# "I switched banks, can you update my deposit?" His $1,912 paycheck went to a stranger. > An owner updates an employee's direct deposit from one friendly email, and his $1,912 paycheck lands in a stranger's account. Here's how payroll diversion works and how to stop it. By Elie Mendlow · Published October 27, 2026 Section: Brokers & Harassment › Industry Scams · Series: Scam Report (https://mcafax.com/notebook/series/scam-report) Canonical: https://mcafax.com/notebook/scam-report-payroll-direct-deposit-switch Source: MCAFax, The Broker's Notebook (https://mcafax.com/notebook). MCAFax is not a lender or a law firm. --- "Hey Tess, I switched banks. Can you update my direct deposit before Friday's payroll? New routing and account numbers below. I'm on the line all day so email is easiest. Thanks!! - Luis" Here's a hypothetical, and everyone in it is made up. Tess (made up) owns Kettle Row Coffee (a made-up coffee roaster) with nine people on payroll. Luis (also made up) runs the roaster. He has been there three years and never once emailed her about anything. The email landed Wednesday at 4:47 PM. His name in the From line. His sign-off, more or less. A friendly double exclamation point. Payroll was open in one tab, the bank balance in another, the daily MCA debit already pulled. She wanted it done. So she logged into the payroll portal, pasted the new numbers, and hit save. Ninety seconds. She felt efficient. Friday at 7:10 AM, Luis asked her why his pay hadn't hit. $1,912.40, gone to an account neither of them had ever heard of. That's the turn. Nobody hacked her payroll. Nobody guessed a password. The scammer just asked payroll, and payroll said yes. Tess pulled up the email again. The display name said Luis. The address behind it was a personal webmail account she'd never seen, with his name and two random digits. The "Meet the Roasters" page on her website had his full name and job title. That's all it took. Then she checked her inbox one more time. A second email, from "Amaya" on the espresso bar, same wording, same request. This isn't a one-off. On Oct. 14, 2026, the Ohio Attorney General warned that scammers posing as co-workers and HR are on the rise, trying to hijack accounts and intercept payroll, and that real employers won't ask anyone to update payroll information outside formal channels ([Ohio Attorney General](https://www.ohioattorneygeneral.gov/Media/Newsletters/Consumer-Advocate/October-2026/Protect-yourself-from-employer-impersonation-scams)). On Oct. 15, 2026, Connecticut news reported police in Plainfield had arrested a man accused of posing as a school employee and asking the payroll office to change his direct deposit ([WFSB](https://www.wfsb.com/2026/10/15/florida-man-posed-plainfield-high-school-employee-gain-direct-deposit-money-police-say/)). The FBI calls this payroll diversion ([FBI IC3](https://www.ic3.gov/PSA/2018/PSA180918)). ## Red flags - The display name is your employee, but the address isn't the one on file. New Mexico's State Auditor says these emails use addresses that imitate a real, known sender ([New Mexico State Auditor](https://www.nmdfa.state.nm.us/wp-content/uploads/2026/05/OSA-Notice-on-Payroll-Email-Spoofing.pdf)). - It's urgent and tied to a deadline, like "before Friday's payroll" ([New Mexico State Auditor](https://www.nmdfa.state.nm.us/wp-content/uploads/2026/05/OSA-Notice-on-Payroll-Email-Spoofing.pdf)). Bonus flag: the sender can't take a call. - It asks you to change bank details by email, outside your normal process ([Ohio Attorney General](https://www.ohioattorneygeneral.gov/Media/Newsletters/Consumer-Advocate/October-2026/Protect-yourself-from-employer-impersonation-scams)). - The new account looks unfamiliar. The FBI says diverted pay often goes to a prepaid card ([FBI IC3](https://www.ic3.gov/PSA/2018/PSA180918)). ## What to do Don't change any bank details from an email alone. Call the employee on the number already in your files, or walk over and ask. Never use a number in the email ([New Mexico State Auditor](https://www.nmdfa.state.nm.us/wp-content/uploads/2026/05/OSA-Notice-on-Payroll-Email-Spoofing.pdf)). Make it a rule: bank changes only through your payroll system's own employee login, or in person, and every change gets a confirmation to the employee's old contact info. The FBI tells employers to give extra scrutiny to any employee request to change direct deposit ([FBI IC3](https://www.ic3.gov/PSA/2018/PSA180918)). Already paid? Call your bank and your payroll provider right now and ask them to recall or reverse the deposit. The FBI says to do it as soon as you spot the fraud, because fast reports with full transaction details give the best shot at freezing the money ([FBI IC3](https://www.ic3.gov/PSA/2025/PSA250424)). Report it to the FBI's [Internet Crime Complaint Center](https://www.ic3.gov) and write "payroll diversion" in the complaint ([FBI IC3](https://www.ic3.gov/PSA/2018/PSA180918)). Also report it at the FTC's [fraud report site](https://reportfraud.ftc.gov) and to your state attorney general. Then tell your team. If one name on your website got a fake email, assume the rest will. Tess took the "Meet the Roasters" page down that afternoon. Luis asked her to put it back up, without the last names. Sources: - [Ohio Attorney General, Protect yourself from employer impersonation scams (Oct. 14, 2026)](https://www.ohioattorneygeneral.gov/Media/Newsletters/Consumer-Advocate/October-2026/Protect-yourself-from-employer-impersonation-scams) - [WFSB, Plainfield direct deposit impersonation arrest (Oct. 15, 2026)](https://www.wfsb.com/2026/10/15/florida-man-posed-plainfield-high-school-employee-gain-direct-deposit-money-police-say/) - [New Mexico Office of the State Auditor, Payroll Phishing Fraud Alert (2026)](https://www.nmdfa.state.nm.us/wp-content/uploads/2026/05/OSA-Notice-on-Payroll-Email-Spoofing.pdf) - [FBI IC3, Payroll diversion PSA](https://www.ic3.gov/PSA/2018/PSA180918) - [FBI IC3, Fake employee self-service sites PSA (Apr. 24, 2025)](https://www.ic3.gov/PSA/2025/PSA250424) - [FTC, report fraud](https://reportfraud.ftc.gov) ## Questions readers ask **How do I verify a direct deposit change?** Call the employee at a number you already have, or confirm in person ([New Mexico State Auditor](https://www.nmdfa.state.nm.us/wp-content/uploads/2026/05/OSA-Notice-on-Payroll-Email-Spoofing.pdf)). **Can I get the paycheck back?** Sometimes. Call your bank and payroll provider fast and ask for a recall or reversal ([FBI IC3](https://www.ic3.gov/PSA/2025/PSA250424)).