SE//PREVENT

Search the library
← Back to latest stories
Workplace Deception6 min read

December Payroll Requests: Verify Deposit Changes and W-2 Asks

A small employer's year-end routine for 'please update my direct deposit' and 'send me the W-2s' emails: who verifies, how, and where to report a loss.

Pixel-art office desk with a cream payroll ledger, a rubber stamp in forest green, a small brass bell and two stacked envelopes under an amber lamp.

“Hi, I changed banks, can you update my direct deposit before the next payday?” From a real employee, it is a two-minute task. From someone using a stolen or spoofed email, it is a paycheck sent to a stranger. A written rule decides which, before December’s rush.

Small offices are the natural target here. The person who runs payroll often also answers the phone, pays the bills and closes the books at year-end, and the requests arrive when everyone is busy or away. The IRS said in an October 2, 2026 reminder that businesses should watch for “W-2 and payroll-related schemes designed to steal employee information, credentials or money,” and that “requests to change sensitive employee or payment information should be verified through a trusted channel.”

This article sets out that channel for a business with a handful of employees.

Two schemes, one weakness

Payroll diversion. The FBI described the pattern in a 2018 public service announcement: criminals phish an employee’s login credentials, then change the bank details and add rules that hide alerts about direct deposit changes, redirecting pay, often to prepaid cards. A simpler version skips the login and just emails the payroll person as the employee. The FBI’s 2019 follow-up counted 1,053 payroll diversion complaints between January 2018 and June 2019, with reported losses of $8,323,354.

W-2 phishing. An email that appears to come from an executive asks payroll or HR staff for a copy of every employee’s W-2. The IRS has called this “one of the more dangerous email scams” in a tax tip for employers. The stolen forms carry names, Social Security numbers and wages, everything needed to file false returns.

Both rely on the same weakness: an email is treated as proof of who sent it. The same weakness drives the fake-CEO and fake-vendor payment lure on the accounts-payable side.

Who verifies what

A verification table to print for the payroll desk
Request Verify by Second person? Hold time
Employee changes bank account Call the employee on the phone number in their personnel file, or confirm in person Owner or manager signs off Apply from the next pay cycle, not the current one
Employee changes email or phone on file Confirm in person or through the old contact detail No Notify the old address too
“The owner” asks for all W-2s or a payroll report Ask the owner in person or on their known number Yes, always No sending until confirmed
Payroll provider asks to “re-verify” your login Sign in to the provider yourself by typing its address No Ignore the link
Any request marked urgent, confidential or “I’m in a meeting” Treat as unverified until confirmed by phone Yes Urgency extends the hold, not shortens it

The FBI’s 2024 business email compromise announcement gives the same core advice: “Use secondary channels and/or two-factor authentication to verify requests for changes in account information.” The 2018 payroll PSA adds three more: scrutinize direct deposit change requests, watch for logins outside normal hours, and use payroll logins that differ from other logins, with two-factor authentication.

Write it into onboarding. Tell every employee on day one: “We never change your bank details from an email. If you change banks, we’ll call you to confirm.” An employee who knows the rule does not feel distrusted when you call, and a scammer cannot argue past it.

A policy you can paste into the employee handbook

A short written policy makes the routine stick when the usual payroll person is out. Adapt this wording to your business:

  1. Changes to an employee’s bank account, address or tax withholding are accepted only through the payroll system’s own employee login, or on a signed form handed in person.
  2. Any change is confirmed by phone, using the number already on file, before it takes effect.
  3. Bank changes take effect from the next pay cycle after confirmation.
  4. Employee W-2 forms and payroll reports are never sent by email. Requests for them, from anyone including owners, are confirmed in person or by phone.
  5. Anyone who receives a suspicious request reports it to [name] the same day. Reporting a request that turns out to be genuine is never a problem.

The last line matters as much as the others. A rule that welcomes questions makes it easier for anyone to pause on a request that seems to come from the boss.

Why year-end raises the stakes

The FBI’s 2025 Internet Crime Report lists 24,768 business email compromise complaints in 2025, with reported losses of $3,046,598,558, the second-largest loss category after investment fraud. Those numbers cover all kinds of businesses and schemes, not only payroll, but they explain why the email channel deserves a rule.

December adds specific pressure: holiday schedules, bonuses, staff away and the W-2 deadline ahead. The IRS’s 2026 instructions for Forms W-2 and W-3 say employers must generally furnish W-2 copies to employees and file with the Social Security Administration by February 1, 2027, because January 31 falls on a Sunday.

A December to February calendar

  1. Early December: remind staff of the rule above. Confirm who can approve changes while the owner is on vacation.
  2. Before the last payroll of the year: freeze non-urgent bank detail changes until January, unless verified in person.
  3. Throughout: turn on login and change alerts in your payroll software, and make sure they go to two people.
  4. January: send W-2s only through your payroll system or by hand, never as attachments to a reply.
  5. By February 1, 2027: furnish W-2s and file with SSA as the IRS instructions require.

Protect the payroll login itself

Payroll diversion often starts with a stolen password rather than a fake request. Give the payroll system its own unique password and two-step verification, limit who has access, and remove access the day someone leaves. If staff approve sign-ins on their phones, our guide to MFA prompts you did not start is worth sharing with them. The FTC’s small-business fact sheet on business email imposters recommends email authentication, keeping security up to date and training staff.

If W-2 data or a paycheck already went out

Call your bank immediately to try to recall a misdirected deposit, then file a complaint with the FBI’s IC3 and include “payroll diversion,” as the 2018 PSA asks. For W-2 data, the IRS page on W-2 data theft for businesses gives the steps:

  • Email [email protected] with the subject “W2 Data Loss,” including your business name, EIN, contact details, a summary and the number of employees affected. Do not attach employee personal data.
  • If you received the scam email but lost no data, send it to [email protected] with the subject “W2 Scam,” saved as an attachment with full headers.
  • File a complaint with IC3, and email the Federation of Tax Administrators at [email protected].
  • Tell affected employees and point them to IdentityTheft.gov.

Our first-hour reporting guide covers who inside the business needs to hear first. The person who sent the data was targeted by professionals; what protects the business next is fast reporting and a better rule, not blame.

Sources

EMAIL BRIEFING

Stay alert to new social engineering tactics.

Get occasional, practical updates on scam patterns, account abuse and safer decisions.