Year-end payroll scams are fraud schemes timed to the closing weeks of the calendar year and the opening weeks of the next, when payroll functions are handling bonuses, final runs, tax document preparation, and benefits transitions simultaneously. The timing is deliberate: attackers target the period when payroll staff are busiest, deadlines are hardest, and unusual transactions are most plausible.
Nothing about the techniques is novel. What changes is that the conditions that normally make a fraudulent request stand out are temporarily absent.
Three conditions combine. Volume rises sharply, so each transaction receives less scrutiny. Genuinely unusual activity is routine — off-cycle bonus runs, corrections, adjustments — so an anomalous request does not look anomalous. And staffing is thin, with holiday absences meaning approvals are handled by people covering unfamiliar territory.
That third factor is the most exploitable. A covering employee does not know what the absent person's normal looks like, has no baseline against which to judge a request, and is reluctant to hold something up over an uncertainty during someone else's absence.
Bonus payment fraud. A request to add or redirect a bonus payment, often framed as a correction to an omission. Bonus runs are already exceptional, so an additional entry attracts less attention than it would in a regular cycle.
Banking changes before the final run. A concentration of direct deposit change requests ahead of the last payroll of the year, frequently combined with the urgency of not wanting to miss a year-end payment.
W-2 data requests. The seasonal peak of executive impersonation aimed at obtaining employee tax data, beginning as soon as W-2 preparation starts and running through the filing season.
Benefits and open enrollment scams. Messages directing employees to fraudulent enrollment portals to harvest credentials and personal data, timed to coincide with genuine enrollment communications.
Vendor payment changes. Requests to update supplier banking details ahead of year-end payment runs, exploiting the same volume and urgency dynamics.
Fake year-end adjustments. Requests for corrections, retroactive adjustments, or reconciliation entries that are plausible only because such entries genuinely occur at this time.
The single most exploitable weakness in the season is delegation of approval authority to people without context. Two practices address it directly.
First, coverage arrangements should be documented in advance — who is covering what, with what authority, and what falls outside their scope. A covering employee should know that certain transaction types are not theirs to approve regardless of urgency.
Second, and more important, verification requirements do not relax during coverage. The standing rule that banking changes are verified out of band applies identically whether the usual approver or a substitute is handling it. Where coverage arrangements quietly suspend controls because the covering person does not know they exist, the season becomes an open window.
The banking change freeze is worth considering specifically. It removes the highest-risk transaction type from the highest-risk period at minimal cost, since a change taking effect in January rather than late December affects almost nobody materially — and an employee genuinely inconvenienced can be handled as a verified exception.
The pressure to finish creates the temptation to skip the review, which is precisely inverted from where the risk sits. The year-end run is the one most worth reconciling: highest volume, most exceptions, thinnest staffing.
The checks that matter are the standard ones applied with more care — banking changes since the last cycle confirmed as verified, payroll additions matched against actual hires, bonus entries traced to approved decisions, duplicate bank accounts across employees, and totals compared against expectations with variances explained before release rather than after.
Scheduling the run to leave time for this is a planning decision made weeks earlier. A reconciliation that happens only when there is time will not happen in the period when it matters most.
Employer's Guardian helps employers prepare payroll operations for high-volume periods, including coverage planning, approval requirements, and reconciliation practices, through payroll services.
This article provides general educational information, not legal, tax, or insurance advice. Requirements vary by location, industry, and the data your organization handles.