How to Spot a Fake Payroll Email

A payroll email just landed in your inbox. It says your direct deposit needs updating, and it wants you to use its button. Pause and count the flags before you touch anything. This phishing quiz walks through one fake message, flag by flag.

The message is fictional. It claims to be from Northlight Works, a made-up employer created for this episode and labelled fictional on screen. Its subject is "Action needed: direct deposit", and it carries an UPDATE DIRECT DEPOSIT button. No real employer sent it. The four red flags in it are real.

Flag 1: You never asked for this change

The first flag is the arrival itself. You never asked to change your direct deposit at work. This request arrived unexpected, out of nowhere.

That pattern is a known sign. The Federal Trade Commission says you might get an unexpected email or text message that looks like it is from a company you know or trust. Such a message may say you need to confirm some personal or financial information, or invite you to click a link to update your payment details. A direct-deposit update you never started fits that pattern.

Microsoft gives the matching rule: never open links or attachments you were not expecting. So the first check is simple. Did you start this change? If no, do not click the links in the message.

Flag 2: The sender address does not match

The second flag is in the sender line. The message claims to be Northlight payroll, but its only address is payroll-update@secure-notice.example — an outside domain, not the employer's own.

Check the actual address, not just the name shown. Microsoft puts it plainly: if a message claims to be from your bank but the sender's address is not your bank's domain name, that should be a "loud warning". The same check applies here, with the claimed payroll sender in place of the bank.

CISA's own example turns on the same mismatch: the email address was not from the vendor's domain. A display name can look familiar. The address underneath it is the part to compare.

Flag 3: Payroll closes today

The third flag is the deadline. The bait says payroll closes today, and your pay will be delayed if you do not update now. That deadline is part of the fiction. The pattern it shows is real.

CISA's example identifies urgent messaging as part of a login credential attempt, and the person in it now pauses at urgent messages requesting information. Microsoft describes the same pattern: an urgent request, something will be cancelled or penalised, and you have to act now. The urgency is there to get you to act without thinking too much.

A deadline tied to your pay is pressure, meant to stop you checking the other flags.

Flag 4: The button leads to a fake sign-in

The fourth flag is where the button leads. It does not lead to a real payroll page. It leads to a fake sign-in asking for your bank and login details.

Microsoft says the website behind a link like this will likely be a fake version of a legitimate website, designed to fool you into entering your username and password, or other personal information, so it can be stolen. In CISA's example, the fake site is where hackers stole a password and credit card information.

So the button is the trap, not the fix. Skip it. Contact payroll yourself through a channel you know is real, never the message link.

How to stay safe

Skip the message's button and link. Do not click links in unexpected messages.

Contact payroll yourself, through a channel you know is real. The Federal Trade Commission says to "contact the company using a phone number or website you know is real — not the information in the email." Microsoft says to go directly to the organisation yourself rather than using the message's link. In CISA's example, the person types the site's address directly instead of clicking a link in an email.

Run the four checks before you act. Did you ask for this change? Does the sender address match? Is a deadline rushing you? Does the button lead to a sign-in asking for bank and login details? One flag is enough to stop.

To practice on other lures, try the fake document quiz and the password reset quiz.

If you already did it

If you clicked the button, or entered bank or login details on the sign-in it led to, do not go back through the message to fix it. Do not use its link, button, or contact information.

Use the sourced remedy instead, in this order. First, stop using the message and anything in it. Second, contact payroll yourself through a channel you know is real — not the information in the email — and tell them what the message asked for and what you did. That direct contact is the remedy the Federal Trade Commission, Microsoft, and CISA guidance gives for this kind of bait, and the recovery step this briefing can support from the fact sheet.

Sources: CISA — Recognize and Report Phishing ↗ · FTC — How To Recognize and Avoid Phishing Scams ↗ · Microsoft Support — Protect yourself from online scams and attacks ↗