Human Resources Blog

As a Professional Employer Organization, it is our goal here at Delta to keep you updated and informed on privacy and security updates.

The IRS has recently advised us of an increase in fraud attempts aimed at Human Resource departments, specifically involving direct deposit payroll information. This scam in particular tries to trick HR personnel into rerouting direct deposit banking data (i.e., payroll) through phishing emails. Once the money is sent, the company must scramble to replace that stolen money and frantically change all of their banking information.

These fake emails are particularly tricky, because they challenge current malicious content filters due to the fact that they lack the grammar errors and exclamation points that usually trigger email filters. They are well-written and casual, sent from an email address mimicking another employee, and beginning with something along the lines of, “Hey, I need help updating my direct deposit information.”

Not only does this scam squeeze through certain email filters, it also circumvents the typical warning signs you teach your employees about payment fraud. Because these scammers are simply asking to change a bank account number rather than directly requesting money, it’s easy for your employees to miss this as a red flag.

While this scam generates a fraction of the hundreds of thousands generated by typical payment frauds, it is expected to grow because of how easy and cheap it is to implement.

A similar type of phishing scam targets company bookkeepers by spoofing the CEO’s email address and asking for help making a payment. Unfortunately, one of our clients fell victim to this scam, and their controller wired out almost $20,000 before realizing it was a fraudulent request. Thankfully, they were able to get their money back, but that is rarely the case.

We keep this client and all of our clients safe from scammers targeting HR personnel, because we handle their payroll and have many layers of security specifically designed to prevent payroll scams.

Protecting Your Company

We urge you to take the proper precautions so that your company does not wind up being the next victim. Here are a few steps you can take to keep your company safe:

• Create a procedure for investigating and reviewing any change requests regarding finances, and make it a company-wide policy to stop accepting change requests from anyone via email.
• Implement Natural Language Processing (NLP) software that will analyze and flag any email content that may sound “urgent.”
• Rather than reply to the email in question, forward it to the actual email address that you have on file for the employee and follow up with a phone call to confirm the request.
• Contact the requesting employee via phone call to validate the request.

Outsourcing your payroll and HR to a Professional Employer Organization (PEO) is an even better way to protect yourself against direct deposit payroll fraud. Let us shoulder the burden for you. Contact us today to learn how Delta Administrative Services can protect your company from email scammers that are targeting your business and your employees.