You approved the payroll batch. Nobody verified the bank account.

A payroll batch can look right after the fraud has already won. The totals reconcile. The file count matches. The bad instruction sits earlier, in the moment a direct deposit account became accepted payroll data.

That is the payroll fraud problem for payroll and staffing companies. Money moves often. Worker records change often. The company holds tax data that can make the next impersonation more convincing.

payroll has more trusted doors than AP

Payroll and staffing companies accept payment instructions from more places than a standard payables team. A direct deposit update may start with a worker, a recruiter, a branch coordinator, an employee portal, an onboarding vendor, a payroll processor, or an email that looks routine.

The person funding the file may never see the first request. By the time treasury reviews the batch, the instruction can carry the shape of clean data.

Staffing adds motion. A worker is onboarded, assigned, moved, corrected, paid off cycle, reclassified, or returned to the pool. Each change creates a believable reason for someone to touch the pay record.

the dangerous change is ordinary

The highest-risk event is simple. A bank account tied to a worker, contractor, vendor, or payroll counterparty changes.

That change does not need to look dramatic. It can arrive as a new hire direct deposit form, a corrected routing number after an ACH rejection, a request to split pay, or a branch spreadsheet sent before cutoff. Normal work gives the fraud cover.

The W-2 problem sits beside it. The IRS has continued warning businesses and payroll providers about executive impersonation and W-2 theft. Those forms carry names, addresses, Social Security numbers, and wage data. Stolen records do not move money by themselves, but they can help a criminal sound real when asking for the next change.

The human impact lands quickly. A missed payroll deposit is not an abstract loss to the worker waiting on rent, fuel, food, or childcare. For the company, the same incident becomes an operations problem before it becomes a legal or banking problem.

the break happens before the payment

Batch approval is late. If the bad account has already been saved as the worker’s current direct deposit record, the payroll file can pass normal review.

The approver may see totals, dates, funding amounts, and file counts. The wrong account is one field inside a valid record.

Callbacks can fail in the same way. If the team calls a phone number supplied inside the change request, the control has accepted the attacker’s contact path. If the team skips review because the next payroll amount is small, it misses the repeat nature of payroll.

This is why payroll fraud often wins before a bank portal is touched. The payment rail does what it was told to do.

controls that matter before payday

The control point is the instruction change. Payroll release review still matters, but it should not be the first hard look at the bank account.

• Verify account ownership before acceptance. New and changed direct deposit accounts should be checked against the person or entity being paid before the record becomes active.
• Separate request intake from approval. The person who collects or enters a bank-account change should not be the only person who clears it for payroll use.
• Use trusted contact paths. If phone verification is used, call a number already on file, not a number supplied in the same request.
• Treat sensitive changes as repeat exposure. A small payroll amount can recur across pay periods. Dollar thresholds alone are a weak screen.
• Flag account changes near cutoff. A change made close to payday should get more scrutiny, especially when paired with a new device, new email address, or recent contact detail change.
• Look for shared destinations. Multiple unrelated workers moving pay to the same account deserves review before the file is funded.
• Preserve the evidence. Keep the request, verification result, approver, date, and outcome in a place finance, risk, and audit can inspect later.
• Apply the same discipline to payroll vendors. Funding instructions from processors, benefits administrators, and payroll-related counterparties should be verified as payment instructions, not handled as ordinary correspondence.

Map one recent payroll cycle from instruction intake to ACH release. Mark every place a bank account can be added, changed, or reactivated. If proof appears only after the batch is built, the control is sitting behind the risk.