Key Insights
Organizations that want to prevent ID fraud need to act before routine workplace trust is exploited. These schemes are built to look ordinary, which makes them easy to miss until employee information or pay is affected. Preventing harm usually depends on recognizing risk early and building safeguards into the systems employees use every day.
Key Takeaways
Email spoofing drives most employee-targeted identity fraud, making email authentication protocols like SPF, DKIM, and DMARC foundational controls for prevention.
Payroll diversion and W-2 phishing are distinct BEC variants that exploit HR and payroll staff through impersonation of executives or coworkers.
Phishing-resistant MFA using hardware security keys stops credential theft even when an employee enters a password on a fraudulent site.
Separation of duties and dual-authorization requirements for sensitive changes create process-level barriers that no single compromised account can bypass.
How ID Fraud Targets Employees Through Email
Email is the primary delivery mechanism for identity fraud schemes aimed at employees, and attackers use it to exploit the trust embedded in everyday workplace communications.
Spoofing Executives to Steal W-2 Data
W-2 phishing is one of the most damaging schemes because it scales instantly. An attacker spoofs a CEO or CFO email address and sends a message to HR or payroll requesting a quick review of all employee W-2 forms. When the HR staffer complies, the attacker receives names, Social Security numbers, addresses, and wage data for the entire workforce. One email and one response can expose sensitive employee identity data across the organization.
Redirecting Paychecks Through Payroll Diversion
Payroll diversion takes a different approach. Instead of impersonating an executive, the attacker poses as a rank-and-file employee and emails HR requesting a change to their direct deposit banking information. HR processes the update, and the next paycheck is deposited into an attacker-controlled account. This is treated as a distinct sub-scheme within BEC because it targets individual employee wages rather than large corporate payments. The attack often goes undetected until the affected employee notices a missing paycheck.
Impersonating Vendors and Attorneys
Beyond internal impersonation, attackers also pose as vendors or legal counsel to target finance and operations staff who regularly process external payment requests. In a typical vendor impersonation attack, the fraudster sends a message appearing to come from a known supplier with updated banking details, directing future payments to an attacker-controlled account. Attorney impersonation follows a similar pattern, with the attacker pressuring staff to complete a wire transfer before a fabricated legal deadline. These variants fit within the BEC framework.
Technical Controls That Prevent ID Fraud at the Email Layer
Email authentication protocols are the first line of defense, and CISA classifies a full deployment as a low-cost, high-impact control.
Deploying SPF, DKIM, and DMARC Together
Email standards work together to verify that incoming emails actually come from who they claim. Sender Policy Framework (SPF) checks whether the sending server is authorized for the domain. DomainKeys Identified Mail (DKIM) uses cryptographic signatures to confirm the message has not been altered. Domain-based Message Authentication, Reporting & Conformance (DMARC) ties these together by enforcing alignment between the technical sender and the displayed From address.
Without DMARC, a fraudster can send email that appears to come from an executive's address while using a different technical sender to bypass SPF and DKIM individually. CISA guidance recommends setting DMARC to a reject policy for the strongest protection.
Requiring Phishing-Resistant MFA
Passwords alone provide inadequate protection because attackers can obtain them through phishing and other account-compromise methods. Standard MFA options like SMS codes or app-generated one-time passwords can also be intercepted in real time when an attacker operates a fake login page.
Phishing-resistant MFA, specifically hardware security keys using FIDO2/WebAuthn standards, addresses that problem. The key is cryptographically bound to the legitimate domain and will not respond to authentication requests from fraudulent sites.
Process Controls That Prevent ID Fraud Across Departments
Technical defenses handle the delivery channel, but process controls address the organizational workflows that attackers exploit once they get through.
Enforcing Separation of Duties for Sensitive Changes
Separation of duties means that no single person can authorize and complete a high-risk transaction alone. For identity fraud prevention, this applies directly to changes like updating direct deposit information, modifying employee tax records, or granting access to HR systems.
When a payroll change requires approval from a second authorized person through an independent channel, a single spoofed email can no longer complete the fraud chain.
Training Employees Early
According to the FBI IC3, business email compromise losses reached $2.77 billion in 2024 alone. Security awareness training helps reduce the likelihood that employees will fall for these schemes, but it works best when it starts early. Early training matters because employees in HR, payroll, finance, and IT may encounter suspicious requests before they have much institutional context for what normal communication looks like.
Annual refreshers maintain baseline awareness, and they reinforce the same warning signs that appear across email, payroll, and access workflows. Training alone does not eliminate risk, which reinforces why training and technical controls need to work together.
Warning Signs of ID Fraud in Progress
Detection depends on monitoring across email, HR, payroll, and IT systems, because the red flags often appear at different organizational touch points simultaneously.
Suspicious Email Patterns
Here are a few indicators worth watching for in email communications:
An apparent executive request asks for employee tax data or identity documents.
A message creates urgency around a financial transaction or sensitive information disclosure.
An onboarding email requests Social Security numbers or banking details outside a verified HR portal.
A contact asks an employee to receive company funds in a personal bank account.
A known vendor or partner sends updated banking details for invoice payments without prior discussion.
A message from an unfamiliar sender requests copies of identity documents such as driver's licenses or Social Security cards.
Any single one of these indicators should trigger verification through an independent channel before any data or funds are released.
Unexpected HR and Payroll Changes
Payroll and HR systems surface a different set of signals:
An employee's direct deposit information changes through an unverified channel without dual authorization.
Identity records do not match consistently across HR databases.
An employee reports not recognizing changes made to their own record.
Tax notices indicate someone else is using an employee's Social Security number for employment.
A change request arrives outside the normal self-service portal with no corresponding login activity from the employee.
HR staff should have a standard verification procedure for any change request that arrives through email or other informal channels.
Unusual IT Access Behavior
IT monitoring catches patterns that email and HR systems may miss:
Login attempts originate from locations inconsistent with the user's role or normal behavior.
Device attributes do not match the user's known devices.
Access entitlements exceed what the employee's current job function requires.
Transaction patterns diverge from the user's established baseline.
IT teams that correlate these signals with concurrent HR and payroll alerts can identify fraud attempts that span multiple systems, catching attacks that would go unnoticed within any single department's monitoring.
Frequently Asked Questions
Building Protection Into Every Process
Preventing identity fraud before it reaches employees requires technical defenses, process controls, and shared awareness across departments. Email authentication reduces spoofing. Phishing-resistant MFA protects credentials. Separation of duties adds friction to sensitive changes. When HR, IT, and finance treat these attacks as a connected problem, they are better positioned to catch suspicious activity before it turns into employee harm or payroll loss.
