{"success":true,"data":{"id":"payroll-portal-credential-harvest","label":"Payroll portal credential harvest","description":"Attacker impersonates a payroll or HR platform (ADP, Workday, Gusto, Paychex, Rippling, Ceridian, BambooHR, UKG) and asks the recipient to update their direct deposit banking details or re-enroll for payroll via a phishing link — success diverts entire paychecks to attacker-controlled accounts; FBI IC3 consistently lists payroll diversion as a top BEC sub-category; legitimate payroll vendors never request banking changes via unsolicited email.","tier":"danger","category":"phishing","isThin":false}}