Payroll diversion and employee impersonation fraud: a Dayforce CISO's view

Who is speaking

Colin Anderson is Dayforce's Chief Information Security Officer. His author profile says he has more than 25 years of experience leading the delivery of solutions and services in technology risk management, cybersecurity, compliance, network engineering, information systems, and business resiliency.

Two posts under his name cover this topic. One, dated August 30, 2023, is about payroll diversion fraud. The other, dated June 12, 2025, is about employee impersonation and HR system credential compromise. The 2023 post is introduced as coming from "Ceridian's Chief Information Security Officer."

How the 2023 post defines payroll diversion fraud

The post says payroll diversion fraud, also known as direct deposit fraud, is a malicious scheme in which cyber criminals try to redirect an employee's paycheck to an unauthorized bank account, typically under their control.

The post says the fraud has been around for a few years and that there are signs of a resurgence.

How the attack unfolds

According to the post, the fraud often starts with phishing emails sent to employees that appear to come from senior leaders or HR representatives. These messages carry urgent messages or threats to pressure the recipient to act quickly.

The post says the emails can mimic the company's branding, logo, and email format with stunning accuracy.

A click may lead to a fake website that looks like a legitimate company portal, and entering login details there gives fraudsters access.

Once in, the post says, the scammer changes the employee's bank account details to divert the direct deposit funds. The scammer may also try to modify or delete notification settings so the employee gets no alerts about the change.

The 2025 post: impersonation by phone

The June 12, 2025 post says HR is seeing a rise in social engineering calls, many from fraudsters impersonating legitimate employees to trick HR teams into changing sensitive information.

One example it gives is someone posing as an employee who calls HR and persuades a team member to update payroll information. The post says this could compromise an employee's payroll or personal identification data.

The post says these calls are becoming more convincing because software can create a realistic impersonation of a person's voice, known as a deep fake. It names executives and employees with publicized speaking events, podcasts, or interviews as especially exposed.

A second example is a caller claiming to be from IT who offers to update a system or apply a patch. The post says these calls are designed to get employees to share system credentials, including for HR systems.

Warning signs in the 2023 post

The post groups the red flags into two sets. The first concerns the nature and timing of the email. One sign is an unexpected email from HR or senior personnel asking for payroll-related changes or information, and these emails often press employees to act quickly or confidentially.

Another sign is a request for personal or financial information that HR, payroll, or management should already have.

The second set concerns the mechanics of the email. The post lists generic greetings such as "Dear employee," spelling and grammar mistakes, and email addresses that do not match the sender's name. It adds that links may go to unfamiliar sites that do not look like the company's official portal.

Defenses the CISO recommends

From the 2023 post:

• Train employees regularly on phishing risks and on not clicking suspicious links.
• Tell employees to communicate payroll changes in person or through a secure, official channel.
• Address password reuse, which the post says can lead to unauthorized access to other accounts, through education and organizational rules for setting and changing passwords.
• Require multiple parties, including the payroll administrator, to verify and approve any request to change direct deposit information.
• Use multifactor authentication, with a username and password followed by a time-based one-time code sent by text message or phone call.
• Set up internal alerts for any changes in bank account details, and train payroll system end users to watch for changes to direct deposit information.

From the 2025 post:

• Set up unique security questions so employees can authenticate themselves when making important changes such as payroll updates.
• Make sure employees do not share their passwords or their answers to those questions.
• Educate the HR team on social engineering calls and train them to authenticate employees properly.
• Train all employees to spot and report phishing emails, vishing voice calls, and smishing text messages.
• Ask the HR system administrator about enabling multi-factor authentication, which the post says helps reduce the impact of compromised credentials.

The common thread

In both posts the target is the HR system login or the HR staff member who can change payroll data. The 2023 post says prevention does not rest solely on employee habits, and it pairs training with process changes such as multi-party approval and alerts.

The 2025 post points readers to CrowdStrike's 2025 Global Threat Report for more on social engineering calls.