{"success":true,"data":{"id":"payroll-direct-deposit-change-phish","label":"Fake HR/payroll direct deposit bank account change request — BEC variant targeting employees; real payroll changes go through authenticated HRIS portals (ADP / Paylocity / Workday / Gusto), never cold email.","description":"Fake HR or payroll direct deposit bank account change request — BEC variant targeting employees by impersonating HR, payroll department, or HRIS system. Real payroll/direct deposit changes are processed through authenticated HRIS portals (ADP Self-Service, Paylocity, Workday, Gusto) — cold inbound email requesting new bank account details for payroll routing is high-loss wire fraud. Detection: direct deposit change/update vocabulary + routing number/ACH details/banking form action + no List-Unsubscribe + no In-Reply-To + not protected sender. Trash score: +4. Source: GC1-R20; FBI IC3 payroll diversion BEC advisory 2025; ACFE payroll fraud report.","tier":"danger","category":"phishing","isThin":false}}