Year-End Payroll Scam: What Employers Need to Know

Year-end payroll scams are fraud schemes timed to the closing weeks of the calendar year and the opening weeks of the next, when payroll functions are handling bonuses, final runs, tax document preparation, and benefits transitions simultaneously. The timing is deliberate: attackers target the period when payroll staff are busiest, deadlines are hardest, and unusual transactions are most plausible.

Nothing about the techniques is novel. What changes is that the conditions that normally make a fraudulent request stand out are temporarily absent.

Why the season works

Three conditions combine. Volume rises sharply, so each transaction receives less scrutiny. Genuinely unusual activity is routine — off-cycle bonus runs, corrections, adjustments — so an anomalous request does not look anomalous. And staffing is thin, with holiday absences meaning approvals are handled by people covering unfamiliar territory.

That third factor is the most exploitable. A covering employee does not know what the absent person's normal looks like, has no baseline against which to judge a request, and is reluctant to hold something up over an uncertainty during someone else's absence.

The recurring schemes

Bonus payment fraud. A request to add or redirect a bonus payment, often framed as a correction to an omission. Bonus runs are already exceptional, so an additional entry attracts less attention than it would in a regular cycle.

Banking changes before the final run. A concentration of direct deposit change requests ahead of the last payroll of the year, frequently combined with the urgency of not wanting to miss a year-end payment.

W-2 data requests. The seasonal peak of executive impersonation aimed at obtaining employee tax data, beginning as soon as W-2 preparation starts and running through the filing season.

Benefits and open enrollment scams. Messages directing employees to fraudulent enrollment portals to harvest credentials and personal data, timed to coincide with genuine enrollment communications.

Vendor payment changes. Requests to update supplier banking details ahead of year-end payment runs, exploiting the same volume and urgency dynamics.

Fake year-end adjustments. Requests for corrections, retroactive adjustments, or reconciliation entries that are plausible only because such entries genuinely occur at this time.

The coverage problem

The single most exploitable weakness in the season is delegation of approval authority to people without context. Two practices address it directly.

First, coverage arrangements should be documented in advance — who is covering what, with what authority, and what falls outside their scope. A covering employee should know that certain transaction types are not theirs to approve regardless of urgency.

Second, and more important, verification requirements do not relax during coverage. The standing rule that banking changes are verified out of band applies identically whether the usual approver or a substitute is handling it. Where coverage arrangements quietly suspend controls because the covering person does not know they exist, the season becomes an open window.

Preparation ahead of the period

• Brief payroll, HR, and finance staff before the season on what to expect, since the schemes are predictable
• Document coverage arrangements including what authority substitutes hold and what they must escalate
• Confirm that verification requirements apply during coverage, in writing
• Consider a freeze on banking changes for a defined window around the final run, with changes taking effect in the new year
• Require dual approval for all off-cycle and bonus payments during the period
• Communicate to employees what legitimate enrollment and payroll communications will look like, and what the organization will never ask
• Schedule the final run with enough margin that reconciliation is possible rather than skipped

The banking change freeze is worth considering specifically. It removes the highest-risk transaction type from the highest-risk period at minimal cost, since a change taking effect in January rather than late December affects almost nobody materially — and an employee genuinely inconvenienced can be handled as a verified exception.

Reconciliation is what closes the year

The pressure to finish creates the temptation to skip the review, which is precisely inverted from where the risk sits. The year-end run is the one most worth reconciling: highest volume, most exceptions, thinnest staffing.

The checks that matter are the standard ones applied with more care — banking changes since the last cycle confirmed as verified, payroll additions matched against actual hires, bonus entries traced to approved decisions, duplicate bank accounts across employees, and totals compared against expectations with variances explained before release rather than after.

Scheduling the run to leave time for this is a planning decision made weeks earlier. A reconciliation that happens only when there is time will not happen in the period when it matters most.

Employer's Guardian helps employers prepare payroll operations for high-volume periods, including coverage planning, approval requirements, and reconciliation practices, through payroll services.

This article provides general educational information, not legal, tax, or insurance advice. Requirements vary by location, industry, and the data your organization handles.