The Employee Received a Fake HR Document: How to Investigate Payroll Diversion and Employee Identity Fraud

An employee receives an email that appears to come from Human Resources. It contains a document about payroll, employee benefits or an update to personal information. The message looks official and says that action is required before the next pay cycle.

The employee opens the document and follows the instructions. They may be asked to confirm their identity, update their bank details, sign in to an employee portal or provide personal information.

A few days later, their salary does not arrive.

When the payroll team investigates, they discover that the employee’s payment details may have been changed without authorisation.

This type of incident can involve fake HR documents, employee impersonation, compromised email accounts, phishing websites or unauthorised changes to payroll records. In some cases, attackers target employees directly. In others, they impersonate HR staff or exploit access to internal business systems.

The consequences can extend beyond a missed salary payment. Personal information may be exposed, employee accounts may be compromised and fraudulent payment instructions may affect multiple people.

Investigating the incident requires more than checking whether a document looks genuine. It involves examining the original communication, verifying the document’s source, reviewing account activity and reconstructing how payroll information may have been altered.

This guide explains how to investigate fake HR documents, payroll diversion and employee identity fraud while preserving the digital evidence needed to understand what happened.

1. Understand How Fake HR Documents Are Used

Fake HR documents are designed to look like ordinary workplace communications.

An attacker may impersonate an HR department, payroll administrator, recruitment team or external benefits provider. The message may claim that employees must complete an urgent task.

Common themes include:

• Payroll information updates.
• Changes to employee bank details.
• Tax or salary documentation.
• Benefits enrolment.
• Employment contract updates.
• Staff policy acknowledgements.
• Direct deposit verification.
• Annual leave or pension information.
• Requests to confirm personal details.

The document may be attached to an email or hosted on a website that imitates an internal employee portal.

Some messages use urgency to discourage employees from checking the request. Others exploit the assumption that HR communications are routine and trustworthy.

The investigation should establish who created or sent the document, whether the request was authorised and what happened after the employee interacted with it.

2. Preserve the Original HR Email and Document

The first step is to preserve the original communication.

Do not rely exclusively on a screenshot or a printed copy. These may show the visible content but omit important technical information.

Where possible, retain:

• The original email.
• Full email headers.
• Sender and recipient addresses.
• Subject line.
• Date and time received.
• Message ID.
• Attached documents.
• Original download files.
• Embedded links.
• Related email conversations.
• Any replies sent by the employee.

Preserve the document in its original format, whether it is a PDF, Word file, spreadsheet or another file type.

Record the filename, file size and available metadata. If a forensic examination is required, a cryptographic hash may help establish whether the preserved file changes during handling.

Do not open suspicious attachments repeatedly or forward them casually. If malware is suspected, use an appropriate controlled examination process.

For more information about preserving original communications, see Cyb3rsect’s Email Forensics resources.

3. Verify Whether the Request Actually Came From HR

A familiar display name does not establish that a message was sent by an authorised HR employee.

Investigate the sender’s address and compare it with previous legitimate communications.

Check:

• The complete email address.
• The domain spelling.
• The Reply-To field.
• The Return-Path.
• The Message-ID.
• The email routing information.
• Authentication results.
• Previous communications from the same sender.
• Whether the HR department recognises the request.

A message may come from a lookalike domain that differs from the organisation’s genuine domain by only a few characters.

Alternatively, the message may originate from a genuine company mailbox that has been compromised.

Email authentication checks such as SPF, DKIM and DMARC can provide useful information about domain-level message authentication. However, a message passing these checks does not prove that the request was authorised by the employee or department named in the email.

Verify the request through an independently established HR contact or internal communication channel.

4. Examine the HR Document for Signs of Manipulation

A fraudulent HR document may imitate an organisation’s branding, logo, formatting and internal terminology.

It might include an employee’s name, job title, department or other information that makes it appear genuine.

Examine the document for inconsistencies.

Potential areas of review include:

• Document author and creator information.
• Creation and modification timestamps.
• Embedded links.
• File properties.
• Unexpected forms or fields.
• Unusual wording.
• Inconsistent branding.
• Unexpected external contact details.
• Requests for information that HR would not normally collect.
• Instructions to bypass established procedures.

Metadata can provide investigative clues, but it should not be treated as definitive proof of who created a document. Metadata may be absent, altered or generated by the software used to open or save the file.

Compare the suspicious document with a known legitimate HR document if one is available. Record the differences rather than relying on appearance alone.

5. Investigate the Website or Employee Portal Behind the Document

Some fake HR documents contain links to websites that imitate an organisation’s employee portal.

The page may request:

• Employee login credentials.
• Payroll account details.
• Bank account information.
• Tax identification information.
• Date of birth.
• Authentication codes.
• Identity documents.

Preserve the URL as it appeared in the original message. The visible text may not match the actual destination.

Where safe and appropriate, examine the destination domain, DNS information, certificate details, redirects and page content in a controlled environment.

A website using HTTPS is not necessarily legitimate. Encryption protects the connection but does not establish that the website belongs to the organisation it claims to represent.

Do not enter employee credentials into a suspicious page to test it. Preserve the relevant details and use an appropriate technical examination process.

6. Determine Whether Employee Information Was Exposed

If an employee entered information into a fraudulent form, establish what information may have been disclosed.

Potentially exposed data may include:

• Full name.
• Home address.
• Date of birth.
• Employee identification details.
• Bank account information.
• Tax or payroll identifiers.
• Login credentials.
• Contact information.
• Identity documents.

Record what the employee remembers entering, but do not ask them to send passwords, authentication codes or other secrets through ordinary email.

The organisation should assess which systems and accounts may be affected and follow its data-protection and incident-response procedures.

If identity documents or financial information were exposed, the employee may need guidance from the relevant financial institution or official identity-protection authority.

The investigation should distinguish between information that was requested, information that was actually submitted and information that can be confirmed as accessed.

7. Review Payroll Records for Unauthorised Changes

Payroll records are central to a suspected payment-diversion incident.

Establish whether the employee’s payment information changed and when that change occurred.

Depending on the payroll system, relevant records may include:

• Previous bank details.
• Current bank details.
• Change-request forms.
• Date and time of the change.
• User account that submitted the change.
• Approval history.
• Administrator activity.
• Payroll processing records.
• Payment confirmation.
• Notifications sent to the employee.

Compare the changed information with the employee’s verified payment instructions.

Identify whether the change was submitted through the normal HR process, an employee self-service portal or an administrative account.

Do not assume that the employee personally made the change simply because the update appears under their account. An account may have been compromised, or the record may have been modified by an authorised administrator.

8. Investigate Possible Employee Account Compromise

If the employee used a link in the fake HR document, their work account may have been exposed.

Review available authentication and security records.

Look for:

• Unfamiliar sign-ins.
• New devices.
• Unexpected password-reset activity.
• Unusual multifactor authentication prompts.
• Changes to recovery information.
• New connected applications.
• Suspicious mailbox forwarding rules.
• Unexpected access to cloud services.
• Unauthorised changes to employee records.

If the organisation uses a central identity-management system, administrators may be able to review sign-in and audit records across multiple services.

Compare suspicious activity with the employee’s normal working pattern and known devices.

An unfamiliar IP address or location is not conclusive evidence of an attacker. VPNs, remote work and mobile networks can affect the apparent location of a login.

9. Check Whether the Incident Affected Other Employees

A fake HR document may be part of a wider campaign.

An attacker may send similar messages to several employees, using a staff directory or compromised mailbox to identify likely targets.

Review whether other employees received:

• The same document.
• Similar payroll-update requests.
• Messages from the same sender.
• Links to the same website.
• Requests for identity information.
• Unusual authentication notifications.

Search available email and security records for matching subjects, URLs, file names and sender details.

If multiple employees were targeted, establish whether anyone submitted information or changed their payroll details.

The organisation should coordinate its response through the appropriate HR, IT, security and management teams.

10. Examine Whether HR or Payroll Accounts Were Compromised

Not every payroll fraud incident begins with an employee clicking a link.

An attacker may gain access to an HR or payroll administrator’s account and use that access to change employee records.

Investigate the accounts with authority to modify payroll information.

Relevant evidence may include:

• Administrator sign-in history.
• Changes to user permissions.
• New accounts or delegated access.
• Payroll-system audit logs.
• Changes to employee bank details.
• Unusual access times.
• Bulk record modifications.
• Password-reset activity.
• Connected applications.
• Changes to approval workflows.

Determine which account performed each relevant action and whether the action followed the organisation’s normal procedure.

Where possible, preserve the audit records before making major system changes. If an account is actively compromised, contain the access promptly while documenting the steps taken.

11. Trace the Payroll Payment and Contact the Bank

If salary has been redirected to an unauthorised account, the organisation and affected employee should contact the relevant bank or payment provider immediately.

Preserve:

• Payroll payment confirmation.
• Payment date and time.
• Beneficiary details.
• Transaction reference.
• Amount and currency.
• Bank correspondence.
• Fraud report reference.
• Any instructions received from the provider.

Ask the bank what steps are available to report the payment and attempt to stop or recall it.

A payment recall is not guaranteed. The available options depend on the payment system, the institutions involved and how quickly the incident is reported.

Avoid making assumptions about who controls the receiving account. Account ownership information may require formal processes and cannot necessarily be established from the payment record alone.

12. Build a Timeline of the HR and Payroll Incident

A clear timeline helps connect the fake document with account access and any changes to payroll information.

Event	Evidence to preserve
HR message received	Original email and headers
Document opened or downloaded	File details and available device records
Link accessed	URL and browser records
Employee information submitted	Employee account and incident records
Suspicious account access	Authentication and security logs
Payroll details changed	Payroll audit history
Payment processed	Transaction confirmation
Fraud discovered	Employee report and internal records
Bank contacted	Case reference and correspondence
Security response begins	Account changes and containment records

Use original timestamps where possible and record the relevant time zone.

Distinguish confirmed events from employee recollections and estimated times. This helps avoid presenting uncertain details as established facts.

13. What to Do If an Employee Receives a Fake HR Document

If an employee receives an unexpected HR or payroll request, they should verify it before submitting information.

Recommended steps include:

1. Do not follow unexpected links or open suspicious attachments.
2. Contact HR through an established internal channel.
3. Preserve the original email and document.
4. Report the message to the organisation’s IT or security team.
5. If credentials were entered, secure the account from a trusted device.
6. Review account sessions and authentication settings.
7. Check payroll records for unauthorised changes.
8. Contact the bank promptly if a payment was redirected.
9. Preserve transaction records and internal communications.
10. Follow the organisation’s incident-response and data-protection procedures.

Organisations should also review how payroll changes are verified. A bank-detail update should not rely solely on an email request or a single account login.

How Cyb3rsect Can Help Investigate Payroll Diversion and Employee Identity Fraud

A suspected payroll diversion incident may involve several sources of digital evidence.

The original HR email may reveal how the request was delivered. Document analysis may identify inconsistencies, while account and payroll audit records may help establish whether employee information or payment details were changed without authorisation.

Cyb3rsect focuses on digital forensics, cyber investigations and online fraud intelligence.

Depending on the available evidence and agreed investigation scope, an investigation may involve:

• Examining suspicious HR emails and attachments.
• Reviewing email headers and communication records.
• Assessing suspicious links and websites.
• Examining relevant employee account activity.
• Reviewing available payroll and administrative audit records.
• Comparing original and altered documents.
• Reconstructing the sequence of account and payment changes.
• Reviewing financial transaction information.
• Identifying technical inconsistencies and investigative leads.
• Preparing a structured report of findings and limitations.

An investigation cannot guarantee that diverted salary will be recovered or that every unauthorised action will leave recoverable evidence.

The objective is to establish what can be verified, preserve relevant records and provide a clearer understanding of how the incident may have occurred.

For digital forensics, cyber investigations and online fraud intelligence, visit Cyb3rsect.

Final Thoughts

A fake HR document can appear to be an ordinary workplace request. It may use familiar branding, employee information and convincing instructions to persuade someone to disclose sensitive details or change payroll information.

The most important step is to verify unexpected requests independently. Employees should not rely on the appearance of a document or the display name of an email sender as proof that a request is genuine.

If payroll information has already been changed, preserve the original communication, review the relevant account and payroll records, and contact the bank promptly if a payment has been redirected.

The investigation should establish who initiated the request, whether an account was compromised, how the payroll information changed and what evidence supports each finding.

For digital investigations and evidence-based analysis, visit Cyb3rsect.