What is payroll diversion, exactly?

A scammer emails HR pretending to be an employee and asks to 'update' their direct deposit details. The next payroll run pays the scammer, and the real employee finds out on payday. The FBI tracks it as a form of business email compromise — a category that cost businesses $3.05 billion in reported losses in 2025.

Isn't this just a security-training problem?

Training helps and doesn't finish the job. These emails are now well-written, personalized, and sent at scale — the sloppy tells people were trained to spot are gone. The durable fix is procedural: every banking-detail change gets verified by a callback to a number already on file, no exceptions, plus email security that models what normal looks like. Do the callback procedure regardless of what you buy; many crime-insurance policies quietly require it anyway.

Doesn't our spam filter already cover this?

Usually not. Diversion emails are clean — no malware, no suspicious links, a plausible sender name. Traditional filters look for technical badness and find none. That's the entire reason behavioral tools like Sublime and Abnormal exist: the tell is that the request is abnormal for that person, not that the email is malicious in any scannable way.

Best-of guide

Best Payroll Diversion & BEC Protection Software

This is a narrower category than it should be, most of the 'payroll fraud detection' conversation online skips right past the fact that email-based direct-deposit diversion is the single most common way SMBs actually lose money. The good news is that it's no longer a one-name category: there's now a real spread, from a free tier you can turn on this afternoon to the premium behavioral engines and, above all of them, the enterprise secure-email gateways (Proofpoint, Mimecast) that most SMBs will never need to shop for. Here's the layered shortlist, easiest and cheapest to adopt first.

Questions buyers actually ask

What is payroll diversion, exactly?: A scammer emails HR pretending to be an employee and asks to 'update' their direct deposit details. The next payroll run pays the scammer, and the real employee finds out on payday. The FBI tracks it as a form of business email compromise — a category that cost businesses $3.05 billion in reported losses in 2025.
Isn't this just a security-training problem?: Training helps and doesn't finish the job. These emails are now well-written, personalized, and sent at scale — the sloppy tells people were trained to spot are gone. The durable fix is procedural: every banking-detail change gets verified by a callback to a number already on file, no exceptions, plus email security that models what normal looks like. Do the callback procedure regardless of what you buy; many crime-insurance policies quietly require it anyway.
Doesn't our spam filter already cover this?: Usually not. Diversion emails are clean — no malware, no suspicious links, a plausible sender name. Traditional filters look for technical badness and find none. That's the entire reason behavioral tools like Sublime and Abnormal exist: the tell is that the request is abnormal for that person, not that the email is malicious in any scannable way.