$8.3 million. <\/p>\n\n\n\n
This number represents the total reported losses<\/a> due to payroll diversion schemes that were reported to the FBI\u2019s Internet Crime Complaint Center (IC3) between Jan. 1, 2018 and June 30, 2019. This form of payroll fraud also sometimes falls under the category of business email compromise (BEC) scams because the criminals commit these crimes using email as their method of choice. <\/p>\n\n\n\n Payroll fraud is a major \u2014 and often overlooked \u2014 threat to\nbusinesses and their employees. The FBI\u2019s data indicates that the average\ndollar loss reported per complaint was $7,904. But again, these numbers just\ninclude the reported<\/em> losses \u2014 they don\u2019t include those that haven\u2019t been\nreported or have yet to be discovered. <\/p>\n\n\n\n But what exactly is payroll fraud or a payroll diversion\nscam? And why are these types of fraud a growing issue for businesses and\nemployees alike?<\/p>\n\n\n\n Let\u2019s hash it out.<\/span><\/p>\n\n\n<\/span><\/span>\n\n\n What\u2019s payroll fraud? Well, the answer depends on whom you\nask. Many people define it differently. In the most general terms, payroll\nfraud is any type of fraud that involves the theft of a company\u2019s money using\nthe payroll system. Payroll fraud often targets people who work in human\nresources, payroll, finance, as well as tax professionals. <\/p>\n\n\n\n Much like donuts, payroll fraud comes in multiple flavors. Payroll\nfraud can <\/p>\n\n\n\n Let\u2019s look at each of these categories more in depth.<\/p>\n\n\n\n We\u2019ll start by discussing a type of payroll fraud that\u2019s committed\nby employers (corporations, organizations, etc.) themselves: worker\nmisclassification. <\/p>\n\n\n\n This type of crime involves a company or supervisor\nintentionally misclassifying employees to avoid workplace laws and paying\ncertain costs (such as payroll taxes and workers\u2019 compensation insurance). This\nillegal practice often involves classifying employees as independent\ncontractors instead of employees. This deprives the employees of their right\nand protections under the law. <\/p>\n\n\n\n A\nstudy<\/a> by Harvard University shows that 17 of the surveyed states report\nhaving laws that specifically address and\/or establish penalties for\nmisclassifying employees. And in some states, such as Alaska, misclassifying a\nworker is both a civil and criminal liability. Some will impose financial\npenalties against organizations that intentionally and knowingly misclassify a\nworker as an independent contractor. <\/p>\n\n\n\n Now, we\u2019re not here to discuss the rights and wrongs of\nthese types of practices by businesses and organizations. We\u2019re just trying to\nshed some light on the different types of payroll fraud that exist \u2014 both those\nthat relate and don\u2019t necessarily relate to the cyber security industry in\nparticular. But, let\u2019s move on to our second category of payroll fraud \u2014 the\ntypes of payroll scams that involve an organization\u2019s employees doing bad\nthings on their own. <\/p>\n\n\n\n These types of scams involve everything from simply changing\npayment information to creating entire false employee profiles. Here are three\nof the most common types of employee payroll fraud:<\/p>\n\n\n Although timesheet fraud can occur by accident \u2014 should an\nemployee simply forgetting to clock out at lunch or at the end of their workday\n\u2014 there are cases in which employees intentionally neglect to clock out to rack\nup hours for time they don\u2019t work. This is the difference between being\ninvolved in an accidental situation and committing an intentional crime. <\/p>\n\n\n\n This third and final category of payroll fraud is one that\u2019s\nof particular interest to us. Third-party payroll scams, more specifically W2\nscams and payroll diversion schemes, are often committed by unrelated third\nparties who use phishing\ntactics<\/a> while targeting payroll or human resources personnel. <\/p>\n\n\n\n The first tactic is used to get the victim to provide\nsensitive personal and\/or financial information. The second aims to get them to\ntransfer money. <\/p>\n\n\n\n Either way, both forms of phishing<\/a> have a single overarching goal: to get the intended victim to perform some type of action through the use of social engineering tactics<\/a>. <\/p>\n\n\n\n This is the type of tactic you often read about just before\nthe start of tax season. This type of crime occurs when a cybercriminal\nattempts to gain access to another person\u2019s W-2 information \u2014 including their name,\naddress, Social Security number, income, and withholdings \u2014 so they can either\nsell it or use it to file fraudulent tax returns. They can do this by contacting\nvictims directly or by reaching out to companies HR or payroll personnel to get\nthis information for their organizations\u2019 workforces.<\/p>\n\n\n<\/span><\/span>\n\n\n This type of direct\ndeposit scam<\/a> involves a criminal sending an email to an employee in an\norganization\u2019s payroll, HR or finance department. The email is designed to look\nlike it\u2019s coming from an employee \u2014 often an executive \u2014 and asks the target to\nupdate or change their direct deposit payroll information. They provide new\nbank account and routing information to an account that the criminal controls. <\/p>\n\n\n\n However, payroll diversion scams don\u2019t always involve a\ncriminal reaching out to payroll or HR. Other methods of payroll diversion\nschemes involve the criminals either:<\/p>\n\n\n\n With both W-2 and payroll diversion fraud, the employees \u2014\nand their employers \u2014 are often on the losing end of these situations.<\/p>\n\n\n\n Both types of schemes can also technically fall under the category\nof employee payroll fraud because dishonest employees can simply do the same\nactions to benefit themselves and don\u2019t necessarily require a third-party\naccomplice. However, they\u2019re becoming common tactics used by cybercriminals who\nare unrelated to the company and simply want to make a quick buck. <\/p>\n\n\n\n If only these criminals took all of their creativity and\ndetermination and applied those traits to things that would be both productive\nand beneficial for society\u2026<\/p>\n\n\n\n If only. <\/p>\n\n\n\n With all of this in mind, what does a payroll diversion scam\nlook like?<\/p>\n\n\n\n At The SSL Store, we\u2019re no strangers to phishing emails and\ntactics. In fact, we receive many emails from people pretending to be our CEO\nand vice presidents. We also receive phishing emails targeting members of our\ncustomer experience team in more personal contexts. <\/p>\n\n\n\n Some of these phishing emails include payroll fraud tactics.\nTake a look at the payroll diversion scheme email that our office manager\n(Nellie) received just a couple of months ago from someone posing as one of our\nvice presidents, Kyle: <\/p>\n\n\n\n If Nellie was in a rush or wasn\u2019t paying full attention when\ngoing through her inbox, she may not have noticed one small yet important\ndetail on the email: the \u201cfrom\u201d address field. Paying attention to this\ncomponent is key for detecting whether an email is legitimate. If she simply\nlooked at the sender\u2019s display name in her inbox without checking the email\naddress itself when she opened the email, she may not have noticed that the\nemail came from \u201ccf90910@cox.net\u201d instead of Kyle\u2019s official thesslstore.com\nemail account.<\/p>\n\n\n\n Thankfully, Nellie is educated on cyber security best practices\nand how to recognize phishing emails. This is why employee cyber awareness\ntraining is so crucial to the safety and financial security of\norganizations. <\/p>\n\n\n\n Still not convinced that payroll fraud \u2014 or, more\nspecifically, a payroll diversion scam \u2014 is a big deal? Let\u2019s paint a more detailed\npicture to provide some clarity. <\/p>\n\n\n\n It\u2019s Monday morning and your human resources team is playing\ncatch-up with the emails from over the weekend. Among the many messages that\nMichael, the payroll administrator, received is an email request from Bob in marketing.\nThe email states that Bob just signed up for a new bank account with a new\nbank, and he wants to transfer his payroll direct deposit from his existing\naccount to the new one. <\/p>\n\n\n\n Sure, no problem.<\/p>\n\n\n\n As the efficient employee you hired him to be, Michael\nimmediately sets to updating Bob\u2019s payroll information to reflect the change in\nhis account. After all, he wants to ensure that Bob\u2019s next bi-weekly paycheck is\nsent to the new account without delay. Once the update is made, Michael sends a\nresponse email to Bob to confirm the change. Bob thanks him, and that\u2019s\nseemingly the end of it.<\/p>\n\n\n\n Fast forward a month, and Bob sends another email to the\nhuman resources team. This time, he is inquiring about why he has not received\nhis last two paychecks. Figuring there must have been a mistake with the account\nnumber, Michael goes back and verifies the account information with the\ninformation Bob\u2019s first email included. The account information matches, but\nsomething else doesn\u2019t: the \u201cfrom\u201d field of the email address. Although the\nemail appears to be from \u201cBob Matthews,\u201d the actual email address is from an\nunrelated Yahoo account (surferdudesr0xi0rs@yahoo.com). <\/p>\n\n\n\n Cue the pit that\u2019s forming in Michael\u2019s stomach \u2014 and yours.<\/p>\n\n\n\n When Michael reaches out to the bank to reverse the payments,\nhe\u2019s told that it\u2019s too late: the new account that the two paychecks were sent\nto is closed, and the money \u2014 as well as the criminal who stole it \u2014 is long\ngone. <\/p>\n\n\n\n The Association of Certified Fraud Examiners<\/a> (ACFE) estimates that 5% of businesses\u2019 annual revenue is lost to employee fraud and abuse. While this may sound relatively minor, consider this: <\/p>\n\n\n\n \u201cWhile this number is only a general estimate based on the opinions of the CFEs who took part in our study, it represents the collective observations of more than 2,000 anti-fraud experts who together have investigated hundreds of thousands of fraud cases.<\/em> To place their estimate in context, if the 5% loss estimate were applied to the 2017 estimated Gross World Product of USD 79.6 trillion, it would result in a projected total global fraud loss of nearly USD 4 trillion.\u201d<\/em><\/p>\n<\/blockquote>\n\n\n\n Now, we\u2019re talking about potentially substantial financial\nlosses. But it doesn\u2019t stop there. In the case of the payroll diversion scenario\nwe described, not only is your company now out the money that was stolen, but\nnow you also need to pay Bob for the paychecks he never received. Furthermore, your\ncompany may suffer reputational damage as a result with other employees and\nprospective employees if word gets out about the incident. Not to mention, you\nmay have to deal with any legal issues and fines that may result from the\nsituation. <\/p>\n\n\n\n Now, imagine if this type of scenario happened on a much\nlarger scale, involving several \u2014 or, worse, all<\/em> of your employees. Not\nonly would it be a logistical, financial, and reputational nightmare, but it\ncould potentially put you out of business if you don\u2019t plan and prepare for\nsuch a situation. <\/p>\n\n\n\n Earlier this year, nearly half a million dollars<\/a> was diverted from the payroll of employees who work in Tallahassee, Florida. In this case, the cybercriminals who performed the attack actually hacked into the city\u2019s direct deposit payroll system. <\/p>\n\n\n\n In Butler County, Ohio, several local government offices<\/a> were repeatedly targeted by payroll scammers. Some employees\u2019 direct deposits were changed to fraudulent accounts, and multiple duplicated checks worth more than $7,000 each were generated by the scammers as well. <\/p>\n\n\n\n The biggest case to occur recently, however, involves MyPayrollHR<\/a>, a now-defunct cloud payroll provider based out of New York. The company\u2019s CEO, Michael T. Mann, was arrested and charged with bank fraud. He reportedly admits to stealing an estimated $70 million in payroll and tax deposits from customers. <\/p>\n\n\n\n When it comes to preventing or combatting the most common\ntypes of payroll fraud, strict policies, meticulous audits, and diligent\nmanagement play important roles. Another thing that also has a major impact is\nmandatory regular cyber awareness training for employees. <\/p>\n\n\n\n As criminals become more creative, it\u2019s up to all of us to\nbecome more vigilant. It\u2019s crucial to not only stay informed but to also be\nprepared for the worst by having mechanisms and protocols in place to aid in\nboth response and recovery from such incidents \u2014 no matter how big or small. <\/p>\n\n\n\n As always, leave any comments or questions below\u2026<\/em><\/p>\n\n\n\n Updated on March 25, 2021<\/em><\/p>\n\n\n\n The FBI reports that direct deposit change requests increased more than 815% in 1.5 years Note: This article, which was originally published in 2019, has been updated to include related…<\/p>\n","protected":false},"author":17,"featured_media":11637,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[16,10200,13114],"tags":[11269,11186,11268],"class_list":["post-11634","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hashing-out-cyber-security","category-monthly-digest","category-updated","tag-bec","tag-fraud","tag-payroll-fraud","post-with-tags"],"views":24515,"jetpack_featured_media_url":"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/10\/PayrollFraud-1.png","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/11634","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=11634"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/11634\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media\/11637"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=11634"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=11634"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=11634"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}6 Types of Payroll Fraud Causing Headaches <\/h2>\n\n\n\n
\n
Employer Payroll Fraud <\/h3>\n\n\n\n
Employee Payroll Scams<\/h3>\n\n\n\n
![\"\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/10\/PayrollFraudTimesheet.png\")
<\/figure>\n<\/div>\n\n\n\n
Third Party Payroll Fraud \u2013 How Phishers Are Stealing Payroll Funds<\/h3>\n\n\n
![\"80](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/04\/Feature-80-facts-1-1024x624.jpg\")
<\/figure>\n<\/div>\n\n\nW-2 Phishing Scams<\/h4>\n\n\n\n
Payroll Diversion Scams<\/h4>\n\n\n\n
\n
A Real-World Example of a Payroll Diversion Scheme<\/h2>\n\n\n\n
![\"\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/10\/PayrollFraud.png\")
<\/figure>\n\n\n\nWhy Payroll Diversion Schemes and W2 Scams Are Such a Big Deal<\/h2>\n\n\n\n
What All of This Means for Your Organization<\/h3>\n\n\n\n
\n
Examples of Recent Payroll Diversion Scams<\/h3>\n\n\n\n
How You Can Prevent Payroll Fraud and Phishing Payroll Scams<\/h2>\n\n\n\n
\n
Recent Related News<\/h2>\n\n\n\n
\n