A suspicious payroll change is any modification to payroll records that warrants review before it takes effect. Recognizing them is the practical skill behind most payroll fraud prevention, because nearly every scheme requires a change to be accepted — and the changes that matter share recognizable characteristics.
The value of naming these patterns is that it converts vigilance into something teachable. An employee told to be careful will apply inconsistent judgment. An employee given a list of specific patterns will catch them reliably.
Banking changes near a processing deadline. Legitimate changes arrive at random times. Fraudulent ones cluster in the final day or two before payroll closes, because the attacker needs the change applied before scrutiny and needs funds to settle before the employee notices.
Banking changes bundled with contact changes. An attacker who updates the phone number or email alongside the bank account is defeating future verification and suppressing the notification that would alert the real employee. This combination is a strong indicator and should never be processed as a single routine update.
Requests routed outside the normal channel. An employee who has always used the self-service portal suddenly emailing HR, or a request arriving to someone who does not normally handle changes, indicates either an attacker or a genuine employee who cannot access their account — and the second possibility is itself worth investigating.
Reluctance to be contacted. A requester who avoids a phone call, provides a new number rather than accepting a call to the number on file, or explains why verification is unnecessary is exhibiting the single clearest signal available.
Multiple employees, same account. Two or more employees whose pay routes to the same bank account is either an error or a scheme. It is invisible in totals and requires a specific check.
Additions that do not match hires. A new payroll record without a corresponding onboarding file is the signature of a ghost employee.
Off-cycle and manual entries. These bypass normal controls by design, which makes them the preferred route for anyone working around the process.
Compensation changes without approval records. An adjustment that cannot be traced to an approved decision warrants explanation regardless of size.
Changes to accounts of employees on leave. Someone on extended leave is less likely to notice a diverted payment quickly, which makes their records attractive.
Clustered requests. Several banking change requests across different employees within a short period suggests a campaign rather than coincidence.
Most flagged changes are legitimate. Employees do switch banks before payday, do sometimes email instead of using the portal, and do occasionally update several details at once because they moved.
This matters because the response to a suspicious change is verification, not accusation. The employee should experience a routine confirmation call, not an interrogation. Framing verification as standard practice applied to everyone — communicated to the workforce in advance so they expect it — keeps the control sustainable and avoids the friction that causes staff to stop applying it.
Treating flags as accusations produces two failures: employees resent the process, and staff become reluctant to raise them.
Several of these patterns can be surfaced by the system rather than depending on someone noticing:
The change report reviewed before each run is the highest-value item. It requires no detection sophistication — only a list of what changed and someone asking whether each entry makes sense.
The response sequence is straightforward: hold the change rather than processing it pending review, verify through a channel already on file rather than anything supplied in the request, confirm with the employee that they made the request, document the verification, and process it once confirmed.
Where verification fails or cannot be completed, the change should not proceed. This is the point at which pressure appears — the deadline, the insistent follow-up, the explanation for why a call is not possible — and it is precisely why the rule needs to be absolute rather than subject to judgment in the moment.
If fraud is confirmed, the scope is rarely a single employee. Checking whether similar requests reached others, and whether the employee's email account was compromised, usually matters more than the individual transaction.
Employer's Guardian helps employers build detection and verification practices into payroll operations through payroll services.
This article provides general educational information, not legal, tax, or insurance advice. Requirements vary by location, industry, and the data your organization handles.