Our Employee's Paycheck Went to a Criminal's Account and What HR Does Next

It is Friday afternoon and one of your warehouse supervisors is standing at the HR desk holding a phone, showing a bank app with no deposit in it. Payroll ran on schedule. Your payroll report says the money went out. It went to an account the supervisor has never heard of, set up two weeks ago after an email that looked like it came from them asking you to update their direct deposit. They never sent it.

If you are the person who handles payroll or HR at a small or midsize business, this moment lands on you, and it tends to feel like your mistake. It usually is not. This kind of request is designed to look routine, and the person who made the change followed the same process they have followed for every honest request before it. What matters now is what you do next, in what order, and who else needs to know.

This post is written for the HR or payroll administrator, the office manager, or the owner who runs payroll themselves. It picks up after the first phone call. If nobody has called the bank yet, stop reading and do that now. Ask the bank to attempt a reversal of the deposit, which is a request to pull the payment back from the receiving bank before the money is withdrawn. ACH, short for Automated Clearing House, is the network that carries payroll direct deposits, and its timing is the reason speed matters. Our guide to the first hour after a fraudulent ACH payment covers exactly what to say to the bank and what details to have ready. Everything below assumes that call has been made.

Why This Was Not a Typo

The first instinct in many offices is to treat a diverted paycheck as a clerical error. Someone trusted the wrong email, and the fix is to change the account number back. That instinct is understandable, and it is the most expensive mistake you can make here.

A direct deposit change that the employee never requested is a form of business email compromise, usually shortened to BEC. BEC is when a criminal takes over or imitates a real email account and uses that trusted voice to redirect money. When the request came from the employee's real address rather than a lookalike, it means someone had access to that mailbox. When it came from a lookalike, it means someone studied your company closely enough to know who handles payroll and what a normal request looks like. Either way, somebody targeted you on purpose, and a person who succeeded once has every reason to try again.

Recent research shows how organized this has become. Between July 14 and September 22, 2026, the security firm Huntress tracked one operator who broke into 97 Microsoft 365 accounts at 79 organizations. Microsoft 365 is the email and office platform most small businesses run on. In one of those cases, the attacker set up a hidden inbox rule that quietly removed any message mentioning payroll, direct deposit, bank or bonus. A second rule hid every email from the company's outside CPA, the accountant who handled their books. The attacker then emailed that CPA directly. We wrote up the full findings in our advisory on the Microsoft 365 token replay campaign.

Think about what those rules do from the inside. The real account owner never sees the message confirming their deposit was changed. They never see the accountant asking a question that might expose the fraud. The mailbox keeps working normally, so nothing seems wrong until a paycheck goes missing. That is why a diverted paycheck has to be treated as a security incident, and why our business email compromise response work starts by finding out which mailbox was used and what the attacker could see from inside it.

The Employee Still Has to Be Paid

Here is the part that is easy to lose in the scramble. Your employee worked the hours. From where they sit, the company did not pay them, and they have rent, a car payment or child care due on the same schedule as everyone else. Whether the bank recovers the deposit next week or never, that person needs money now.

The practical path is to issue a replacement payment quickly, by paper check or by a deposit to the employee's verified account, and to handle the bank recovery and any insurance claim separately. How you record that second payment belongs with your payroll provider and your accountant, because paying the same period twice has tax and bookkeeping consequences. Ask them before you run it. What you should not do is make the employee wait on the bank's investigation. The employee did nothing wrong, and making them carry the loss for two or three weeks turns a fraud problem into a trust problem and, depending on the circumstances, a legal one. If you are unsure of your obligations, a short call with your employment attorney is cheap compared with the alternative.

Before you send the replacement anywhere, confirm the account details in person or by calling the employee at a number that was already in your records before this happened. Do not rely on anything sent by email this week, including a reply that appears to come from the employee. If their mailbox is the one that was compromised, the attacker may still be reading it.

Keep a written record of every payment you make, with the date, the amount and the reason. If you file an insurance claim later, the carrier will ask for exactly that record, and it is far easier to build today than to reconstruct next month.

What to Tell the Employee Today

The conversation with the employee matters more than most people expect. Start by saying clearly that they are going to be paid, and when. Then explain, without blame, what happened. A request to change their direct deposit came in under their name, the change was made, and the deposit went to an account that is not theirs.

Ask them a few questions, and write down the answers. Did they send any email to HR or payroll about their bank account in the last two months? Have they received unexpected prompts on their phone asking them to approve a sign-in, or been asked to type a code into a Microsoft page? Do they use the same password for their work email as for anything personal? None of these questions are an accusation. They help establish whether the employee's mailbox was the way in, which changes everything that follows.

If the request came from their real work address, tell them their account is being secured today and that they may be signed out of their phone and laptop. Encourage them to change the password on their personal email and their bank login as well, particularly if they reuse passwords, because a criminal who reaches a work mailbox often finds personal details inside it. Dark web monitoring can tell you whether that employee's work password was already circulating among criminals before this happened, which helps answer the question of how the attacker got in.

Finally, ask the employee to keep the matter between themselves, HR and management for now. That is not about secrecy. If the attacker is still inside your email, a company wide message about the fraud tells them they have been noticed.

Look for the Rules You Were Not Meant to See

Securing the mailbox is where well meaning offices most often stop too early. The usual move is to reset the password and consider the problem solved. The Huntress researchers are blunt about why that fails. In their words, "A password reset alone does not remove attacker-registered devices or MFA methods."

MFA, short for multi-factor authentication, is the second step after a password, usually a code or an approval on a phone. In at least 19 of the organizations in that campaign, the attacker removed the real owner's MFA methods and enrolled their own. Across the campaign the attacker also registered 48 fake devices to victims' accounts, which gave them a way to keep coming back. So securing the account properly means four things done together. Sign the account out of every session, reset the password, remove any device the employee does not recognize, and remove any MFA method the employee did not set up. Skip one and the door stays open.

Then look for the rules. Inbox rules are instructions inside a mailbox that automatically move, mark as read or delete certain messages. In the Huntress campaign the rules were given names designed to be overlooked, such as a single letter or a few dots, and they moved mail into folders almost nobody opens, such as RSS Feeds and Conversation History. The rule that hid payroll mail was named simply "s". An administrator scrolling through a rules list for something that looks suspicious can easily miss a rule called "s".

Check the rules on the employee's mailbox, on the HR or payroll mailbox, and on the mailbox of anyone who approves payroll. If you find one, do not delete it yet. The rule, the sign-in history and the timing of each change are evidence, and some of that history expires after a limited number of days in common business email platforms. Digital forensics is the careful, documented collection of that evidence before the cleanup begins, so you can answer how long the attacker was inside, which mailboxes they reached and what they read. Those answers decide whether you have a wider problem, including whether other people's personal information was exposed.

For a business with one internal IT person, all of this lands on top of everything else that person already does. Co-managed IT lets your IT person keep the office running while an outside team handles the investigation and the mailbox cleanup, so the payroll fix does not wait for whoever has a free afternoon.

Check Every Other Deposit Change and Call Your Accountant

One diverted paycheck is the part you can see. The next step is to look for the parts you cannot. Pull a report from your payroll system of every direct deposit change made in the last 90 days, and confirm each one with the employee in person or by phone at a number on file. An attacker who succeeded once had time to try others, and a second change may be waiting for the next payroll run.

Look at changes beyond bank accounts, too. A changed personal email address or phone number on an employee profile can be how an attacker blocks the notice that would have warned the real employee. If your payroll provider sends change confirmations, check where they were actually delivered.

Then call your outside accountant or CPA, by phone, at the number you already have. Remember the second rule in the Huntress case, the one that hid every message from the company's CPA, after which the attacker emailed the CPA directly. Your accountant may have received requests that appeared to come from you about payroll, tax forms or bank details. They need to know today that your email may have been used against them, and they may have their own notifications to make. Call your payroll provider as well, and ask them to flag any change on your account that does not come through a verified channel.

Changing How Payroll Handles Requests

Once the incident is contained, the goal is to make the next attempt fail without making payroll harder for honest employees. The rule that matters most is simple. A direct deposit change is never made on the strength of an email alone, even one from a real company address. The employee confirms it in person, through the payroll provider's own portal with its own login, or on a call to a phone number that was already in your records. A short hold before the first payment to a new account, with a notice sent to the employee's previous contact details, gives the real employee a chance to say that was not them before money moves.

Much of the protection needs to sit in email, because that is where this started. Email security tools can flag sign-ins from unusual places, lookalike addresses and newly created inbox rules that mention payroll or banking terms, so someone notices the setup before a paycheck goes out rather than after.

We are based in McKinney and work with businesses across McKinney, Allen, Plano, Frisco and the rest of Collin County. If a paycheck has already gone to the wrong account, call us at 512-518-4408 and we will help you secure the mailbox, preserve the evidence and find out whether anything else was touched. If you would rather learn how exposed your payroll and HR mailboxes are before anything happens, start with a free security assessment or contact our team.

Frequently Asked Questions

Can a direct deposit sent to a scammer be reversed?

Sometimes. Your bank can ask the receiving bank to return the deposit, but it can only recover what is still in the account, so the chances are much better if you call the same day you find out. Call the bank before you do anything else, then file a report at ic3.gov, the FBI's online fraud reporting site.

Do we have to pay the employee again if their paycheck was stolen?

The employee did the work and did nothing wrong, so the practical answer is to issue a replacement payment right away and pursue recovery separately. Ask your payroll provider and accountant how to record it, and talk to an employment attorney if you are unsure of your obligations.

How did a criminal get our employee's direct deposit changed?

Through a change request sent by email, either from a lookalike address or from the employee's real mailbox after an attacker took it over. In one recent campaign the attacker also added a hidden inbox rule that removed any message mentioning payroll, direct deposit, bank or bonus, so the warning signs never reached anyone.

Is resetting the employee's email password enough after payroll fraud?

No. An attacker can keep access through a device they registered to the account or an MFA method they added, and a password reset removes neither. Sign the account out of every session, reset the password, remove unknown devices and MFA methods, and check for hidden inbox rules before you consider the account secure.