Fight Payroll Direct Deposit Fraud

Fraudsters may attempt to re-route electronic payroll deposits to themselves through fraudulent requests to change the destination account. This could occur in an email purporting to be from an employee. They may also use a fraudulent direct depository change request form.

It is important to be aware of this threat. You can protect your payroll system with internal controls. Here are some specific controls to consider:

• Verify each request by contacting the employee directly -- in person, or using a phone number you can rely on.

• Require the employee to turn in an original signed ACH form. Do not accept electronic forms.

• Remove ACH forms from the internet. Only send them to an internal or external address already on file.

• On an ACH form, require that the employee to provide the previous bank routing and account number for verification.

• Require multiple approvals for each change.

For additional information, see the League of Minnesota Cities Electronic Funds Transfer Fraud. You can also read the GFOA publication Bank Account Fraud Prevention.

Date this Avoiding Pitfall was most recently published: 10/16/2026