Payroll Security: What It Means for Employers

What it means in practice

Payroll holds employee identity data and money in motion: the names, Social Security numbers (SSNs) and wages on each Form W-2, and the net pay sent by direct deposit over the ACH network, plus the employer's own tax deposits. Guidance comes from the IRS, the FBI's Internet Crime Complaint Center (IC3), the Federal Trade Commission (FTC) and the Cybersecurity and Infrastructure Security Agency (CISA). This page summarizes what each says; the agencies describe practices that reduce risk, not guarantees.

The Form W-2 scam. The IRS says criminals spoof an email so it appears to come from an executive; it goes to someone in payroll or human resources and requests a list of all employees and their Forms W-2. The IRS calls this business email compromise (BEC) or business email spoofing. A Security Summit video script describes three versions: the W-2 variant; a fake invoice "with wire instructions for a bank account that the threat actor controls"; and "the direct deposit variant, or sometimes referred to as payroll diversion," which is "a request to change direct deposit information to an account the threat actor controls."

Payroll diversion, as the FBI describes it. FBI PSA I-091818-PSA (September 18, 2018) explained the pattern: phishing emails capture an employee's login; the criminal enters the employee's online payroll account, changes the bank details, adds rules that block alerts about direct deposit changes, and redirects pay to an account "which is often a prepaid card." PSA I-042425-PSA (April 24, 2025) added fake search ads that imitate employee self-service websites; criminals may also phone victims posing as a bank representative to get a one-time passcode. The FBI said thousands of spam emails arriving in a short period can signal a compromised account, because the spam buries the real notice.

How large the problem is (dated figures). IC3 figures come from complaints and filings reported to the FBI. The 2025 IC3 report counts 24,768 BEC complaints in 2025 (21,442 in 2024) and reported BEC losses of $3,046,598,558 in 2025 ($2,770,151,146 in 2024), and says businesses reported 2025 losses of over $30 million to BEC scams involving artificial intelligence. PSA I-091124-PSA (September 11, 2024) reported $55,499,915,582 in exposed BEC losses from October 2013 to December 2023.

What the FBI recommends. The 2018 PSA recommends educating the workforce about payroll diversion; telling employees never to supply logins or personal information in response to an email; keeping payroll credentials different from those used for other purposes; applying "heightened scrutiny" to employee requests to change direct deposit details; monitoring logins outside business hours; and two-factor authentication on sensitive systems. The 2024 PSA adds: "Use secondary channels and/or two-factor authentication to verify requests for changes in account information." The 2025 PSA suggests bookmarks instead of search results and warns that "Multi-factor authentication will not protect you if you land on a fraudulent login page."

What the IRS recommends. In IR-2026-119 (October 2, 2026), the IRS said "requests to change sensitive employee or payment information should be verified through a trusted channel" and urged multifactor authentication where available. The Security Summit script adds: "Always verify the sender's address and not just the display name."

Protecting stored payroll records. The FTC's Protecting Personal Information: A Guide for Business rests on five principles: take stock, scale down ("Keep only what you need for your business"), lock it, pitch it ("Properly dispose of what you no longer need") and plan ahead. It names meeting payroll as a function that needs personal information, and advises using SSNs "only for required and lawful purposes," not as employee ID numbers; keeping paper files and backups in a locked room or cabinet; screening employees who will access sensitive data; and considering multi-factor authentication.

IRS Publications 4557 and 5293. These IRS guides are written for tax professionals, not employers generally, but address the same data. Publication 4557 (Rev. 6-2024) lists auto-updating anti-malware, unique passwords of 8 or more characters, multi-factor authentication, encryption, backups to a source not connected full time to a network, need-to-know access, audit logs, and immediately deactivating a terminated employee's passwords and user names.

CISA guidance for small businesses. CISA's Cyber Guidance for Small Businesses (updated April 2024) asks the owner to name a security program manager, who keeps an incident response plan and makes sure staff use MFA "to log into key systems, especially email," and asks the IT lead to patch systems, test backups and encrypt laptop drives.

SSNs on Forms W-2. The 2026 Form W-2 and W-3 instructions let employers truncate SSNs on employee copies (for example, ***-**-1234). Truncation is voluntary, is not allowed on Copy A filed with the Social Security Administration, and an EIN may not be truncated on any form.

Payment security when a provider runs payroll. Publication 15 (2026) says an employer that outsources payroll tax duties to a payroll service provider or other third-party payer generally remains responsible for them, including liability for the taxes (certified professional employer organizations are an exception), and the IRS may assess penalties and interest if deposits are missed. The IRS "strongly recommend[s]" keeping the employer's own address of record, and says the EFTPS Inquiry PIN lets the employer "monitor its account and ensure the third party is making the required tax deposits." The IRS Outsourcing Payroll Duties page says a red flag should go up "the first time a service provider misses a payment or makes a late payment."

The FTC Safeguards Rule: who it covers. The rule implements the Gramm-Leach-Bliley Act and applies to "financial institutions" under FTC jurisdiction, meaning businesses significantly engaged in financial activities; its examples include payday lenders, check cashers, wire transferors and tax preparation firms (16 CFR 314.1, 314.2). It protects "customer information" about consumers who obtain financial products for personal, family or household purposes. Covered businesses need a written information security program with a qualified individual, risk assessment, safeguards such as MFA and encryption, training and an incident response plan; some elements do not apply below 5,000 consumers (16 CFR 314.6). Under a November 13, 2023 amendment (88 FR 77508), effective May 2024 per the FTC, unauthorized acquisition of unencrypted customer information of at least 500 consumers must be reported to the FTC within 30 days of discovery (16 CFR 314.4(j)).

If payroll money is diverted. The 2024 PSA says "time is of the essence": contact your financial institution immediately to request a recall of the funds, and file at ic3.gov regardless of the amount. The 2025 PSA says prompt reports with complete transaction information may let the IC3 Recovery Asset Team help freeze funds. The 2018 PSA asks victims to note "payroll diversion" in the complaint.

If W-2 data is lost. The IRS asks for an email to [email protected] with the subject "W2 Data Loss" giving the business name, the EIN tied to the loss, a contact name and phone number, how the loss happened and the number of employees affected, with no employee personal information attached. It also points to the Federation of Tax Administrators ([email protected]) for state tax agencies and to an IC3 complaint. A scam email not acted on should be saved as a file and attached to an email to [email protected] (subject "W2 Scam"), not simply forwarded, because the IRS needs the headers. The FTC's Data Breach Response: A Guide for Business covers securing systems and notifying law enforcement, affected businesses and individuals.

Business identity theft and Form 14039-B. The IRS says to use Form 14039-B when someone is using a business's name or EIN, with signs such as a rejected e-filed return because one is already on file, a notice about Forms W-2 the business did not file, or a balance-due notice it does not owe; the form is not needed for a breach with no tax impact. Separately, Publication 15 (2026) says identity protection services an employer gives employees are not included in their gross income.

Where states differ. The FTC's breach guide notes that all states, the District of Columbia, Puerto Rico and the Virgin Islands have breach notification laws, and they are not uniform. Two examples: the Texas Attorney General says a breach affecting 250 or more Texans must be reported to that office as soon as practicably possible and no later than 30 days after discovery, and affected consumers must be notified. The California Attorney General says a business required to notify more than 500 California residents must submit a sample copy of the notice under Civil Code 1798.82(f). Both rules count residents of that state, so one breach can involve several states' laws.

Retention and disposal. The IRS says to keep employment tax records at least 4 years "after filing the 4th quarter for the year." Under the FLSA, payroll records are preserved at least 3 years from the last entry (29 CFR 516.5) and time cards and wage rate tables at least 2 years (29 CFR 516.6). Records must be kept "safe and accessible," and centrally kept records produced within 72 hours of a Wage and Hour request (29 CFR 516.7). When records are no longer needed, the FTC and Publication 4557 describe shredding or burning paper and erasing or destroying electronic media.

Example: a direct deposit change by email. (Remindax illustration.) Two days before payday, a payroll clerk receives an email in an employee's name asking that pay go to a new account. This matches the "direct deposit variant" the IRS describes. The IRS ("verified through a trusted channel") and the FBI ("secondary channels") both describe confirming such requests outside the email thread. If pay has already gone out, the FBI's steps are to call the bank to request a recall and file at ic3.gov, noting payroll diversion.

FAQ: Does running payroll put my business under the Safeguards Rule? Coverage depends on whether a business is significantly engaged in financial activities (16 CFR 314.2(h)), and the rule protects customer information about consumers of financial products. Check the rule text or ask a professional about your business.

Why it matters and common mistakes

How Remindax helps

Related terms

See all terms in Payroll & Compensation Basics or browse the full HR Glossary.