Compromised Colleague Payroll Diversion Scam

How Compromised Colleague Payroll Diversion Scam Works

Overview: The Compromised Colleague Payroll Diversion Scam involves genuine internal email accounts being hacked and used to request salary account changes within Indian organizations. Because the sender is known, the scam often succeeds, leading to redirection of personal or mass payroll disbursals to fraudster-controlled accounts. Especially dangerous in multi-branch firms, call centers, and IT service companies where employees may not recognize all colleagues. How It Works: Cyber criminals gain access to a genuine HR or finance staff account, typically via phishing attacks or weak passwords. From this internal ID, they send realistic emails to payroll staff or fellow HR colleagues, requesting a 'minor update' or a 'bank switch' for salary credit. Since the sender ID is legitimate, recipients often trust it and update records accordingly. The scam is often timed just before payroll closure, ensuring minimal time for double-checks. India Angle: This scam is especially rampant in Indian companies with high staff turnover or distributed teams—such as call centers in Noida, Pune, Chennai, and Tier II cities. Attackers often use Indian names, internal templates, and language matching the company’s communication style. Small businesses with limited IT security are particularly at risk. Real Examples: - Example 1: Payroll clerk receives an email from an HR manager’s account: “Hi Suman, as discussed, please use my new HDFC account for this month's salary. URGENT as old account frozen. Details attached." - Example 2: “Finance team – please approve updated details for Rajan’s March salary, see signed form attached." Red Flags: - Requests to change bank details sent from familiar but unexpected sources - Sudden shift to obscure or small regional banks - No out-of-band verification (phone/SMS) - Change instructions received at odd hours or close to salary runs - Poor spelling/grammar in an otherwise professional template Protective Measures: - Verify every salary or account change verbally, even if sender is a known colleague - Maintain robust two-factor authentication for HR/finance logins - Routinely audit payroll change logs for any unsanctioned edits - Train all staff to never approve payroll edits from email instructions alone If Victimised: - Freeze affected payroll immediately and coordinate with the company’s IT and finance teams - Contact affected bank and request urgent recall - File a report on cybercrime.gov.in and call 1930 - Inform RBI if the fraud involves multiple accounts or UPI wallets Related Scams: - HR resignation scams (fake employee offboarding) - Payroll ‘reconciliation’ phishing attacks - Internal IT account compromise leading to fake approvals

Visual Intelligence:

BharatSecure's AI has identified this as a used in scams targeting Indian users.

Who Does Compromised Colleague Payroll Diversion Scam Target?

General public across India

Red Flags — How to Identify Compromised Colleague Payroll Diversion Scam

• Salary account change requests from known colleagues without warning
• Update requests near payroll deadline
• Switch to little-known or obscure banks
• No external (phone/SMS) confirmation
• Odd timings or inconsistent message language

What To Do If You Encounter Compromised Colleague Payroll Diversion Scam

1. Do not click any links or share personal information
2. Block and report the sender immediately
3. Report at cybercrime.gov.in or call 1930
4. Inform your bank if financial details were shared

How to Report Compromised Colleague Payroll Diversion Scam in India

• Call 1930 — National Cyber Crime Helpline (24x7)
• File a complaint at cybercrime.gov.in
• Contact your bank immediately if money was lost
• Call RBI helpline: 14440 for banking fraud

Frequently Asked Questions

What is Compromised Colleague Payroll Diversion Scam?

Overview: The Compromised Colleague Payroll Diversion Scam involves genuine internal email accounts being hacked and used to request salary account changes within Indian organizations. Because the sender is known, the scam often succeeds, leading to redirection of personal or mass payroll disbursals to fraudster-controlled accounts. Especially dangerous in multi-branch firms, call centers, and IT service companies where employees may not recognize all colleagues. How It Works: Cyber criminals g

How does Compromised Colleague Payroll Diversion Scam work?

Overview: The Compromised Colleague Payroll Diversion Scam involves genuine internal email accounts being hacked and used to request salary account changes within Indian organizations. Because the sender is known, the scam often succeeds, leading to redirection of personal or mass payroll disbursals to fraudster-controlled accounts. Especially dangerous in multi-branch firms, call centers, and IT

How to protect yourself from Compromised Colleague Payroll Diversion Scam?

Do not click any links or share personal information Block and report the sender immediately Report at cybercrime.gov.in or call 1930 Inform your bank if financial details were shared

How to report Compromised Colleague Payroll Diversion Scam in India?

Report to cybercrime.gov.in or call 1930 (National Cyber Crime Helpline). You can also contact your local police station's cyber cell.

Verify Any Suspicious Message

Check any suspicious message, link, or call for free at bharatsecure.app. BharatSecure uses AI to detect scams in real-time and protect Indian users.