Payroll diversion is a fraud in which a criminal changes where an employee's pay is deposited, either by emailing the employer's payroll or HR team while posing as the employee, or by stealing the employee's login to a payroll portal and changing the bank details there, so that the next direct deposit lands in an account the criminal controls. The pay itself does not change, which is why it is hard to catch: the employer sends the right amount to the right name on the usual date, and only the account number is wrong. Under Nacha's rules it is a named example of a payment made under false pretenses, and since 2026 receiving banks must monitor for exactly that. Botminds' ACH Fraud Monitoring catches it where the evidence is plainest, at the bank that receives the credit, by comparing the payroll with where the same employer paid that employee before.
The case traced on this page runs on a fictional sample bank, Tessaly Community Bank, with a fictional employer, employee and sending bank. The warnings and rules quoted come from the FBI, a state attorney general and Nacha, linked where they appear.
One diverted paycheck, from the email to the cash-out, and who could have stopped it at each step
Fraudster · Monday
Emails the employer's payroll team from marcus.hollis@delmarfreight-hr.com, a look-alike of the real domain, asking to change the employee's direct deposit.
Could stop it: The employer: call the employee on a number already on file.
Employer · Monday
Changes the account in its payroll system without calling the employee. The new account is opened on Tuesday through a partner app.
Could stop it: A second person in payroll, with a rule that every account change is checked by another channel.
Payroll file and the sending bank · Before Thursday
The payroll file carries the usual $3,412.66, described PAYROLL, to the new account instead of the old one.
Could stop it: The ODFI or payroll processor: a pay run with account changes in the last few days.
Receiving bank · Thursday, 1:42 a.m.
The credit arrives for an account two days old, from an employer that has paid the same employee elsewhere for seven years.
Could stop it: The RDFI: hold under the funds availability exemption and ask the sending bank.
Mule account · Friday, 9:05 a.m.
A $3,400.00 cash-out is already queued, five minutes after the funds would be available at 9:00 a.m.
Could stop it: Nobody, once the money is out. Every earlier step was a chance.
What is payroll diversion fraud?
It is the redirection of an employee's wages to a fraudster's account by a false change to direct deposit details. The FBI described the login version in 2018: "Once the cybercriminal has obtained an employee's credentials, the credentials are used to access the employee's payroll account in order to change their bank account information", after which deposits are "redirected to an account controlled by the cybercriminal, which is often a prepaid card" (FBI IC3, PSA I-091818-PSA). The FBI added that the fraudster sets rules in the employee's account so that alerts about the change never reach the employee.
The email version needs no login at all. Maryland's Attorney General described it in 2021: the fraudster "will send an email designed to look like it's coming from an employee to human resources, payroll, or the finance department requesting an update or change to that employee's direct deposit information", and the scheme "is often called payroll diversion or third-party payroll fraud" (Maryland Attorney General, consumer alert, October 2021).
Both versions end the same way: an ACH credit, correctly built and correctly authorized by the employer, carrying real pay to the wrong account. Direct deposit is how most pay moves; the ACH Network carried 8.74 billion direct deposits in 2025, worth $16.49 trillion (Nacha, ACH volume statistics), so the scheme has an enormous stream to hide in.
How does payroll diversion happen?
Through one unchecked change. Nacha's advisory group put the mechanism in a sentence: "A great deal of fraud is predicated on a change of account information to redirect a payment" (Nacha, payroll origination checklist). The fraudster does not need to touch the employer's bank, its ACH files or its payroll provider; one request accepted by one person does the rest.
In the sample case the email arrived on Monday from the employer's own domain with "-hr" added to it. Payroll made the change without calling the employee. The payroll file that reached the receiving bank early on Thursday carried his usual pay, to the cent, to an account opened on Tuesday through a fintech partner's app, from a device that had opened two more accounts in other names within 51 hours. By Thursday morning a cash-out of almost the whole amount was queued for five minutes after the funds would become available.
The sample case, Monday to Friday: three days for the fraud to work, one morning to stop it
- Monday to Thursday 1:42 a.m.: email, change, new account, payroll fileabout 3 days
- Held, asked, returned9 h
- Until funds due Friday 9:00 a.m., cash-out at 9:0522 h 30 min
Is payroll diversion covered by Nacha rules?
Yes, by name. Nacha's examples of a credit authorized under false pretenses include a fraudster who "claims to be an employee of an organizations and requests payment to fraudster's account; or, fraudster gains access to organization's payroll system and redirects payroll payments to fraudster's account" (Nacha, October 1, 2024 FAQ). That covers both the email and the login versions. Since 2026 every RDFI must have risk-based procedures to identify credits sent under false pretenses, and every employer that originates payroll by ACH, as a non-consumer originator, must have procedures for the entries it sends.
Nacha added a second tool aimed squarely at this fraud. Since March 20, 2026 originators must use the company entry description "PAYROLL" for PPD credits paying wages and similar compensation, and Nacha says the rule "is intended to reduce the incidence of fraud involving payroll redirections" (Nacha, Company Entry Descriptions). The descriptor is information, not a guarantee: originators and ODFIs "make no representation or warranty to the RDFI or to the Receiver regarding the Receiver's employment status", and an RDFI is not required to act on it.
The diverted payroll credit as the receiving bank saw it in ACH Fraud Monitoring
How can banks detect payroll diversion?
The receiving bank looks for pay arriving somewhere new; the sending side looks for account changes just before a pay run. Nacha's advisory group lists the receiving-side question directly: "Is the account receiving multiple new payroll transactions?" (RMAG, March 2024). Nacha's FAQ for RDFIs points the same way: a run of similar credits in a short time, such as several payrolls, and any such credit into a new, dormant or mule account (Nacha, Phase 2).
Where payroll diversion shows, by who is looking
| Who | What they can see | The check that catches it |
|---|---|---|
| Employer's payroll team | The change request: its sender, its timing, its channel | Confirm any change by calling the employee on a number already on file; a second person approves |
| Payroll provider or ODFI | The pay file: how many employees changed accounts, to which banks, how recently | Flag pay runs with several account changes in a short window, or several employees moved to one new bank |
| Receiving bank (RDFI) | The account: its age, how it was opened, its history, what is queued to leave | Flag PAYROLL credits to accounts under a set age, or pay for one person arriving where another bank had always received it |
| Employee | Their own pay not arriving | Usually too late; the FBI notes fraudsters hide change alerts from the employee |
At the sample bank two rules carry most of it. On the receiving side, a PAYROLL credit to an account under 30 days old; on the sending side, a payroll file with three or more account changes in 48 hours, flagged for the bank's own payroll clients before the file releases. Over 90 days, payroll diversion was the largest confirmed fraud type at the sample bank, 188 of 435 cases. Name checks help less than one might expect: the name on the entry is the employee's, and a fraudster who opens the new account in the employee's name passes a name match.
How do employers prevent payroll diversion?
By treating every change to direct deposit details as a payment instruction, confirmed through another channel and approved by a second person. Nacha's advisory group published a ten-step checklist for payroll origination, and is blunt about its first step.
For this reason, some practitioners advise treating any request to change account information as an attempt to commit fraud.
Nacha Risk Management Advisory Group, A Checklist Approach to Reduce Fraud in Payroll Origination, April 2023
Nacha's sample electronic payroll origination checklist, ten steps
- Authenticate the requestor
When adding or updating a receiver, the payee.
- Confirm the change through a separate channel
Using contact information already known, never the details in the request.
- Verify the account number
Before the first payment to it.
- Verify the routing number
Before the first payment to it.
- Confirm the effective date
Of the transaction.
- Confirm payment-related information
Amounts and details against the pay run.
- Confirm funds in the payroll account
Sufficient to fund the run.
- Obtain approval
For the transaction.
- Initiate the transaction
Only after the checks above.
- A second person confirms and releases
Dual control, which Nacha says has "a renewed relevance in an age of identity theft, imposter fraud, and business email compromise".
The FBI's own advice adds controls on the portal route: "Apply heightened scrutiny to bank information initiated by employees seeking to update or change direct deposit credentials", "Monitor employee logins that occur outside normal business hours", and use separate credentials and two-factor authentication for payroll systems (FBI IC3, 2018). Nacha's 2026 rules make the first of these part of an employer's own obligation: its example of an originator's risk-based procedure is "change controls regarding payment information and instructions for vendor and payroll payments".
Who is liable for payroll diversion?
Nacha's rules do not say, and that is deliberate. Nacha's FAQ states that the 2026 monitoring rules expressly disclaim any change to UCC Article 4A rights and any new duty beyond the commitment to Nacha, so they leave the allocation of liability where other law already puts it (Nacha, Phase 2 FAQ). Who bears the loss between employer and employee, and between the banks, turns on the employment relationship, state law and the agreements each party signed.
What the rules change is the chance of not having a loss at all. Each of the three parties now has its own reason to look: the employer as a non-consumer originator, its bank as ODFI, and the employee's new bank as RDFI. In the sample case the employer, told by its bank, sent a corrected same-day credit to the employee's real account on payday, which is the outcome a quick catch makes possible.
The conversation with the sending bank in ACH Fraud Monitoring, run by an agent and answered by morning
Can a diverted paycheck be recovered?
Often, if someone acts before the funds are spent, and rarely after. The FBI's advice for any fraudulent transfer is to move at once: call the financial institution and ask it to recall the funds, with whatever indemnity the other bank requires (FBI IC3, 2025 report). For an ACH credit the clock is concrete: since September 18, 2026 a non-Same Day credit must be available by 9:00 a.m. local time on settlement date (Nacha).
The tools exist on both sides. The receiving bank can hold a flagged credit under Nacha's false pretenses exemption and return it with R17 QUESTIONABLE within the two-day return window. The sending bank, once the employer reports the fraud, can ask for it back with R06 and an indemnity; the receiving bank may refuse but must answer within ten banking days (Nacha, October 1, 2024). The FBI's Recovery Asset Team, working with banks through its Financial Fraud Kill Chain, froze $679,013,183 of $1,163,919,846 attempted across 3,900 incidents in 2025, a 58% success rate across all fraud types, not payroll alone.
After the money is spent, the fraud becomes a claim. That is why the receiving bank matters most: it is the last party that can stop a diverted paycheck without anyone having to pay it twice. The received credits agent's checks are set out step by step.
Why the receiving bank is the last place it can be stopped
Because after posting, a fraudster's account is a door, and early availability opens it sooner. Nacha's guidance warns that "Offering early funds availability can reduce the time an RDFI has to identify the validity of the payment" (Nacha, 2021), and its advisory group suggests offering early funds only to seasoned accounts and after "the second or third receipt of a regular recurring transaction" (RMAG, 2022). A first payroll into a two-day-old account fails both tests.
The receiving bank also has to protect the person whose pay was stolen, and avoid alerting the one who stole it. In the sample case the employee received a plain message that his pay had gone to a different account after someone asked his employer to change it, and that the employer was paying him on Friday; the holder of the new account saw only that a deposit was under review. Neither message mentioned the referral to the BSA officer.
What each customer sees, previewed before anything is sent
The false pretenses definition sets the legal frame for this fraud, and why an ACH debit filter would not have stopped it is covered on its own page. To run the payroll rules on a bank's own received credits, start from ACH Fraud Monitoring.
Questions people ask
What industries are most targeted by payroll diversion?
In its 2018 announcement the FBI said the institutions most affected were "education, healthcare, and commercial airway transportation". Any employer that lets employees change direct deposit details by email or through a self-service portal is exposed; the scheme depends on the change process, not the industry.
Is payroll diversion a form of business email compromise?
Often. When the change request comes by spoofed or compromised email, it is a form of business email compromise, which the FBI tracks under that heading; when the fraudster uses a stolen payroll login, it is closer to account takeover. The FBI's figures do not report payroll diversion separately, so its share of BEC losses is not published.
How do I know if my direct deposit was changed?
The first sign is usually pay that does not arrive. The FBI notes that fraudsters add rules to the employee's account to suppress direct deposit change alerts, so check the payroll portal itself, report any unexplained change to the employer at once, and ask the employer to confirm future changes by phone.
Does the PAYROLL description stop payroll diversion?
Not by itself. It lets receiving banks see that a credit is pay, so they can spot pay arriving in a new account or several payrolls arriving in one. Nacha does not require RDFIs to act on it, and the descriptor makes no promise about who the receiver is.
Should a bank return a payroll credit without asking the employer?
It may, with R17 QUESTIONABLE, if its monitoring gives it reason to believe the credit was sent under false pretenses; Nacha leaves that to the receiving bank's discretion. Asking the sending bank first, through its registered fraud contact, usually settles it within hours and lets the employer send a corrected payment.