Phase 2 — Digital and Emerging Schemes · 8 min read
15 · ACH Changes and Payroll Diversion
Employee direct-deposit details altered so paychecks route to an account the employee never owned.
01The redirected paycheck
Payroll diversion is the alteration of an employee's bank account on file so that their net pay is sent to a fraudster's account instead. It is often triggered by a plausible-looking email from the employee requesting the change. The employee does not notice until payday, and the money is gone.
- Direct-deposit change requests received by email, especially with urgency or outside normal channels.
- Paychecks routed to accounts that differ from the employee's prior history.
- Multiple change requests processed in a single pay cycle.
- No verification step — a callback, a portal confirmation — before the change takes effect.
Require out-of-band verification for every bank-account change. A second channel defeats an email-only request.
Continue offline
Every chapter, worksheet, and checklist in one edition you can annotate.
Buy the guidebookMore in Phase 2 — Digital and Emerging Schemes
10 · Payment Apps and Unauthorized Payment Links
Customer payment links pointing to a personal account on a consumer payment app.
11 · Leads and Customers Redirected Through Social Media
Business-generated leads and customers steered to a competing venture owned by the fraudster.
12 · AI-Assisted Documents and Impersonation
Invoices, signatures, and communications fabricated or altered with generative AI tools.
13 · Cryptocurrency Receipts Diverted to Private Wallets
Crypto payments accepted on the business's behalf but routed to a wallet the partners cannot see.