New Cyber Risk: Hackers Accessing Payroll

Phishing scams aimed at accessing employees’ direct deposit funds are emerging as a new danger, according to Beazley P.L.C.

Here’s how it works: Once hackers have access to an employee’s email, they request a password reset from the organization’s payroll provider and change the employee’s inbox forwarding instructions to send all emails from the payroll provider to the target’s junk mail. The hackers then change the employee’s direct deposit bank account details to their own to steal funds.

Scammers may also access the employee’s W2 information and file a fraudulent tax return, said Beazley in its analysis of the 641 incidents it managed during the first quarter. 

Most direct deposit phishing attempts occurred in the higher education sector, where hacks and malware caused 48 percent of data breaches during this year’s first quarter.

“Organizations continue to face increasingly sophisticated threats as hackers adapt and employ new methods to seize data and funds,” Katherine Keefe, Philadelphia-based global head of the breach response services unit, said in a statement.

Source: Business Insurance