Payroll Diversion SWIFT Wire Scam

How Payroll Diversion SWIFT Wire Scam Works

Overview: This scam involves fraudsters impersonating company HR representatives or executives to redirect staff payroll payments via the SWIFT network to bank accounts they control. Once funds arrive in these mule accounts, they're swiftly converted to cryptocurrency or withdrawn, making recovery nearly impossible. The attack often unfolds at month-end, targeting finance departments under pressure, and can result in lakhs or even crores of employee salary losses. How It Works: Scammers send emails pretending to be from HR or top leadership, sometimes using lookalike domains. These emails request urgent payroll changes—redirecting all or specific staff salaries to new bank accounts (usually in the US, Hong Kong, or even within India but controlled by fraudsters). Requests often cite emergencies, mergers, or audit requirements. Payroll staff, misled by official-looking documents, input the new account details into the SWIFT payroll transfer system. Once transferred, the money vanishes into international, often crypto-linked, accounts. India Angle: Large Indian corporates, BPOs, tech exporters, and education institutions with cross-border payroll operations are targets, especially in Bengaluru, Pune, Noida, and Hyderabad. Such scams exploit India’s SWIFT-enabled banks and digital HR platforms. Finance teams inexperienced with BEC tactics or those who work remotely are especially vulnerable. Real Examples: - HR at a Hyderabad BPO receives an emergency email (matching the CEO’s writing style) instructing the next payroll cycle to divert senior staff salaries to new accounts in Green Dot Bank, US. - A Pune IT firm’s finance executive gets a message late Friday asking for a mass salary transfer to an ‘updated’ account list due to ‘audit compliance’. Red Flags: - Sudden payroll update requests from top management - Change of bank details to unfamiliar foreign or digital banks - Instructions that combine salary and unrelated gift card reimbursements - Requests for no in-person or verbal confirmation Protective Measures: - Mandate dual approval for all payroll account updates - Always verify such requests with senior management via independent, known contact channels - Use SWIFT’s AI and anomaly detection for non-routine payroll transfers - Hold payments to new or updated accounts for 24-48 hours If Victimised: - Notify your bank to try and reverse the payment - File an FIR and report immediately to cybercrime (1930, cybercrime.gov.in) - Alert all affected employees and audit payroll records - Involve your IT security team for full investigation Related Scams: - HR email spoofing fraud - Payroll redirection via fake online forms - Crypto wallet payroll diversion

Visual Intelligence:

BharatSecure's AI has identified this as a used in scams targeting Indian users.

Who Does Payroll Diversion SWIFT Wire Scam Target?

General public across India

Red Flags — How to Identify Payroll Diversion SWIFT Wire Scam

• Urgent requests for payroll changes to unfamiliar accounts
• Unusual bank names (often foreign, digital, or crypto-linked)
• Combination of salary and gift card disbursement requests
• Lack of standard multi-person approval
• Emails using slightly misspelled company domains

What To Do If You Encounter Payroll Diversion SWIFT Wire Scam

1. Do not click any links or share personal information
2. Block and report the sender immediately
3. Report at cybercrime.gov.in or call 1930
4. Inform your bank if financial details were shared

How to Report Payroll Diversion SWIFT Wire Scam in India

• Call 1930 — National Cyber Crime Helpline (24x7)
• File a complaint at cybercrime.gov.in
• Contact your bank immediately if money was lost
• Call RBI helpline: 14440 for banking fraud

Frequently Asked Questions

What is Payroll Diversion SWIFT Wire Scam?

Overview: This scam involves fraudsters impersonating company HR representatives or executives to redirect staff payroll payments via the SWIFT network to bank accounts they control. Once funds arrive in these mule accounts, they're swiftly converted to cryptocurrency or withdrawn, making recovery nearly impossible. The attack often unfolds at month-end, targeting finance departments under pressure, and can result in lakhs or even crores of employee salary losses. How It Works: Scammers send em

How does Payroll Diversion SWIFT Wire Scam work?

Overview: This scam involves fraudsters impersonating company HR representatives or executives to redirect staff payroll payments via the SWIFT network to bank accounts they control. Once funds arrive in these mule accounts, they're swiftly converted to cryptocurrency or withdrawn, making recovery nearly impossible. The attack often unfolds at month-end, targeting finance departments under pressur

How to protect yourself from Payroll Diversion SWIFT Wire Scam?

Do not click any links or share personal information Block and report the sender immediately Report at cybercrime.gov.in or call 1930 Inform your bank if financial details were shared

How to report Payroll Diversion SWIFT Wire Scam in India?

Report to cybercrime.gov.in or call 1930 (National Cyber Crime Helpline). You can also contact your local police station's cyber cell.

Verify Any Suspicious Message

Check any suspicious message, link, or call for free at bharatsecure.app. BharatSecure uses AI to detect scams in real-time and protect Indian users.