AegisAI Perspectives · 064
Universities stop payroll diversion and gift card scams with a payroll callback rule and with alerts on hidden mailbox rules in Gmail and Microsoft 365.
Universities stop both scams with two controls: confirm every bank change or gift card request outside email, and alert on new mailbox rules that hide payroll alerts3. The FBI names education first among the sectors hit by payroll diversion, and campus gift card requests run to hundreds of dollars10. AegisAI checks each payment request against the sender's history after delivery23, and the callback rule covers the steps that happen outside the inbox.
This page is the payroll and gift card detail behind the education hub on how to choose email security for universities and K-12. The steps below work on Google Workspace and on Microsoft 365.
Payroll diversion takes over a real staff account. Attackers send phishing emails designed to capture an employee's login credentials, then use them to change the bank account in the payroll system2. They add rules to the employee's mailbox so the employee never sees the alert about the direct deposit change. The pay then goes to an account the attacker controls, often a prepaid card.
A second version skips the login. At UCLA the fake emails typically ask the payroll office to change banking details, and callers ask HR and Payroll staff to do the same by phone11.
The gift card scam impersonates a leader from outside. Yale reports attackers posing as a dean or department chair to get staff to buy hundreds of dollars worth of gift cards and send the codes on the back. The FBI classes it as business email compromise: a person in authority, by spoofed email, call or text, asks the victim to buy multiple gift cards8.
Both scams need one trusted email and one person who acts on it. The controls below take away each of those.
Bank details change only inside the HR or payroll system, never by email. UCLA states that all payroll changes must be completed in UCPath and not communicated through email12. The FBI advises heightened scrutiny for every employee request to change direct deposit details5.
No one buys gift cards on an email or text request. The person confirms the request by calling the dean or chair on a number already known from the campus directory, never a number in the email, as the FBI advises9.
In Gmail, turn on Protect against spoofing of employee names under Apps, Google Workspace, Gmail, Safety; the default action keeps the message in the inbox with a warning20. In Microsoft 365, impersonation settings exist only in Defender for Office 365 anti-phishing policies19. Add deans, chairs, payroll and HR staff to user impersonation protection, up to 350 users per policy.
In Google Workspace, automatic forwarding is on by default under Apps, Google Workspace, Gmail, End User Access21. Allow internal addresses only, or turn it off for staff who do not need it. In Microsoft 365, the Suspicious email forwarding activity alert fires at High severity when mail is autoforwarded to a suspicious external account14.
In Microsoft 365, run Get-InboxRule with IncludeHidden on staff mailboxes, starting with anyone who reports a missing paycheck, to list every rule, including hidden ones16. Look for rules that move mail to Notes, Junk Email or RSS Subscriptions. The Creation of forwarding/redirect rule alert tracks only rules made in Outlook on the web or Exchange Online PowerShell, at Informational severity, so a rule that moves or deletes mail needs this check. In Google Workspace, the Email settings changed alert covers changes an admin makes22, so review user filters on the same schedule.
Require two-factor authentication for the payroll system, and keep payroll credentials different from those used for anything else7. Review payroll logins that occur outside normal business hours.
Revoke the user's active sessions, which immediately invalidates access with the stolen credentials17. Delete the hiding rules, then ask payroll to reverse the bank change before the next pay run.
The page on how email account takeover works shows the full chain from stolen password to hidden rule. For Gmail settings against invoice and payment fraud, see how to protect Google Workspace from business email compromise.
| Control | Google Workspace | Microsoft 365 | Owner |
|---|---|---|---|
| Outside sender using a dean's name | Protect against spoofing of employee names; default keeps mail in inbox with a warning | User impersonation protection in Defender for Office 365, up to 350 users per policy | IT |
| Automatic forwarding | On by default; set to internal only or off | Suspicious email forwarding activity alert, High severity | IT |
| Rules that hide payroll mail | Email settings changed alert covers admin changes only; review user filters | Get-InboxRule with IncludeHidden; forwarding rule alert is Informational | IT |
| Bank detail change | Changes only in the HR or payroll system | Changes only in the HR or payroll system | Payroll |
| Gift card request | Callback on a directory number | Callback on a directory number | Every department |
Illustrative example, figures are fictional. A university with 6,000 staff mailboxes runs the seven steps over one month. Step 3 adds 40 deans, chairs, payroll and HR staff to impersonation protection. In week two, 12 staff receive "Are you available?" emails from an outside address that uses a dean's name, and each one shows a warning. In week three, the Get-InboxRule review finds one rule in a lab manager's mailbox that moves messages from the payroll system to RSS Subscriptions. IT revokes the sessions, deletes the rule, and payroll reverses a bank change two days before the pay run.
AegisAI's AI agents check every payment request against the sender's history, and stop the business email compromise that authentication lets through. It connects by API and works after delivery, and the email is removed from every mailbox that received it24. A trial on your own tenant runs in monitoring mode on live mail with no MX change, then removal is turned on.
Track three numbers from the day the steps go live.
An attacker phishes a staff password, signs in to the payroll account and changes the bank details. A mailbox rule hides the change alert, so the employee finds out on payday.
Run Get-InboxRule with IncludeHidden on the mailbox. Look for rules that move mail to Notes, Junk Email or RSS Subscriptions, and for rules that match words like payroll or direct deposit.
Yes, when Protect against spoofing of employee names is on. Its default action keeps the message in the inbox with a warning. Moving it to spam or quarantine is a stronger choice for payroll and finance staff.
Staff act fast on a request from a leader. Yale reports attackers posing as a dean or chair to get hundreds of dollars worth of gift cards. A callback on a directory number stops it.
Refuse it and point the employee to the HR system. UCLA requires all payroll changes in UCPath, never by email, and the FBI advises heightened scrutiny for every direct deposit change.
