Swipeclock

Don't Fall Victim to Payroll Phishing Scams

The article warns that payroll phishing scams, a form of business email compromise where fraudsters impersonate employees or executives to steal direct deposit details, W-2 forms, or initiate fraudulent wire transfers, are increasingly targeting HR departments, and advises business service providers to educate clients on recognizing these sophisticated, often grammatically correct emails to protect their companies from significant financial losses.

Email scammers are defrauding companies by targeting Human Resources. As a business services provider, you can help your clients protect their companies.

Let's talk about HR and payroll scams.

The FBI calls this type of fraud business email compromise (BEC) or business email spoofing (BES). Businesses lose over $12.5 billion to fraud every year. Furthermore, the FBI says payroll email phishing is increasing.

How Do HR Scams Work?

Unfortunately, these schemes are easy to carry out. The fraudster creates an email account under someone else’s name. They can find a treasure trove of information on LinkedIn. It’s not hard to register an email with a name nearly identical to an employee at the targeted company.

They don’t need to penetrate security or hack into an email account. To make things worse, it’s also easy for hackers to automate the creation of thousands of accounts in a few minutes.

Types of Payroll Phishing Emails

The most common phishing emails aim to:

  • Get direct deposit information so they can re-route paychecks to scammer-controlled bank accounts.
  • Obtain W-2s so the scammer can file tax returns and receive tax refunds under victims’ names.
  • Initiate a wire transfer which is routed into a scammer-controlled bank account.

The FBI says the emails rarely have the incorrect spelling or grammar common to ‘Nigerian prince’ type scams.

Here is an example email from a fraudster posing as a staff member:

To: Brittney Williams

Subject: Direct Deposit Update Request

Brittney,

Can you update my direct deposit? I just changed bank accounts. I would appreciate it before next payroll.

Thanks!

Instruct employees to be aware that some emails purport to come from the CEO or CFO. They are directed to HR personnel or accountants who initiate wire transfers.

Protect Your Employees

Help your clients understand the importance of fraud prevention including the following:

  1. 1.Teach employees to look closely at email addresses and compare with correct ones.
  2. 2.Instruct employees to never answer an email on their mobile phone when they can only see the sender’s name without the email address.
  3. 3.Use WorkforceHub with an employee self-serve (ESS) portal so staff members can manage their own direct deposit information.
  4. 4.Don’t publish names of HR personnel online.
  5. 5.Update email spam filters to flag these types of emails.

How do I Report a Scam Email?

Swipeclock offers WorkforceHub, the Human Resources Management System (HRMS) that makes it easy to optimize the performance of managers, employees, and business operations.

Contact us today to request a demo.

Or are you interested in becoming a reseller? Check out the Swipeclock Partner Program now.

Related