Payroll Diversion Fraud Investigation

How a Paycheck Gets Stolen Before Payday

Payroll diversion is business email compromise aimed at HR instead of the wire room. The criminal's goal is simple: change an employee's direct deposit destination to an account they control, then wait for the next pay run.

They get there by one of three doors. The first is the employee's own credentials, phished through a fake login page for your HR or payroll portal; once inside the self-service account, the criminal changes the bank details directly and often adds a rule to hide the confirmation email. The second is impersonation: an email to HR or payroll staff that appears to come from the employee, politely asking to update their direct deposit, usually to a prepaid card account that is hard to claw back. The third is compromise of an HR or payroll administrator's own account, which lets the criminal change many employees at once.

Each theft is smaller than a wire fraud loss, one paycheck instead of one closing, but the scheme repeats. The same criminal hits multiple employees, multiple pay cycles, or multiple companies running the same payroll platform. The question that matters on day one is whether you are looking at one compromised employee or a compromised HR system, because the containment, the loss, and the notification obligations are different. That is the first question this investigation answers.

The First 72 Hours

The Question That Decides Everything: One Employee or the System

If a single employee was phished, the exposure is one person's pay and the fix is contained. If an HR administrator's account or the payroll platform itself was compromised, every employee's bank details, Social Security numbers, and home addresses may have been exposed, and that raises breach notification questions your counsel must answer on a deadline. We establish the scope with evidence: portal access logs, mailbox audit records, and the pattern of changed accounts. Guessing small and being wrong is the expensive outcome; our job is to make sure nobody is guessing.

The fraudulent change traced to how it got in

The Recovery Path

Individual paychecks move by ACH, so the recovery mechanics differ from wire fraud: reversal requests through the originating bank, holds on the receiving account, and the receiving institution's own fraud process. Where the same receiving accounts appear across multiple victims, law enforcement interest rises sharply, and our documentation is built to make that case. Civil routes exist against identified account holders, and employer practices liability or crime coverage may respond depending on the policy; the coverage question usually turns on exactly the access evidence we document. No investigator can promise recovery. What we deliver is the documented intrusion, the traced funds, and the identified parties that give every recovery channel something to act on.

Who Makes the Employee Whole

In most payroll diversion cases the employer re-issues the stolen pay, then pursues recovery, because the employee did nothing but get phished, and wage payment obligations do not disappear because a criminal intervened. Either way, the dispute over the loss lands on the evidence: who was compromised, what controls existed, and what the logs show. That record is what we build.

When the Fraud Is Bigger Than Your Company

Payroll diversion is rarely bespoke. The same operators run the same play against many employers at once, often targeting companies on the same payroll platform with the same phishing kit and the same look-alike login pages. That has two practical consequences for your case. First, the receiving accounts in your incident have usually received other companies' payroll too, and documenting that overlap is what elevates a small-dollar theft into a case law enforcement will work: one diverted paycheck is a report, a mule account collecting from a dozen employers is a prosecution. Second, the infrastructure that hit you, the domains, the sending addresses, the kit fingerprints, is searchable, and it tells us how industrial the operation is and where else it points. We document your loss inside that larger pattern, which strengthens every channel you care about: the bank sees an account worth freezing, the insurer sees a professional attack rather than lax controls, and the federal file gets weight it would never have alone.

Written for whoever absorbs the loss

Stay Protected

How These Cases Are Priced

Every engagement is a flat fee, quoted in writing before work begins, so a payroll incident never becomes an open-ended bill. As a framework, insurance claim evaluations start at 5,400 dollars, and full business email compromise investigations, the family this belongs to, typically run 12,500 to 25,000 dollars depending on how many mailboxes, employees, and accounts are involved. Complex multi-company or platform-level matters are quoted beyond that range. These figures are frameworks, never final quotes: your quote comes from your facts. Contact us to have your case evaluated and quoted.

Frequently Asked Questions

Two of our wire fraud matters are written up in full: a six figure wire, gone overseas, recovered in weeks, and a $500,000 loss and a partnership worth saving.

Your Examiner