An email arrives in payroll or HR from an employee: they have switched banks and would like their salary paid to a new account from this month. It is short, polite, and entirely ordinary. The sender is either a spoofed address or the employee's own compromised mailbox.
Why it succeeds
The amount is usually unremarkable, so it attracts no scrutiny. The request is routine, so it is handled quickly. And the person who would notice — the employee — has no visibility until payday. By then the receiving account has been emptied and closed.
Controls
- Verify every change of bank details by calling the employee on the number in the HR record, not one supplied in the request.
- Require multi-factor authentication for the payment-details screen in any self-service portal.
- Send an automatic confirmation to the employee's known email and phone whenever bank details change, so an unauthorised change is visible immediately.
- Freeze detail changes in the days immediately before a payroll run, when timing pressure suppresses checks.
If it has happened
Contact your bank the same day for a recall attempt, and tell the affected employee immediately — they have lost a salary they were relying on, and how quickly you make them whole matters. Check whether your insurance covers electronic funds transfer fraud, and review the employee's mailbox for compromise, since that is often the starting point.