Would you notice if someone changed an employee’s direct deposit today?

It’s Thursday afternoon. Your payroll admin gets an email from a top performer asking to switch her direct deposit before a big bonus hits. It looks legit and sounds like her, so nobody picks up the phone to check.

That exact scenario played out with one of our clients last year. The email came from a hacked account, and roughly $80,000 was on its way to a fraudster’s bank before our team flagged the transaction and stopped it on behalf of our client.

October is Cybersecurity Awareness Month, which makes it the right time to ask a hard question: if someone came after your payroll tomorrow, would they get through?

Fraud Got a Lot Smarter This Year

In our March webinar, How to Outsmart the Next Wave of Payroll Cyber Fraud, CommPayHR Founder and President, Jeff Plakans, sat down with Steve Lenderman, Head of Fraud Prevention at our platform partner isolved. Steve has spent more than 25 years fighting financial crime, and his message was blunt: AI has made fraud faster and far more convincing.

The clumsy, typo-filled scam emails are gone. Today’s attacks are researched. Criminals scrape LinkedIn and social media, then write messages that sound like your own team. Some clone a voice from a few seconds of audio and leave a voicemail from “the CEO” demanding an urgent wire.

Payroll sits right in the crosshairs. Steve shared that business email compromise aimed at payroll diversion is one of the fastest-growing fraud types reported to the FBI’s Internet Crime Complaint Center. And attackers time it for when you’re distracted, like a Friday afternoon or even the day before your payroll admin leaves on vacation.

Simple Habits That Stop Most Attacks

Steve’s advice came down to a handful of habits to ensure your safety that any employer can start this month:

• Verify every banking change by phone. Call the employee at a number you already have on file, never one listed in the request. This one step would have stopped the scam above cold.
• Upgrade your multi-factor authentication. Email and text codes beat nothing, but authenticator apps are stronger, and passkeys are the gold standard.
• Trim who has access. Review who can touch payroll and HR data, and remove anyone who no longer needs it, including former employees.
• Agree on a code word. One attendee shared that their team uses a verbal passphrase to confirm any urgent money request. Low tech, highly effective.

Training matters too, but skip the click-through slideshow. Talk with your people about real examples. As Steve pointed out, an alert employee with a gut feeling still catches more fraud than most software.

Where Cyber Insurance Fits

Even great habits can’t promise you’ll never be hit. That’s where cyber liability insurance comes in, which we broke down in Is Cyber Liability Insurance Worth It for Your Business?

A solid policy can help cover breach response, system recovery, legal requirements and notifying affected employees. Small businesses often pay $1,000 to $7,500 a year for $1 million in coverage, a fraction of what one incident can cost.

Here’s the catch: insurers expect you to do your part. Many policies won’t pay for losses tied to preventable gaps like weak passwords or loose access controls. So the habits above aren’t just good security. They’re what keeps a future claim from getting denied.

Protect Your Payroll This October

Security works best as a partnership. CommPayHR clients run on isolved People Cloud, backed by more than 3,500 isolved cybersecurity experts and a dedicated team that knows your business well enough to notice when something looks off. That attention is exactly what saved our client $80,000.

Want the full picture? Watch the webinar on demand and read our cyber insurance guide. Then, when you’re ready to talk about how your payroll is set up, let’s get into it.