Payroll Direct-Deposit Fraud: Secure Change Intake

Treat bank-detail changes as exceptions

New or changed direct-deposit instructions, urgent requests, changed contact information, executive pressure, secrecy, or a request sent from an unusual channel should enter a controlled exception path. Capture the worker, employer, channel, time, changed field at the minimum necessary level, affected pay period, request source, and current payroll state. Support should not edit the account, approve the change, reveal existing bank details, accuse a person, or tell the requester how to bypass verification. Preserve the original request and route it through the employer’s reviewed identity, authorization, and dual-control process.

Verify through independent channels

A reply to the same email or message, caller ID, a phone number supplied in the request, familiar writing style, possession of personal data, or successful account login may not independently verify a payroll change. Use the employer’s approved callback, known-contact, secure self-service, or out-of-band process. Never request passwords or one-time codes. Record which trusted directory or prior authoritative record supplied the route, which identity steps were completed, who verified, what was confirmed, and who approved. Failed or inconsistent verification requires escalation.

Separate change and payment states

Distinguish change requested, identity verified, bank information submitted, account validated under policy, change approved, effective period assigned, payroll calculated, payroll released, payment transmitted, settled, returned, recalled, disputed, and recovered. Do not collapse these states or promise that a payroll hold or bank notification stopped funds. Support may capture what the worker reports and route urgently; it should not initiate a recall, reissue wages, change taxes, freeze an account, file a police report, or promise an off-cycle payment unless explicitly authorized.

Coordinate fraud escalation honestly

Suspected phishing, business-email compromise, account takeover, insider activity, malware, or unauthorized payroll access may require payroll, HR, security, legal, privacy, finance, bank, insurance, and law-enforcement decisions. Preserve messages, timestamps, affected pay periods, and available evidence without unnecessary propagation. Tell the worker what is known, unverified, which owner accepted the case, and when an update will occur. Do not promise attribution, containment, wage replacement, fund recovery, notification timing, account safety, retaliation protection, regulatory outcome, or compliance before authorized investigation.

Build the control table

Govern sources and accountable handoff

Every answer should point to a dated, owned source. Separate worker statements, time records, payroll-system output, benefit records, court or agency orders, employer policy, tax filings, bank confirmations, and public guidance. Require qualified review for worker classification, hours, wages, overtime, deductions, benefits, leave, garnishments, taxes, filings, deposits, corrections, payments, employment law, authorization, fraud, privacy, security, identity, accessibility, and jurisdiction. Log the source version, verification state, employer and worker scope, receiving owner, and confirmation. A summary helps only when its provenance can be checked and the authorized destination accepts the matter.

Protect payroll data and service resilience

Collect the minimum information needed in approved channels. Define identity verification, employer and employee access, retention, redaction, recording, consent, export, deletion, tax-record, wage-record, benefit, court-order, bank-data, and vendor controls. Provide accessible interaction, error recovery, a human alternative, and reviewed language support. Test outages, duplicate time imports, stale tax tables, malicious prompts, changed direct-deposit instructions, credential disclosure, impersonation, suspicious documents, urgent wage complaints, and failed handoffs with synthetic data. Record limitations, owners, incident paths, and rollback procedures.

Apply scope and qualified review

This article provides general operational information, not payroll, wage, tax, legal, benefits, leave, employment, garnishment, financial, fraud, payment, privacy, security, identity, accessibility, or compliance advice. Employer, worker, classification, jurisdiction, pay period, policy, plan, order, authorization, system, facts, and current law control. A configured conversational system may assist approved intake and routing, but this article does not claim LumiTalk hires or classifies workers; records time; calculates wages, overtime, taxes, benefits, deductions, or garnishments; prepares or files returns or wage reports; executes deposits or payroll; changes bank data; makes eligibility or legal decisions; detects fraud; guarantees accuracy, recovery, timing, security, or compliance; reads live payroll, bank, tax, or government data; or provides exact pricing, availability, language, or integration coverage.

Primary sources

Use current primary sources as the factual floor, then obtain employer, worker, classification, jurisdiction, pay-period, tax, benefit, order, payment, and policy-specific qualified review. CISA Recognize and Report Phishing · FTC Safeguards Rule · NIST Cybersecurity Framework 2.0 · NIST Digital Identity Guidelines

Continue through the Payroll cluster

Use the hubs and service page for cluster context, then compare adjacent guides before implementing a workflow. Payroll resource hub · Tax & Accounting resource hub · LumiTalk for payroll operations · Payroll Customer Support Operations Guide · Payroll Employee Onboarding Intake · Payroll Support Software Checklist