Payroll Diversion Fraud

The first prosecuted cases targeted US universities from 2014 (Georgia Tech, University of Virginia) from Malaysia; the FBI's IC3 issued its first public alert on payroll diversion in September 2018.

Payroll diversion is a business email compromise variant that appeared once employers let staff change direct-deposit details online or by email. The FBI's IC3 issued its first public warning in September 2018 and reported an 815% rise in losses between January 2018 and mid-2019. Early cases were phishing attacks on universities - Nigerian nationals Olaniyi and Ibiwoye targeted Georgia Tech and the University of Virginia from 2014 - and the technique later moved to spoofed 'employee' emails to HR and to bulk compromise of payroll-provider portals (Charles Onus, 5,500 accounts).

The attacker either phishes an employee's HR-portal login and changes their direct-deposit account to a mule or prepaid card, or emails HR from a lookalike address in the employee's name asking to 'update my bank details before payday'. The next salary run lands in the attacker's account and is withdrawn or laundered immediately; the fraud is usually discovered only when the employee reports a missing paycheque. Large-scale versions compromise thousands of accounts at a payroll provider. Stolen portal access also exposes W-2 tax forms, which are used to file fraudulent refunds.

A single phishing email or a spoofed 'update my bank details' message is enough, and payroll runs are large and predictable; Charles Onus took $800,000 from 5,500 accounts with no malware. Each diverted salary is modest, so most cases fall below the threshold for federal investigation, and only a handful of operators have been prosecuted in a decade.

The FBI's last standalone figure was $8.3 million across 1,053 complaints for January 2018-June 2019 (IC3, 2019); since then it is counted within BEC, which reached $3.04 billion in 2025. The biggest single case is the $6 million-plus university scheme run by Olaniyi and Ibiwoye. Non-money harm: employees miss rent and bills, and compromised HR portals expose W-2 data used for tax-refund fraud.