How should universities stop direct deposit fraud when credentials are stolen?

Universities should require step-up identity verification at the point where bank details change, not only at login. That means stronger proof of personhood, account ownership checks, and contextual risk scoring before any payroll or refund reroute is approved. Passwords alone are not enough once credentials can be phished or reused.

Why This Matters for Security Teams

Direct deposit fraud is a payroll fraud problem, but it often begins as an identity problem. Once a university account is phished, reused, or session hijacked, an attacker does not need to defeat the login banner again. They only need a weak change-control path for bank details, refunds, or student payout reroutes. Current guidance from NIST SP 800-63 Digital Identity Guidelines supports stronger identity proofing at sensitive transactions, not just at sign-in. That is consistent with NHIMG’s analysis of 52 NHI Breaches Analysis, which shows how compromise often spreads from one valid credential into downstream abuse when controls are too static.

Universities are especially exposed because payroll, HR, registrar, bursar, and student systems often sit in separate workflows with inconsistent verification. Attackers exploit that separation by moving from email compromise to self-service profile changes, then to payment diversion. Password resets alone rarely stop this because the attacker already has a valid session or a reused credential. In practice, many security teams encounter direct deposit fraud only after funds have already been redirected, rather than through intentional change verification.

How It Works in Practice

The control objective is simple: treat bank detail changes as high-risk events that require step-up verification, independent approval, and auditability. That means the institution should not rely on the same authentication used for routine portal access. Instead, the transaction should be evaluated at runtime using identity assurance, device context, location, and change history before the update is accepted.

For universities, the most effective pattern is layered verification:

• Require a second factor or out-of-band challenge at the moment of bank account change.
• Verify account ownership, such as a match on payroll name, micro-deposit validation, or institution-approved bank verification service.
• Use risk scoring to flag first-time changes, unusual geolocation, impossible travel, or rapid follow-on edits.
• Route high-risk changes to human review before payment cutoffs.
• Maintain immutable logs so finance, HR, and security can trace who approved what and when.

This is also where identity governance needs to move beyond static access control. If the attacker is operating from a stolen session, the right question is not only “who logged in” but “should this specific change be allowed right now?” That is why OWASP Non-Human Identity Top 10 is useful even outside pure NHI contexts: it emphasizes the danger of over-trusting credentials without lifecycle controls. NHIMG’s Guide to the Secret Sprawl Challenge similarly highlights how weak credential handling tends to cascade into broader abuse once one account is compromised.

Where institutions do this well, bank change requests are treated like wire transfers, not profile edits. These controls tend to break down when finance and IT own different parts of the workflow because no single team is accountable for the final approval gate.

Common Variations and Edge Cases

Tighter verification often increases user friction and payroll support volume, so universities must balance fraud reduction against employee experience and urgent payment needs. Best practice is evolving on how much step-up is enough for low-risk changes versus high-risk ones, and there is no universal standard for this yet.

Some campuses will use the same process for employees, student workers, and refund recipients, but the risk profile is not identical. Student refund fraud often clusters around high-volume self-service portals, while staff payroll fraud may involve HR systems and vendor-managed workflows. A practical control set should therefore distinguish between first-time bank changes, edits to existing accounts, and emergency exceptions.

Another edge case is account takeover without password change. If an attacker uses a valid browser session, the institution may never see a failed login. That is why current guidance suggests pairing step-up verification with conditional access, device reputation, and post-change notification to a separate channel. When possible, require confirmation from the previously enrolled contact method before any payout reroute is finalized.

For broader identity hygiene, NHIMG’s Ultimate Guide to NHIs — Static vs Dynamic Secrets reinforces a principle that applies here too: short-lived, context-aware trust is safer than long-lived, reusable access. In the same spirit, the fastest way to reduce direct deposit fraud is to stop treating a bank change as a routine update.

Related resources from NHI Mgmt Group

• Who is accountable when stolen credentials from a phishing email are used for fraud?
• How should organisations stop auto-sync from turning desktops into repositories of credentials?
• Why do stolen credentials create so much more risk when identity is poorly governed?
• Why do early-stage hiring checks often fail to stop onboarding fraud?