Payroll Direct-Deposit Phishing: Does the Employer Owe the Stolen Paycheck Twice?
When a scammer diverts an ACH payroll run to a burner card, refusing to reissue pay turns cybertheft into a state wage-payment violation. Harden ACH verification before payday.
- Jurisdiction
- US Multi-State · 26 M.R.S. § 621-A, Cal. Lab. Code §§ 212–213 & NY Lab. Law §§ 191–193
- Employer threshold
- All US employers running ACH payroll or self-service portals · 1+ employees
- Decision trigger
- Employee reports missing payday deposit after spoofed email or compromised portal routing update
- Review cadence
- Reviewed on state appellate wage-diversion rulings or Reg E amendments
Direct operational answer
Under strict state wage-payment statutes—anchored by Dorsey v. Northern Light Health, 2022 ME 62, alongside California Labor Code §§ 212–213(d) and New York Labor Law §§ 191–193—wiring ACH payroll to a scammer’s account leaves the employee’s earned wages legally unpaid unless the employer proves affirmative employee fraud or collusion. Under the hr.cafe payroll recovery and verification protocol, HR reissues stolen net pay on time while firing immediate bank ACH recalls and out-of-band change locks.
Why "We Already Sent the Money" Fails Under State Wage-Payment Laws
Finance instincts treat a diverted payroll ACH like a disputed commercial invoice: freeze cash until the bank finishes its fraud trace. State wage-payment statutes treat that exact reflex as an unlawful failure to pay earned wages on the scheduled payday.
It is Friday at 9:15 a.m. A senior clinician messages payroll: her biweekly deposit never hit her credit union. Your payroll coordinator opens the employee self-service audit log and spots a routing-number change submitted nine days earlier from an unfamiliar IP address, redirecting $8,432.98 to an out-of-state prepaid card account. Your originating bank sends an urgent ACH recall and claws back $79.65; the remaining $8,353.33 is already withdrawn at an ATM. Finance tells HR not to cut a replacement check because "the company already paid payroll once, and someone used the employee’s own credentials."
Those numbers are not hypothetical. They are the exact dollar figures from Dorsey v. Northern Light Health, 2022 ME 62, 288 A.3d 386, where cybercriminals compromised portal credentials affecting eleven hospital employees. Northern Light refused to reissue Dr. Deanna Dorsey’s unrecovered pay, arguing she had failed to safeguard her credentials under its signed IT Code of Conduct. The Maine Supreme Judicial Court unanimously affirmed summary judgment against the employer. Because the funds never reached an account actually designated by Dr. Dorsey, the hospital legally failed to pay wages in full on payday under 26 M.R.S. § 621-A—exposing an employer that digs in its heels to statutory interest, reasonable attorneys’ fees, and mandatory double-additional-liquidated (effectively treble) damages under 26 M.R.S. § 626-A.
While Dorsey is binding Maine appellate precedent rather than a federal statute, its statutory logic mirrors strict wage-delivery mandates across major US jurisdictions:
- California (Cal. Lab. Code §§ 204, 210, 212 & 213(d)): Employers may pay by direct deposit only when voluntarily authorized by the employee into an account at a financial institution of the employee’s choice. Routing pay to an imposter’s burner card is not delivery to an employee-authorized account—triggering Labor Code § 210 late-pay penalties ($100 initial; $200 plus 25% of the amount unlawfully withheld for subsequent or willful violations) and § 203 waiting-time penalties if final pay is affected.
- New York (N.Y. Lab. Law §§ 191, 192, 193 & 198(1-a)): Direct deposit requires advance written consent of the employee (§ 192), shifting loss onto an employee operates as an impermissible deduction from wages (§ 193), and underpaying timely wages under § 191 carries 100% liquidated damages plus mandatory plaintiff’s attorneys’ fees under § 198(1-a).
- Why Federal Regulation E (12 CFR Part 1005) Does Not Rescue Payroll: Employers sometimes invoke consumer liability caps ($50 / $500) under the Electronic Fund Transfer Act and Regulation E (12 CFR § 1005.6). Regulation E governs unauthorized electronic fund transfers out of a consumer’s own bank account held at a financial institution. When an attacker alters routing instructions inside an employer’s HRIS or emails HR before the ACH file originates, the money never enters the employee’s consumer bank account—so the employee has zero Reg E claim against their own bank.
Distinguish the Three Attack Vectors—and Why Only Collusion Shifts Liability
AI-written voice clones and spoofed executive emails pushed business email compromise losses past $3 billion in federal cybercrime tracking. Separate HR-desk spoofing, self-service portal takeover, and verifiable first-party collusion before deciding next steps.
As AI and changing work tools allow attackers to scrape org charts and clone writing styles with zero grammatical tells, people operations teams see three distinct diversion scenarios:
- Vector A — Spoofed Email or Helpdesk Ticket to Payroll (100% Employer Operational Fault): An attacker registers a lookalike domain or free webmail address ("I switched banks today, can you update my routing before tomorrow’s payroll cutoff?") and a helpful coordinator types the new ABA/account numbers into the payroll register. The employee touched nothing. Every state labor agency treats this as an unequivocal unpaid-wage liability of the employer.
- Vector B — Compromised Employee Self-Service (ESS) Portal Credentials (The Dorsey Trap): An attacker phishes an employee’s SSO login or stuffs reused passwords into an HR portal lacking phishing-resistant MFA or cooling-off holds, changing the routing table directly. Even here, unless state statute explicitly creates a negligence defense (most wage-payment statutes impose strict no-fault delivery duties and void private waivers), courts following Dorsey place portal infrastructure risk on the employer—especially where a signed handbook waiver attempts to contract around non-waivable wage laws.
- Vector C — Verifiable First-Party Collusion (The Rare Exception): Only where forensic banking and device evidence proves the employee personally owned the destination account or colluded intentionally to double-collect would wage-delivery liability disappear. Never accuse a victimized worker of collusion based solely on a residential proxy IP in the same metro area—commodity residential-proxy botnets routinely route attacker traffic through local ISP nodes.
Payroll ACH Diversion Triage, Wage-Reissue & Hardening Matrix
| Control / Response Gate | Time Window | Exact Operator Action | Costly Mistake That Multiplies Loss |
|---|---|---|---|
| 1. Originating Bank Recall & Freeze | Hour 0–2 of discovery | Instruct treasury’s Originating Depository Financial Institution (ODFI) to transmit an immediate NACHA fraudulent-entry recall / R06 request and hold indemnity letter to the receiving bank (RDFI). | Waiting 48 hours for internal IT ticket triage while ATM cash-outs empty the burner account. |
| 2. Replacement Net Pay Issuance | Same business day / statutory payday | Reissue net wages to the employee’s verified pre-existing account or live paper check after taking a signed factual non-receipt attestation and assignment of recovered funds. | Telling the employee to wait 30–60 days for bank/FBI IC3 recovery—triggering 100%–200% statutory wage penalties. |
| 3. W-2 & Tax Ledger Cleanliness | Same payroll quarter | Record the diverted net transfer as a corporate cybertheft/fraud expense—never double-reporting gross wages or double-withholding FICA/FIT on the employee’s Form W-2. | Running a second full gross payroll check without reversing/reclassifying the stolen disbursement, inflating the employee’s taxable Box 1 wages by $8,000+. |
| 4. Out-of-Band Callback Gate | Every manual / portal routing change | Ban email/chat ACH changes outright; verify every portal change via live voice/video callback to the pre-existing phone number stored in HRIS ≥30 days prior. | Calling the phone number typed inside the suspicious email signature or relying on SMS codes sent to a newly edited mobile number. |
| 5. Prenote & Old-Account Alert | Every routing edit (1-cycle hold) | Fire instant automated alerts to BOTH old email and SMS on file, enforce phishing-resistant MFA, and hold new routing in $0 prenote status for 1 pay cycle (paying via prior account or live check). | Allowing T-minus-24-hour self-service routing edits to go live silently on tomorrow’s ACH batch. |
First-24-Hours Recovery Arithmetic: Don’t Inflate the Employee’s W-2
When payroll reissues a stolen paycheck clumsily, a second operational disaster strikes in January: the employee’s Form W-2 overstates gross income by thousands of dollars. Separate the fraud loss journal entry from the employee’s wage register.
Walk through the exact payroll accounting on a $5,000.00 gross ($3,650.00 net after $1,350.00 tax/benefit withholdings) biweekly paycheck diverted to a scammer:
- Taxes and benefit withholdings ($1,350.00) were never stolen: Your payroll tax sweep still remitted federal/state income tax and FICA to the IRS and state agencies. Only the $3,650.00 net ACH transfer left the building to the fraudulent routing number.
- Reissue $3,650.00 net—not a second $5,000.00 gross run: Issue a replacement disbursement of $3,650.00 directly to the employee’s verified bank account (or hand-delivered live check), debiting a dedicated Cyber Fraud / ACH Diversion Loss Receivable GL account (net of any partial ODFI bank clawback, such as the $79.65 recovered in Dorsey) rather than posting a second $5,000.00 wage expense against the employee’s YTD tax accumulator.
- File IC3, Law Enforcement, and Crime-Policy Claims Within 48 Hours: File a formal complaint on the FBI Internet Crime Complaint Center (IC3) Recovery Asset Team portal alongside a local police report, and notify your commercial crime / social-engineering cyber insurer immediately (checking whether your social-engineering endorsement carries a mandatory out-of-band callback warranty!).
Install the Copy-Ready Out-of-Band Direct-Deposit Verification Protocol
Zero-trust payroll hygiene rests on one iron rule: no single digital channel—email, Slack, or self-service login—can redirect an upcoming ACH batch without out-of-band confirmation and a cooling-off window.
MANDATORY DIRECT-DEPOSIT CHANGE & ANTI-DIVERSION PROTOCOL (HR / PAYROLL SOP)
Effective Immediately — Zero Exceptions Including C-Suite Executives
1. Absolute Ban on Email, Ticket, or Chat Routing Edits
- Payroll and HR personnel are strictly prohibited from accepting, keying, or attaching bank routing/account forms received via email, helpdesk ticket, SMS, or messaging apps. Any email requesting a direct-deposit update must be closed unactioned and flagged to Security.
2. Self-Service Portal Hardening & Simultaneous Old-Channel Alert
- Direct-deposit edits may be initiated ONLY inside the authenticated HR portal protected by phishing-resistant Multi-Factor Authentication (FIDO2 / authenticator app; SMS-only OTP disabled where supported).
- Any edit to bank routing/account fields or MFA phone numbers immediately triggers an automated alert to the employee’s corporate email, personal email on file, AND prior mobile number: "Your payroll bank account was just modified. If you did not initiate this change, contact Payroll & Security within 2 hours."
3. Out-of-Band Callback Verification + One-Cycle Cooling-Off Gate
- Before activating any modified routing/account number exceeding $0 prenote validation, Payroll must complete a live voice or on-camera video verification call using ONLY the phone number / directory extension on file for at least 30 days (NEVER a number supplied in the change request) and log:
[Employee ID] | [Verifier Name] | [Timestamp] | [Last 4 of Old Account Confirmed by Employee] | [Bank Name & Last 4 of New Account Confirmed].
- Any unverified change submitted within 5 business days of ACH origination defaults to a live paper check held for ID-verified pickup or deposits to the previously verified account.Align Payroll, IT Security, and Treasury Before Your Crime Insurer Audits Controls
Many commercial crime and cyber insurance policies cap or deny social-engineering coverage if payroll skipped pre-established callback verification. Lock Payroll, IT Security, and Finance into a single control architecture.
Enforce zero email-based ACH edits, complete logged out-of-band phone/video callbacks on pre-existing numbers, and reissue diverted net pay on time so cybertheft never becomes a treble-damages wage suit.
Require step-up phishing-resistant MFA specifically on bank-account and MFA-device changes inside the HR portal, block impossible-travel logins, and preserve 90-day IP/session logs.
Pre-stage ODFI bank ACH recall contacts for sub-2-hour escalation, book diverted net funds to a corporate fraud-loss GL (keeping W-2 Box 1 clean), and align SOPs with crime-insurance callback warranties.
Primary statutes, regulations, and enforcement dockets
- Dorsey v. Northern Light Health, 2022 ME 62, 288 A.3d 386 — Maine Supreme Judicial Court — Appellate decision holding the employer liable under state wage-payment law for $8,432.98 in wages diverted after an employee self-service portal breach.
- IRS Newsroom — Dirty Dozen & Security Summit Warnings on Direct-Deposit Payroll Phishing — Federal tax-administration warnings detailing payroll direct-deposit phishing schemes, W-2 credential theft, and employer verification safeguards.
- FBI Internet Crime Complaint Center (IC3) — Business Email Compromise & Payroll Diversion Reporting — Federal cybercrime reporting portal and Recovery Asset Team mechanism for domestic ACH/wire diversion incidents.
- 12 CFR Part 1005 — Electronic Fund Transfers (Regulation E) — eCFR — Defines consumer EFT protections on financial-institution accounts, illustrating why pre-origination employer payroll diversion falls outside consumer bank Reg E claims.
Practitioner questions on the edge cases
Can we ask employees to sign a direct-deposit authorization waiving claims if hackers breach their portal password?
Private waivers almost never override state wage-payment laws. Most states—including California (Cal. Lab. Code § 219), New York, Massachusetts, and Maine as applied in Dorsey v. Northern Light Health—expressly bar private agreements that waive timely payment of earned wages or shift business operational losses onto employees via unlawful deductions.
What if the employee personally clicked a phishing link on their personal phone that exposed their portal login?
Even where an employee fell for a credential-harvesting text or email without malicious intent, strict state wage-payment statutes still require actual delivery of wages to an employee-authorized account, and deducting business/fraud losses caused by simple employee mistake violates state deduction bars (such as California Labor Code § 221 and New York Labor Law § 193). Harden the portal with step-up MFA and out-of-band callbacks rather than litigating employee fault.
How do we prevent an employee from keeping both the replacement paycheck and a later bank ACH recovery?
Have the employee sign a simple, non-punitive Factual Non-Receipt Attestation and Repayment Assignment when issuing the replacement net check: if any portion of the diverted ACH lands in an account controlled by the employee or is credited directly to the employee by a financial institution later, the employee agrees to remit that duplicate recovery back to the company. Meanwhile, ODFI bank recalls return recovered funds directly to the employer’s originating bank account.
Does issuing a replacement net check require amending the employee’s quarterly Form 941 or year-end Form W-2?
No, provided you handle the accounting properly. Because tax withholdings from the original payroll run were already calculated and remitted accurately, reissuing only the stolen net amount from a corporate fraud-loss general-ledger account (rather than running a second gross paycheck through the employee’s payroll history) keeps Form 941 and Form W-2 Box 1, 3, and 5 totals completely accurate.
Get the Thursday edition
One email a week with new practitioner stories and primary-sourced HR playbooks. Free, and one click to unsubscribe.