Clear Path step · Business · No money moves on one message
Lock payroll and direct-deposit changes
Why it matters: A fake 'please update my direct deposit' email is a simple, common payroll fraud. Removing email as a change channel removes the scam.
On your path if you picked “Trades and field services”, “Education and childcare” or “Something else” for “What's your industry?”, or you picked “We run payroll through a service” for “What runs your business?”.
Do it
- Turn on MFA for every payroll user, including employees' self-service accounts.
- Set a written rule that bank changes happen only in the payroll portal.
- Turn on change notifications to the employee's existing email and phone.
- Call the employee on a known number before the first payroll after any change.
Check it worked: Employees change direct deposit only inside the payroll system with MFA, never by email, and every change triggers a notice to the employee's old contact details plus a callback.
Simply put
It's like a rule that address changes only happen at the front desk, in person. If direct deposit changes only happen inside the payroll system, a fake 'please update my bank' email has nowhere to go.
In detail
The request can come from a new personal address in the employee's name rather than a hacked account, so filters may not flag it; the process change is what catches it.
If this is new to you: Worried staff will find it a hassle? Tell them it's there to protect their paychecks: bank changes happen only inside their own payroll sign-in.
Points toward the Long View: paychecks that only change through a channel the employee controls.