← All posts · 2026-08-04 Life in America

How to Spot Direct Deposit Scam Emails: What to Do When You Get One

If you work in payroll or at a staffing agency, one day you’ll see an email like this land in your inbox:

“Thanks for letting me know. Please, send me the direct deposit information you have on file for him.”

The line above isn’t from a specific incident; it’s a reconstructed example based on patterns that show up all the time. The sender address may be unfamiliar, or the name looks right but something feels off. It’s hard to tell whether it’s a legitimate request or a direct deposit scam email.

Here are the four main red flags to focus on:

• The target is vague (“him,” “her”) and there’s no identity verification
• The email comes from a slightly off domain or a personal email account
• The tone is urgent: “I need this today,” “I can’t talk on the phone right now”
• They ask you to email existing direct deposit info or full account numbers

When you see these signs, do not reply to the email. First, use an existing in-house phone number or another official channel to verify the request.

What’s Risky About That Sample Email?

That sample email is dangerous for a few reasons:

• It only says “him” — there’s no employee name or ID number
• There’s no mention of any process to verify that the employee is really who they say they are
• They’re asking you to send all existing direct deposit information

Requests like this closely match typical direct deposit change scams, also known as payroll diversion or BEC (Business Email Compromise) payroll scams. Attackers usually want to:

1. Get existing payroll account information to use for identity theft, or
2. Trick you into changing the account so the paycheck goes into their own account

If staffing agency payroll security is weak—especially where one team processes payroll for multiple clients—a single breach can blow up into large losses and high response costs.

How to Handle Payroll Account Change Emails (Practical Workflow)

Here’s the baseline procedure I’ve used in practice. You can adapt it to fit your organization.

1. Set a firm rule: never process changes by email alone

• Even if a request to change or view payroll account info comes by email, you should:

→ Only complete the change after speaking on the phone using a pre-registered number, or

→ Confirming the person in a face-to-face visit.

• Treat email and chat as “request received” notifications, nothing more.

1. Only call using contact info you already have on file

• Scam emails often say, “Please only contact me at this number.”
• Ignore that. Call back using the phone number stored in your HR/payroll system or on the original contract.

1. Prepare an identity verification question script in advance

• For example: hire date; the name of the bank where the last paycheck was deposited (only partial info, not full numbers);

name of the direct manager; worksite location; etc.

• Decide on 2–3 standard questions in advance and use them to cross-check that you’re really talking to the employee.

1. Be extra strict with ‘lookup’ requests for existing direct deposit info

• As a rule, decline email requests like “Please send me the full account info you have on file.”
• If it’s truly necessary, first confirm identity, then share only minimal details over the phone, not full account numbers.

1. Don’t handle suspicious emails alone—share them

• Attackers often test the same template on different contacts in the organization.
• If something feels off, immediately loop in IT/security or your manager so the same scam doesn’t hit others across the company.

Practical Payroll Security Tips That Work in the Field

In environments like staffing and temp agencies, where people move around and identity verification is harder, having at least these basics in place helps:

• Document your policy and notify all staff
• Put in writing that “Payroll account changes are never processed by email alone.”
• Also state clearly: “Existing direct deposit info is not sent by email.”

• Apply the same rules to external partners (e.g., staffing vendors)
• If you make exceptions for just one partner, attackers will look for that weak spot.

• Keep a separate log of all payroll account changes
• Record who changed what, when, and through which channel.
• If something goes wrong, this makes it much easier to find the cause and prevent a repeat.

• Include this topic in onboarding and manager training
• Explain “the official process to change your payroll account.”
• Show employees and onsite managers how to forward suspicious payroll-related emails to HR/payroll.

In Closing: When in Doubt, Skip Reply and Verify via Another Channel

Spotting direct deposit scam emails is less about fancy technology and more about a few basic habits:

• Don’t rush to act based only on an email
• Always ask, “Is this the right channel for this kind of request?”
• If anything feels off:

→ Instead of replying, use a phone call, internal chat, or in-person check to cross-verify through another channel

Because one slip can lead directly to a major incident, even simple, pre-defined standards and procedures can go a long way in preventing payroll diversion.

The more an email makes you think, “No way this is a scam, right?”, the more important it is to double-check—and to make that double-checking reflex part of your organization’s culture. That’s the most realistic way to protect payroll security.