Payroll Is Now a Cyber Target — What Finance Teams Need to Do Differently
There's a particular type of email that finance teams dread — and fraudsters have figured that out.
It looks like an ordinary HR or payroll request. A staff member asking to update their bank details before the next pay run. A supplier requesting a payment to a new account. An urgent approval from someone in the executive team who needs a transfer processed today. The language is familiar, the context plausible, and the urgency just high enough to compress the time available to verify.
What's changed in 2026 is how convincingly these can be faked — and how specifically payroll workflows are being targeted to do it.
|
$166.8M
lost to payment redirection scams in Australia in 2025 — largely business-facing, targeting accounts payable and payroll workflows
(ACCC Targeting Scams Report, 2025) |
1 in 3
Australian employers are not fully confident they are paying employees correctly — a governance gap that also creates vulnerability to undetected payroll fraud
(Yellow Canary State of Payroll Compliance, 2026) |
|
30%
board engagement in payroll oversight — meaning most boards are not actively reviewing the controls around one of the organisation's largest cost lines
(AICD, 2026) |
5 words
most common in phishing emails targeting business finance teams: urgent, sign, review, invoice, payment — exactly the language of a normal payroll workflow
(KnowBe4 Phishing Threat Trends Report, 2025) |
What's Actually Happening
The threat vector that concerns me most right now is not a sophisticated technical hack. It's social engineering — specifically, AI-enhanced social engineering targeting the people in finance who process payroll changes and payment approvals.
AI voice cloning and deepfake video are now being used to impersonate executives and finance managers in targeted fraud attempts. A call that sounds like the CFO authorising an urgent payment. A video message from the CEO explaining why a bank account change needs to happen before end of day. These are no longer edge cases from overseas crime reports — ASIC, the ACCC, and CERT Australia have all flagged the increasing sophistication of AI-powered business fraud in 2025 and 2026.
What makes payroll workflows particularly attractive to fraudsters is exactly what makes them efficient for legitimate use: they are recurring, they involve large aggregate amounts, the language is familiar, and approvals are often informal — particularly at smaller organisations where the payroll manager and the payment approver are the same person.
The Three Payroll Entry Points Attackers Use
Bank detail change requests. A staff member's email is compromised, or spoofed convincingly, and a request comes in to update bank details before the next pay run. Without a verification step that goes outside the email channel, there's nothing to distinguish a legitimate update from a fraudulent one. By the time the real employee reports non-payment, the money is gone.
Payroll system access. If a payroll officer's credentials are compromised — through phishing, credential stuffing, or an unprotected device — an attacker with system access can change multiple employees' bank details in a single session. The impact compounds rapidly.
Fake payment approvals. Business email compromise targeting the accounts payable function — suppliers requesting payment to new bank accounts, urgent transfers requested by spoofed executive emails — operates on the same principle and has cost Australian businesses hundreds of millions annually.
What Controls Finance Teams Should Have In Place
The encouraging thing about this risk is that it's largely controllable through process — not technology spend. The fundamental controls are straightforward:
- Out-of-channel verification for all bank detail changes. Any request to change employee or supplier bank details must be verified via a separate channel — a phone call to a number already on record, not a number provided in the request. This one control stops the majority of bank detail fraud.
- Maker-checker on payroll processing. The person who enters payroll data should not be the same person who approves the payment run. This is basic segregation of duties and still absent in many smaller NFPs and SMEs.
- Multi-factor authentication on payroll system access. Non-negotiable in 2026. If your payroll system doesn't support MFA or your team hasn't enabled it, that's an immediate priority.
- A clear escalation protocol for unusual requests. Staff need to know what to do when something feels off — and that acting cautiously won't be penalised. The culture of "just get it done" is one of the most exploited vulnerabilities in payroll fraud.
- Regular review of active payroll records. Ghost employees, duplicate bank details across multiple staff, and bank accounts changed without corresponding HR documentation are all detectable through periodic payroll audits. They're also all things that get missed when payroll is treated as a purely operational function.
Where AI Fits — On Both Sides
AI is the tool attackers are using to make fraud attempts more convincing. But it's also increasingly part of the defensive toolkit. Payroll anomaly detection — flagging unusual patterns like multiple bank detail changes in a short period, new accounts matching known fraud patterns, or payment runs that deviate from historical norms — is now a feature in several payroll and finance platforms rather than a bespoke enterprise capability.
For most Australian SMEs and NFPs, the practical starting point isn't AI detection tooling — it's the process controls above. But it's worth knowing that the technology is moving in a useful direction, and that embedding structured data practices in payroll now makes it easier to leverage those tools as they become more accessible.
If your organisation's payroll controls haven't been reviewed recently — or if you're not sure what "recently" means in this context — PFL works with NFPs, NDIS providers, and SMEs on finance process and compliance reviews, including payroll governance.
Talk to PFL →
Comments
Post a Comment