BEC Payroll Diversion

How BEC Payroll Diversion Works

BEC payroll diversion is not a technical exploit so much as an identity-and-process fraud. The attacker relies on a believable request, a trusted communication channel, and a payroll or HR workflow that can be manipulated without strong verification.

The scheme usually succeeds when a payment change looks routine enough to bypass suspicion. That can include a new bank account request, a “corrected” direct-deposit form, or an urgent message that appears to come from the employee, executive, or an internal intermediary.

Why Payroll Diversion Is So Effective

This fraud works because payroll changes often involve time pressure, privacy concerns, and a culture of helping employees quickly. Attackers exploit those conditions to create a sense of urgency and reduce the chance that staff will pause to verify the request through an independent channel.

It is especially effective when organizations treat email content as proof of identity. If the workflow accepts instructions from a compromised mailbox, a look-alike address, or a forged message without secondary verification, the attacker only needs one convincing interaction to reroute pay.

Where Exposure Usually Appears

Exposure is often found in the handoff between email, HR, and payroll systems. Weak mailbox protection, permissive inbox rules, shared administrative access, and informal approval paths can all make a fake change request look legitimate.

Broadly, the same weakness can also appear in vendor or contractor payment processes, where changing bank details is common and the normal business context makes anomalies harder to spot. When payroll instructions are accepted from a single message thread, the fraud path becomes much easier to sustain.

What Successful Defense Depends On

Stopping BEC payroll diversion depends on separating identity verification from the request channel. A payroll team should be able to confirm that a change is genuine without relying only on the email account or message content that delivered it.

That means using out-of-band confirmation, strict change control, and clear ownership for approving payment updates. It also means recognizing that the strongest defense is procedural, not just technical, because the attacker is trying to exploit trust in routine business handling.

Risk and Threat Considerations

Payroll diversion is high impact because it directly targets compensation, trust, and employee confidence. The same technique can also expose broader financial controls if the attacker learns how internal approval paths work and reuses that knowledge for later fraud.

Failure mechanism: The attacker obtains or mimics a trusted identity, then pushes a payment-detail change through a workflow that does not independently validate the requestor or the banking destination.

Impact: Salary payments are redirected, remediation becomes difficult once funds move, and the organization may also need to investigate mailbox compromise, false approvals, and any related account or payment abuse.

Practitioner Guidance

Why practitioners should care: Payroll diversion is a workflow-control problem as much as a phishing problem. If payroll teams cannot distinguish a legitimate change from a convincing impersonation, the organization has a preventable fraud exposure.

What to watch for: Sudden bank detail changes, urgent confidentiality requests, slight changes in sender identity, and instructions that try to bypass normal review are all warning signs. A request that asks for secrecy or speed deserves extra scrutiny, not less.

Practitioner takeaway: Treat payment-detail changes as high-risk events and require a verification step that does not depend on the same channel used to submit the request.

Related resources from NHI Mgmt Group

• Guide: Email Identity and BEC Guide
• How should organisations reduce the risk of BEC payroll diversion scams in payroll operations?
• How should security teams reduce the impact of lateral phishing, invoice fraud, and payroll diversion as attackers target human behaviour instead of technical flaws?
• What should organizations do when a BEC-style request targets payroll or direct deposit changes?
• Why do payroll diversion scams succeed even when emails contain no malicious links or attachments?