Fake ADP Workforce Now payroll platform subscription payment failed, payroll licenses suspended, payroll processing disabled, or ADP access no longer active phishing

Phishing emails impersonating ADP (Automatic Data Processing) claiming the Workforce Now or Run payroll platform subscription payment has failed, payroll licenses are suspended, payroll processing is disabled, or ADP access is no longer active — directing them to update billing or restore access through a credential-harvesting portal. A distinct and extremely high-value attack category: ADP is the most widely recognized payroll brand in the world, processing payroll for 1 in 6 U.S. workers and serving 800,000+ businesses, making ADP impersonation uniquely plausible to any business owner or HR professional who uses ADP for payroll — even those who do not use the specific product being impersonated. Key facts: (1) ADP serves 800,000+ clients (ADP Workforce Now for mid-market: $150-$250/month base + $5-$15/employee/month; ADP Run for small business: $59-$180/month base; ADP TotalSource PEO: $100-$200/employee/month) including a significant portion of all U.S. businesses with 50-1,000 employees — ADP Workforce Now is the system of record for payroll tax calculation, direct deposit management, W-2 and 1099 generation, benefits deduction processing, and garnishment management; a suspension email that claims 'ADP payroll licenses are no longer active' is immediately credible to every HR manager and business owner who processes payroll on ADP, regardless of which ADP product they actually use; (2) The 'payroll suspended, licenses no longer active' hook carries maximum urgency because ADP's brand is synonymous with 'payroll' in the U.S. business market: unlike enterprise HCM platforms (Workday, SAP SuccessFactors) where the recipient must be a customer to be targeted effectively, ADP's ubiquity means the suspension hook works on a broader audience — business owners who use any payroll software recognize ADP and may be uncertain about whether they have an indirect ADP dependency (ADP is also used by many accountants and PEOs who process payroll on behalf of their clients); (3) ADP Workforce Now suspension creates immediate payroll liability: ADP is the actual payroll execution platform for most U.S. mid-market companies — unlike Workday (which calculates payroll but may use ADP as a payroll processor) or UKG (which tracks time but may feed into ADP for payroll execution), ADP Workforce Now is the final step in the payroll chain; a suspension that prevents ADP from processing the payroll run means employees do not receive ACH direct deposits on the expected pay date; for businesses on a Friday pay date schedule, a suspension notice arriving on Wednesday creates an immediate crisis with a 48-hour resolution window; (4) ADP's tax filing function creates a specific regulatory urgency hook: ADP files payroll taxes on behalf of its clients, and a 'suspended' ADP account creates the additional fear that tax deposits and 941 filings that ADP was scheduled to submit may not be made; missing a payroll tax deposit deadline triggers IRS penalties starting at 2% of the deposit and increasing rapidly; the combination of missed employee pay + missed tax deposits creates both employment and tax compliance emergencies simultaneously; (5) ADP credentials expose the complete payroll and compliance data architecture: every employee's direct deposit banking information (bank routing and account numbers), year-to-date earnings by compensation type, federal and state tax withholding records, all garnishment orders (child support, creditor garnishments, tax levies), W-2 and 1099 data for prior years, and the employer EIN (Employer Identification Number) and state tax account numbers used for payroll tax filings. Warning signs: sender not adp.com; genuine ADP billing at workforcenow.adp.com/theme/index.html#/settings/billing or run.adp.com; ADP never sends payment failure emails requiring immediate action via link.