TL;DR: Year-end payroll activity in December–January gives scammers a reason to impersonate HR systems. Update payroll or bank details only through your company's verified HR portal, and confirm any unusual payroll email with HR directly through a known internal channel before clicking a link.
Year-end payroll activity in December–January gives scammers a reason to impersonate HR systems.
How the Scam Plays Out
Phishing emails impersonate the company's HR or payroll portal asking employees to 'update' bank details for bonus disbursement or tax declarations, directing them to a fake login page that steals credentials.
How to Protect Yourself
Update payroll or bank details only through your company's verified HR portal, and confirm any unusual payroll email with HR directly through a known internal channel before clicking a link.
If this looks similar to something else you've seen, it's worth reading Diwali Online Shopping Scams.
This pattern shows up elsewhere too — see Exam Result Season Phishing Scams.
Frequently Asked Questions
When does this typically happen?
Year-end payroll activity in December–January gives scammers a reason to impersonate HR systems.
What tactics are used?
Phishing emails impersonate the company's HR or payroll portal asking employees to 'update' bank details for bonus disbursement or tax declarations, directing them to a fake login page that steals credentials.
How can I protect myself?
Update payroll or bank details only through your company's verified HR portal, and confirm any unusual payroll email with HR directly through a known internal channel before clicking a link.
What should I do if I’ve already been targeted?
Stop all payments immediately, contact your bank or card issuer to see if a transaction can be reversed or flagged, and report the incident to the appropriate consumer protection body.