AegisAI Perspectives · 092
Manufacturers stop direct deposit change scams by refusing email-only requests, calling staff on a number on file, and locking down HR mail and portals.
Manufacturers stop attackers changing staff direct deposit details by email by refusing email-only changes and calling the employee back on a number on file, the secondary channel the FBI advised in 201910. The same FBI alert found direct deposit change request losses rose more than 815 percent between January 2018 and June 20198. AegisAI lists an “employee” changing direct deposit among the attacks its AI agents check against the sender’s history21.
Payroll diversion reaches a manufacturer's HR inbox by one of two routes. In the first, phishing emails capture an employee's login credentials4. Direct deposits are then changed and redirected to an account controlled by the cybercriminal5.
In the second, an attacker emails HR or payroll posing as the employee, with no login stolen, the same payroll diversion scheme universities face. The new direct deposit information generally leads to a pre-paid card account9.
The FBI IC3 lists 24,768 business email compromise complaints in 20251, with losses of $3,046,598,5582. The 2024 figures in the same table are 21,442 complaints and $2,770,151,1463.
Set these seven controls in this order, starting with the written rule that every later control backs up.
HR accepts no direct deposit change by email alone, from anyone, including a supervisor writing for a crew member. The FBI advises secondary channels or two-factor authentication to verify requests for changes in account information.
HR calls the employee on the phone number in the HR record, never a number in the email, during the employee's own shift. For night shift staff, use the shift supervisor's desk phone as the second channel.
Mail or text a notice to the employee's existing contact on file the day a change is entered, and hold the first deposit to the new account until the employee confirms. Treat a new account that is a pre-paid card as a reason to stop the change.
The FBI names two-factor authentication as one way to verify a request to change account information. Google calls security keys the strongest 2-Step Verification method19. In Google Workspace, make 2-Step Verification required for HR and payroll users18.
In Microsoft 365, set automatic forwarding in the outbound spam filter policy to Off (Forwarding is disabled). Check the Auto forwarded messages report each week for HR and payroll mailboxes16. In Google Workspace, turn user automatic forwarding off in the Admin console17.
The FBI advises monitoring employee logins that occur outside normal business hours6. At a plant, compare each payroll portal login with the employee's shift schedule, and call back a day shift worker who logs in at 3 a.m.
Show them the warning signs: a change sent by email, a new bank that is a pre-paid card, and a sender who cannot be reached on the number on file. Tell staff on shared break room kiosks to open the payroll portal from the kiosk bookmark and never from an emailed link, since the scheme starts with stolen credentials.
Give each control one named owner.
| Control | Who owns it at a plant | What it stops |
|---|---|---|
| Written rule: no change by email alone | Plant HR manager | Fake employee requests that lead to a pre-paid card |
| Callback on a number on file | Payroll clerk, with the shift supervisor on nights | Requests from a lookalike or stolen address |
| Notice to the employee's contact on file | Payroll clerk | A redirected deposit the employee never asked for |
| MFA on HR and payroll portals | IT admin | Logins with credentials captured by phishing emails |
| Forwarding set to Off | IT admin | Inbox rules that copy HR mail to an external address |
| Login review against shift schedules | IT admin and shift supervisors | Portal logins outside normal hours for that employee |
| Pattern training | Plant HR manager | Staff typing portal logins into phishing pages |
Illustrative example, figures are fictional. Ridgeline Castings (fictional) runs a 400-person plant on three shifts, with one HR generalist and one payroll clerk, plus a single IT admin. At 2:40 a.m. on a Tuesday, the HR inbox gets an email from a night shift supervisor asking to move his direct deposit to a new bank before Friday's payroll. The sender domain swaps the letter i in the company name for an l. At 7:30 a.m. the payroll clerk applies the written rule: no change by email alone. At 11 p.m., when his shift starts, she calls the supervisor on the mobile number in his HR record, and he says he sent nothing. The Auto forwarded messages report shows 0 HR mailboxes forwarding outside the company. Friday's deposit goes to the supervisor's old account.
AI agents check every payment request against the sender’s history, and stop the business email compromise that authentication lets through20. AegisAI reads the thread the way an analyst would: the sender’s history, the change being asked for, and where the reply actually goes22. AegisAI connects by API and works after delivery23. The median verdict takes 1.9 seconds, then the email is removed from every mailbox that received it.
Track these three numbers each week from the day the rule goes live.
To see an emailed direct deposit request checked against the sender’s history in your own tenant, use the demo page.
They accept no direct deposit change by email alone and call the employee back on a number on file. They add 2-Step Verification on payroll portals, automatic forwarding set to Off on HR mailboxes, and a notice to the employee's contact on file for every change.
It reads as a routine request from an employee or supervisor, sent from a lookalike or stolen address. The FBI describes phishing emails that capture the employee's login credentials before the change.
Yes, through the payroll portal with MFA, and never through an emailed link. The FBI describes phishing emails built to capture employee logins. Google rates security keys the strongest 2-Step Verification method, and an admin can make 2-Step Verification required for users.
Use Off for automatic forwarding in the Microsoft 365 outbound spam filter policy. Off disables Inbox rules that forward to external addresses. In Google Workspace, turn user automatic forwarding off in the Admin console.
The FBI IC3 lists 24,768 business email compromise complaints in 2025, with $3,046,598,558 in losses. Its 2019 alert reported that direct deposit change request losses rose more than 815 percent from January 2018 to June 2019.
File a complaint with the FBI's Internet Crime Complaint Center at ic3.gov and write payroll diversion in the body of the complaint. Call the bank that received the deposit the same day.
