Yes, you can be scammed through direct deposit, and it happens often enough that federal agencies and payroll providers treat it as a routine threat. The same routing and account numbers that make automated pay convenient give a criminal everything needed to redirect your money, and the schemes usually work by either impersonating you to your employer, tricking you into handing over login credentials, or luring you into a fake job that harvests your banking details. Federal law protects you from some of these losses, but only if the transfer qualifies as unauthorized and only if you report it in time.
How Direct Deposit Scams Actually Work
The most damaging version never contacts you at all. In a payroll diversion scheme, a criminal emails your employer’s HR or payroll department pretending to be you, asks to update the direct deposit account on file, and waits for the next pay run. If the payroll clerk doesn’t independently verify the request, your paycheck lands in a prepaid debit card or bank account the scammer controls.
The second common approach targets you. A message arrives by email, text, or phone claiming to come from HR, your bank, or your benefits provider, warning about a locked account or a required update. The link goes to a cloned login page. Once you enter your credentials on the fake site, the attacker signs into the real portal and changes where your deposits go. The scam works because there’s a gap between when the settings change and when the next pay cycle actually runs. You notice when your paycheck doesn’t arrive; by then the money has already moved.
Fake job postings are the third pattern. The interview happens over a messaging app, the offer comes fast, and the onboarding paperwork asks for your routing number and account number. Some schemes use those details to pull unauthorized withdrawals. Others go further: the “employer” sends a check to cover home office equipment or a sign-on bonus and asks you to wire part of it back to a vendor. Federal rules require your bank to make deposited funds available on a schedule, but availability isn’t the same as clearance. When the check bounces days later, the bank has the legal right to reverse the credit and charge the full amount back to your account under UCC Article 4.1Cornell Law School. UCC 4-214 Right of Charge-Back or Refund Whatever you wired out is gone, and you owe the bank the rest.
Federal benefit payments face the same risk. Social Security, VA disability, and other electronic disbursements can all be redirected if someone gets into your online account. The VA now requires a verified ID.me or Login.gov account before it will change deposit information for disability, pension, or education benefits.2Veterans Affairs. How to Change Direct Deposit Information for VA Benefits The Social Security Administration offers a stronger tool: a Direct Deposit Fraud Prevention block that stops anyone, including you, from changing your deposit online or through a financial institution. Once it’s on, any change requires an in-person visit to a local SSA office.3Social Security Administration. Fraud Prevention and Reporting
Whether You Get Your Money Back Depends on One Legal Distinction
Federal law splits direct deposit fraud into two categories, and the split determines almost everything about recovery. An “unauthorized electronic fund transfer” is one initiated by someone other than you, without your permission, from which you got no benefit.4eCFR. 12 CFR Part 1005 Electronic Fund Transfers Regulation E If a criminal hacks your payroll portal and redirects your paycheck, that’s unauthorized, and Regulation E’s consumer protections apply.
If you voluntarily sent money to a scammer, even because they lied to you, the transfer is generally treated as authorized. The check-and-wire scheme is the clearest example: you deposit the check, you initiate the wire, and the deception doesn’t change the legal classification. Regulation E’s protections for unauthorized transfers don’t apply when you’re the one who moved the money. That’s exactly why these schemes remain effective. The criminal designs the setup so you press the button.
Reporting Deadlines Set Your Liability
For transfers that do qualify as unauthorized, Regulation E creates a sliding scale based on how fast you notify your bank.5eCFR. 12 CFR 1005.6 Liability of Consumer for Unauthorized Transfers
- Report within two business days of learning about the loss, and your maximum liability is $50 or the amount of unauthorized transfers before you reported, whichever is less.
- Report between two and sixty days, and your liability can climb to $500 for transfers that happened after the two-day window closed.
- Wait more than sixty days after receiving a statement showing the unauthorized activity, and you lose protection entirely for those transactions. The bank only has to reimburse losses it can’t prove earlier reporting would have prevented.
The burden of proof sits with the bank. If it wants to hold you liable beyond $50, it has to prove either that you authorized the transfer or that you missed the reporting window.6Office of the Law Revision Counsel. 15 USC 1693g Consumer Liability The practical rule: check your account and your pay stubs every pay period. A scam caught on day one costs almost nothing. One found two months later can cost you everything.
How to Report and What the Bank Must Do
Call your bank’s fraud department first. Give the transaction date, the amount, and whether you authorized the transfer. The bank will try to reverse the transfer through the ACH network, though whether it succeeds depends on whether the funds are still sitting in the receiving account.
Once you’ve reported, the bank generally has ten business days to investigate. If it needs more time, it must provisionally credit your account for the disputed amount (minus up to $50) within those ten business days and keep working. The full investigation has to close within 45 days, extended to 90 for foreign transfers or purchases made within 30 days of opening a new account.7Consumer Financial Protection Bureau. 1005.11 Procedures for Resolving Errors If the bank finds an error, it must correct it within one business day and notify you within three.8Office of the Law Revision Counsel. 15 USC 1693f Error Resolution
After the bank report, file with the FBI’s Internet Crime Complaint Center at ic3.gov. A federal complaint creates a record that may be referred to law enforcement, and in some cases the FBI can freeze stolen funds.9Internet Crime Complaint Center (IC3). IC3 Home Page Also file at IdentityTheft.gov. The site generates a personalized recovery plan and an official Identity Theft Report, which gives you specific rights when disputing fraudulent accounts, correcting credit reports, and stopping debt collectors.10U.S. Federal Trade Commission. Identity Theft A Recovery Plan Keep a log of every case number, representative, and date. Fraud cases bounce between your bank, your employer’s payroll department, and federal agencies, and a clean record keeps things from falling through the cracks.
If Your Employer Was the One Who Was Tricked
When a payroll diversion scheme succeeds, you didn’t fail to report anything. Your employer processed a fraudulent change request. Under the Fair Labor Standards Act, wages are due on the regular payday for the pay period covered.11U.S. Department of Labor. Handy Reference Guide to the Fair Labor Standards Act The fact that a criminal intercepted the payment doesn’t erase the employer’s obligation to pay you. State wage-and-hour laws generally reinforce that with their own payday rules.
If the same breach exposed your W-2 data or Social Security number, the IRS instructs businesses to email dataloss@irs.gov with the business name, EIN, a contact person, a description of how the theft occurred, and the number of employees affected.12Internal Revenue Service. Form W-2 SSN Data Theft Information for Businesses and Payroll Service Providers
How to Protect Yourself Going Forward
Check your pay stubs every pay period. If the amount changes or the deposit doesn’t arrive, that’s your signal, and catching it within two business days holds your liability at $50 for anything that counts as unauthorized.
Layer the other protections:
- Turn on multi-factor authentication for every payroll portal, banking app, and federal benefits account. A stolen password alone can’t redirect your deposit if the attacker also needs a code from your phone.
- Never approve a login prompt or verification code you didn’t trigger. If one arrives out of nowhere, someone else is trying to get in.
- Freeze your credit with Equifax, Experian, and TransUnion. Federal law requires the bureaus to place and remove freezes at no charge. A freeze won’t stop a direct deposit redirection on its own, but it blocks new credit accounts opened with information stolen in the same breach.13GovInfo. 15 USC 1681c-1 Identity Theft Prevention Fraud Alerts and Active Duty Alerts14Consumer Financial Protection Bureau. What Is a Credit Freeze or Security Freeze on My Credit Report
- Ask your employer how it verifies direct deposit changes. If the answer is “we process email requests,” push for callback verification or in-person confirmation.
- If you receive Social Security and rarely change banks, consider the SSA Direct Deposit Fraud Prevention block. It’s inconvenient by design.3Social Security Administration. Fraud Prevention and Reporting
Watch for red flags during any legitimate setup or change. A real employer won’t ask for banking details over text or personal email. Onboarding URLs should match the company’s actual domain. No payroll department threatens a missed paycheck if you don’t submit information within hours. And no employer needs your online banking username and password. The routing and account numbers are the only banking pieces a real payroll system requires.
Direct deposit remains safer than paper checks, which can be stolen from mailboxes. The vulnerability lies in how easily the instructions feeding the system can be changed, and knowing where those weak points are keeps you in position to catch fraud while the law still protects you and the money is still recoverable.