Oregon Payroll Fraud Prevention: A Change-Control Guide

Quick answer: verify changes before releasing payroll

Treat a payroll bank-account change as a payment instruction that needs independent verification. Confirm the request through contact information already on file, have a second authorized person review it when possible, and check the final payment destination before releasing payroll. An email from a familiar name is not enough.

For a Bend shop, Redmond contractor or small professional office, the useful safeguard is a repeatable workflow. The recommendations below draw on longstanding FBI and CISA guidance, not a newly enacted Oregon fraud law or a new October warning. They complement normal payroll procedures.

Know the two routes into payroll diversion

The Oregon FBI payroll-phishing advisory describes criminals stealing an employee's login credentials, entering the employer's HR system and replacing direct-deposit details. Attackers may also change settings that would otherwise notify the employee. That advisory dates to October 16, 2018.

The IC3 payroll-diversion advisory describes another route: a spoofed or compromised email appears to come from an employee and asks payroll staff to change the deposit account. A believable message and a valid-looking account number can still send wages to the wrong person. This September 10, 2019 advisory supports the control lesson, not a claim about today's fraud frequency.

Use one controlled intake route

Set a documented route for employee banking changes, payroll-funding changes and instructions affecting tax payments. A secure payroll portal can collect requests, but collection is only the first step. Record who requested the change, which employee or business account it affects, its requested effective date and the person responsible for verification.

Keep sensitive banking data in the approved payroll system. Do not let a text message or last-minute attachment bypass verification. Include an exception process for legitimate requests near cutoff.

Verify through a channel the requester did not supply

IC3 recommends secondary-channel verification for account-information changes. Call the employee using an established number in your records, speak in person, or use another independently verified channel. Do not call a new number in the change email: an attacker can answer that call and confirm the instruction.

Confirm the requested change and intended timing without asking the employee to send passwords or authentication codes. For a provider or funding instruction, contact a known representative through a previously established channel. Record the verification result; a bank-format check alone does not establish who controls the account.

Separate entry from approval where practical

Use a maker-and-checker process: one authorized person enters the change, and another compares it with the verified request. This is a recommended operational control, not a claim that Oregon requires two reviewers for every payroll edit. A sole owner can arrange a documented review handoff with the payroll provider instead of sharing logins.

• Request record: employee or business identity, requested change and effective payroll date.
• Verification record: established contact channel, verifier and confirmation timestamp.
• Approval record: authorized reviewer, decision and any unresolved exception.
• Release record: masked payment destination, payroll date and completed comparison.

Protect accounts and preserve useful alerts

CISA recommends MFA, with businesses aiming for phishing-resistant methods, and prioritizing administrative accounts and people handling sensitive data. Work with your IT or payroll provider to choose supported options. MFA reduces account-compromise risk; it does not verify the business legitimacy of every instruction entered by an authorized user.

• Give each authorized user a separate login; avoid a shared owner or payroll-administrator account.
• Review access when a role changes or someone leaves, including permissions to edit bank details.
• Send change notifications to previously verified contact details where supported, and review notification-setting changes.

Check tax deposits as well as employee deposits

For ordinary payroll-service-provider outsourcing, the IRS warns that forwarding tax funds to the provider does not remove the employer's federal tax responsibility. It recommends keeping the employer's IRS address of record and independently checking deposits through EFTPS. Your exact third-party arrangement matters; do not assume every arrangement transfers liability.

Compare payroll tax amounts and deposit confirmations with your own agency payment history, rather than relying only on a provider's internal report. Investigate a missing payment or unexpected instruction promptly. Automated exception alerts can reduce routine work, but the owner should retain an independent way to see notices and confirm payments.

Worked example: a change can hide inside a normal total

Assume a hypothetical eight-person business has $1,600 net pay per employee for one payroll. Total net pay is 8 × $1,600 = $12,800. If two deposits are redirected, $3,200 is at risk even though the payroll total is unchanged. This is an illustration, not a reported loss or a promise that controls prevent every incident.

• Review the change report: identify the two altered destinations before approving the payment file.
• Compare each change with its verified request and approval record, not just the $12,800 total.
• Escalate an unverified destination and arrange a lawful payment solution rather than ignoring the employee's payday.

A short checklist for the next payroll

Configure software to report exceptions rather than asking staff to reread every unchanged record. A focused change report can list new payment destinations, new administrator access, altered notification settings and unusual funding instructions. Assign a person to clear each exception before release.

• Confirm the authorized request route and publish it to employees and payroll staff.
• Verify each banking change through established contact information already on file.
• Record approval separately from entry, with a clear handoff for a sole-owner business.
• Compare the final payment file with approved changes before releasing funds.
• Check payroll tax deposits through your independent agency access and retain confirmations.
• Test the exception process, including how staff handle an urgent request near cutoff.

Common mistakes that weaken the process

Do not use urgency as a substitute for identity verification. A message asking staff to keep a change confidential, skip the usual approval or act before the bank closes deserves extra scrutiny. Even an accurate sender address is not conclusive when the account itself may be compromised.

• Replying to the same email thread and treating that reply as independent confirmation.
• Allowing one person to request, enter and approve a sensitive payment change without review.
• Checking only gross and net totals while overlooking changed payment destinations.
• Assuming a successful login or an automated confirmation proves the employee requested the change.

Respond quickly without losing track of wages

If money was misdirected, contact the financial institution immediately to request a recall, tell the payroll provider and report the incident to IC3. Preserve the original messages, change records, approvals and payment identifiers in a restricted file. Ask IT to secure affected accounts and assess unauthorized access; a recall is not a guarantee of recovery.

Oregon's ORS 652.120 requires regular paydays and payment of wages due; BOLI provides paycheck guidance. Do not treat a security investigation as permission to suspend wages indefinitely. Coordinate the lawful payment method and any correction with the provider and qualified counsel, especially when money has already left the account.

Build a manageable owner-and-provider handoff

Our Payroll services in Bend and Oregon small-business payroll pages explain local payroll support. Bring your current approval process to a payroll consultation and ask who verifies changes, who releases funds and how exceptions reach you. Ask about the existing first-month-free payroll offer when discussing a new service relationship.

If staff roles and procedures need documentation, our Fractional HR services page describes administrative policy support. IT specialists handle technical security and counsel handles legal questions. Clear responsibilities and exception-based review help you delegate routine payroll work without giving up oversight.

Sources and educational scope

Official sources were checked October 17, 2026. This guide provides general educational information and is not legal or tax advice. Joy Bunde, SHRM-CP, provides payroll and HR support, not attorney or CPA services. Security recommendations are practical controls, not a compliance guarantee or a promise of insurance coverage.

Frequently asked questions