who in the company can change payroll banking details. Keep audit logs and review changes weekly, looking for patterns such as several employees changing to the same account or unusual changes just before pay day.
Secure mailboxes
Employee mailbox takeover feeds these scams. Require multi-factor authentication, disable legacy protocols, and watch for suspicious forwarding rules.
What Employees Should Know
Share these points with your workforce in plain language:
- Payroll will never ask for your password or one-time codes.
- Changes to your pay deposit should be made only through the official system or in person.
- Be suspicious of messages that create urgency or threaten delays.
- Check your pay stub details after any change.
- Report unexpected emails about pay immediately.
If It Happens
Speed matters.
- Contact your bank and your payroll provider immediately to attempt to stop or recall the payment.
- Reset the affected employee's credentials and check their mailbox.
- Preserve emails and records.
- Report the incident to law enforcement, including through the FBI's IC3, and notify your insurer.
- Pay the affected employee promptly according to your policy and applicable law, and tell them what happened.
- Review how the change was approved and fix the gap.
Building a Procedure
Write a one-page direct deposit change procedure and train payroll staff on it, including role-play of a pushy request. Ironfield Cyber helps construction firms strengthen payroll and finance controls, secure mailboxes and train staff to recognize these requests before money moves.