Payroll diversion phishing

An HR email asks you to confirm your salary details. The sign-in page steals your login and the attacker quietly redirects your pay.

What it looks like

Email · HR · Payroll

Action needed: confirm your salary details for the new pay schedule. Sign in with your company account to review.

How it usually ends

The link stole your sign-in and MFA code. The attacker changed your direct-deposit account in the HR system — and deleted the warning emails.

Red flags

HR-themed lure with a sign-in link
Sign-in page proxying your company login
Inbox rule hiding HR notifications

A real case

Microsoft tracked “payroll pirate” Storm-2657 diverting university salaries via Workday in 2025, after phishing MFA codes.

What to do

Open the HR portal yourself instead of using an email link.
Check your bank-detail settings in the HR system now and then.
Ask HR to require extra checks for any bank-detail change.

Could you spot it in the moment?

In Painted Sky you’re born at random somewhere on Earth and live a whole life — and this scam is one of the fakes that can find you. Make the call yourself, then replay the same life with a lens that shows what was fake.

Play Painted Sky — free →