Security awareness for HR staff: payroll diversion and W-2 scams
For HR coordinators, generalists, payroll administrators and anyone who can change employee pay details or release employee records. No prerequisites beyond everyday email use; 'Business email compromise and payment fraud' is recommended first. Finance staff should also take 'Security awareness for finance staff', which covers supplier payments. This course covers the HR side: direct deposit change requests, take-over of employee self-service accounts, requests for W-2s and other employee data, and the US reporting routes the IRS and FBI give. It is written for US employers. Your organisation's HR, payroll and incident procedures come first. This course is not legal advice or tax advice.
- Level
- Beginner
- Length
- About 72 minutes
- Contents
- 5 lessons · final exam
- Status
- Published · updated 10 Oct 2026
Skills you'll practise
- Recognise payroll diversion attempts, including emailed direct deposit changes and take-over of employee self-service accounts
- Verify a direct deposit change with the employee through contact details HR already holds before the change takes effect
- Identify requests for W-2s or other bulk employee data that impersonate executives, and hold the data until the request is verified
- Report W-2 phishing and W-2 data loss through the routes the IRS gives, alongside internal reporting
- Protect HR and payroll system accounts with MFA, separate passwords and prompt reporting of a phishing click
Course outline
- 1.Recognising payroll diversion attemptsLesson · 15 min
- 2.Verifying a direct deposit change before it takes effectLesson · 14 min
- 3.Identifying W-2 and employee-data requests that impersonate executivesLesson · 14 min
- 4.Reporting W-2 phishing and W-2 data lossLesson · 15 min
- 5.Protecting HR and payroll system accountsLesson · 8 min
- 6.Security awareness for HR staff: payroll diversion and W-2 scams: knowledge checkKnowledge check · 14 questions
- 7.Security awareness for HR staff: payroll diversion and W-2 scams: practical exerciseKnowledge check · 1 question
- 8.Final exam10 questions · passing it completes the course, so people who already know the material can test out
Sources it draws on
The lessons and questions are written from these references, so learners can go back to the original.
- FBI IC3 PSA: Cybercriminals Utilize Social Engineering Techniques To Obtain Employee Credentials To Conduct Payroll Diversion (18 September 2018)
- FBI IC3 PSA: Business Email Compromise: The $50 Billion Scam (9 June 2023)
- FBI IC3: Business Email Compromise (crime information and reporting steps)
- IRS: Report phishing and online scams (last reviewed 30 July 2026)
- IRS: Form W-2/SSN data theft: Information for businesses and payroll service providers (last reviewed 12 May 2026)
- IRS news release IR-2017-20: Dangerous W-2 phishing scam evolving; targeting schools, restaurants, hospitals, tribal groups and others (2 February 2017)
- CISA: Avoiding Social Engineering and Phishing Attacks (1 February 2021)
- UK NCSC: Phishing attacks: defending your organisation (reviewed 13 February 2024)
See it with your own jobs and topics
Tell us about your team and we'll walk you through setup, from choosing jobs to your first skills check.