Payroll diversion is a quiet, well-mannered fraud. An email arrives, apparently from a member of staff, asking to update the bank account their wages go to. New job, new bank, nothing dramatic. It is polite, it is plausible, and it is timed with care to land in the days just before the payroll run, when whoever handles wages is busiest and least inclined to query a routine-looking request.

The account in the message belongs to the criminal, not the colleague. If the change goes through, the next salary payment - often a full month's pay - lands in their account instead, and the real employee only finds out when their wages do not arrive. By then the money has usually been moved on and is very hard to recover. One small edit, made under time pressure, does the whole job.

The timing is not a coincidence and it is your best warning sign. Fraudsters watch for payday because that is when a bank-detail change is both most useful to them and least likely to be questioned. A request to change salary details that happens to arrive in the tight window before a run deserves more suspicion, not less, however ordinary it looks.

The defence is a verification step that does not depend on the email. Any change to where wages are paid is confirmed by speaking to the employee directly - in person or on a number already in their staff record, never a number or reply address from the request itself. It adds a minute and it stops the fraud cleanly, because the criminal cannot answer that call.

Make it a standing rule rather than a judgement call, and tell staff it exists. When people know that every bank-detail change is checked by a phone call, the fraud loses its footing, and a genuine employee changing banks understands the small delay rather than taking offence.