TL;DR: This phishing pattern concentrates in November and December, when year-end bonus announcements and payroll updates are genuinely common at many companies, giving cover for a fake version of the same message. Verify any request to change direct deposit details by contacting payroll or HR directly through a known internal channel, never by replying to or clicking a link in the email itself.
👉 Check my digital footprint — free 30-second check →
This phishing pattern concentrates in November and December, when year-end bonus announcements and payroll updates are genuinely common at many companies, giving cover for a fake version of the same message.
How the Scam Plays Out
Emails impersonating payroll or HR ask employees to 'update' direct deposit details or click a link to view a bonus statement, actually harvesting banking credentials or login information.
How to Protect Yourself
Verify any request to change direct deposit details by contacting payroll or HR directly through a known internal channel, never by replying to or clicking a link in the email itself.
If this looks similar to something else you've seen, it's worth reading Back-to-School Laptop and Device Scams.
This pattern shows up elsewhere too — see Back-to-School Scams Targeting Parents.
Frequently Asked Questions
When does this typically happen?
This phishing pattern concentrates in November and December, when year-end bonus announcements and payroll updates are genuinely common at many companies, giving cover for a fake version of the same message.
What tactics are used?
Emails impersonating payroll or HR ask employees to 'update' direct deposit details or click a link to view a bonus statement, actually harvesting banking credentials or login information.
How can I protect myself?
Verify any request to change direct deposit details by contacting payroll or HR directly through a known internal channel, never by replying to or clicking a link in the email itself.
What should I do if I’ve already been targeted?
Stop all payments immediately, contact your bank or card issuer to see if a transaction can be reversed or flagged, and report the incident to the appropriate consumer protection body.