Category
Banking (banking-financial)Updated October 2026 to our current guidance. The original reporting date is unchanged.
One polite email to payroll can reroute a paycheck. Here’s how it works, and the two-minute phone call that stops it.
Count What’s on Your Computers →See how many programs each Windows PC has, how many are current, and how many need updating. No credit card needed.
You have a spam filter, and the person who runs payroll is careful. Both of those are true, and both do their jobs.
A spam filter looks for bad links and malicious files. This email has neither. It’s a plain, polite request from a name you know. So what checks a change to someone’s bank details?
In this article
It lands in the inbox of whoever runs payroll, and it looks like one of your own people sent it. “I switched banks. Can you update my direct deposit before Friday?” Polite and ordinary. The sender either faked the employee’s name or already has that employee’s email login.
If they’re inside the mailbox, they often set a quiet rule that deletes the bank’s confirmation message, so nobody sees it until payday. The FBI files this under business email compromise and keeps warning about it. (source)
There’s no malware to catch and no link to flag. A spam filter is built to stop junk and known-bad files, and this message is neither. It reads like routine office mail, because that’s what it was written to be.
Once a paycheck lands in the wrong account, getting it back is slow and often doesn’t work. That’s why the check has to happen before the change, not after.
First, make it a rule that no direct deposit ever changes because of an email alone. Call the employee at a number you already have on file, never one from the email, and have a second person approve the change. The call takes two minutes.
Second, look at the computers payroll runs on. Windows Update never touches third-party software. The PDF reader that opens every invoice and the other programs on that machine update on their own schedule, or not at all. Count them, so you know which ones are current and which need updating.
A good direct deposit scam fools careful, smart people. It’s written to. Nobody should have to be a fraud expert to run payroll, and a written callback rule means nobody has to be.
I’ve spent 35+ years watching how these attacks work. The email that does the damage is usually the most ordinary one in the inbox. A rule beats a judgment call every time.
Here is what happens when you click the button.
If the second number is higher than you expected, that’s common. You don’t have to be able to do this. We’ll do it with you.
The scan is on us. If you want step-by-step instructions afterward, that’s a paid report, and you’ll see the price before you decide.
It only looks and reports. It doesn’t change anything on your computer. No credit card needed to start.
Your results are yours, and we don’t sell your data. If you buy anything later, refunds are available within the first 30 days.
Everyone starts with the scan. Most people stop there, and that’s a fine outcome. If you want more, there are two other ways we work.
Run it on each Windows computer. It counts what is installed: how many programs are current and how many need updating. No credit card needed. The scan is on us. If you want step-by-step instructions afterward, that’s a paid report, and you’ll see the price before you decide.
Count What’s on Your Computers →For a business that gets asked to prove its security, by a bigger customer, an insurer, or an auditor. We scan your computers every month, a person reviews the results, and you get a prioritized report you can hand over. Whoever runs your IT keeps doing the work; you get a dated record of where the computers stand. Up to 100 computers, from $4,500 a year.
See how Second Opinion works →If you would rather have the work done for you: the updates, the monitoring, and the problems when they come up. Every business is set up differently, so we scope it in a conversation.
Start a conversation →A spam filter does a good job on what it was built for: junk and known-bad files. This email has no file and no link, so there’s nothing in it for the filter to recognize. The callback rule covers the gap.
Write the rule down today and tell payroll it applies to everyone, including you.
The Reveal Scan counts what is installed on each Windows PC: how many programs are current and how many need updating. Read-only, no credit card needed.
Count What’s on Your Computers →The scan is on us. If you want step-by-step instructions afterward, that’s a paid report, and you’ll see the price before you decide.
If you run it and never speak to us again, that’s a fine outcome.
Want this kind of plain-English security news every week? Sign up for Craig’s Insider Notes at CraigPeterson.com.
Join the owners who get Craig's Insider Notes every week.