DIVERTED DIRECT DEPOSITS
If hackers are nothing else, they are innovative - constantly changing ways to gain unauthorized access to accounts and information. In an effort to redirect employees' direct deposits, hackers are using phishing techniques to change access to employees' email accounts. Once the hackers have access, they send a password reset request from the employee's email to the employer's payroll provider. The hackers will then change the employee's inbox forwarding rules so that all emails from the payroll provider will be sent to the employee's junk mail folder. As soon as the email lands in the junk email folder, the hackers will change the direct deposit bank account information and have the employee's payroll deposited in their own account. Adding insult to injury, the hackers can also access employees' W-2 information and file fraudulent tax returns.
Hackers are creating even bigger headaches for employers by adding new payees to the employer's payroll and entering immediate payments to be made. The payroll for these fake employees is then directed to the hackers' back accounts, thus draining the employer's payroll account. While these scams involve individual employees falling for hackers' phishing techniques, the compromised system was the employer's and an employer is responsible for ensuring the security of its system. Accordingly, this ever-increasing risk cries out for more training to be conducted by employers to avoid any loss of funds and/or confidential information.
To help employers deal with cyber-attacks and related data breaches, the Chair of K&C's Data Privacy and Security Practice Group, Nicole Harrell, will be on hand at the Virginia Beach Convention Center for the November 15, 2018 showing of the 35th Annual Employment Law Update to provide timely guidance for dealing with data breaches of this nature. This day-long program will include a number of timely employment workshops and a skit highlighting a data breach caused by "Antoine Merriweather," the perpetual problem employee.
Mentioned
The contents of this publication are intended for general information only and should not be construed as legal advice or a legal opinion on specific facts and circumstances. Copyright 2026.
