Payroll Security: A Practical Guide for Small Business
What payroll security means, the fraud schemes targeting small employers, the controls that work without an IT team, and what to do after a breach.
Payroll Security
The threats that actually target small employers, the controls worth your time, and what to do in the first hour if something goes wrong
Almost every guide on this subject is written as though you have a security team. Encrypt data at rest, implement zero-trust architecture, conduct penetration testing. All reasonable, none of it actionable for a company where the person running payroll is also the person answering the phone.
Here is the version that matches reality. The attack most likely to cost you money is an email asking payroll to update someone's bank details before Friday. It requires no technical sophistication, it targets a person rather than a system, and the control that stops it is a phone call. No encryption involved.
This guide covers what payroll security means in practice, the specific schemes that target small businesses with no IT or security team, the controls worth your limited time in the order I would do them, and a first-hour playbook for when something goes wrong, which almost no small-business guide includes.
I build FirstHR for companies at this size. This is general information rather than legal or security advice.
What Is Payroll Security?
Payroll security is the set of controls, processes, and technologies a business uses to protect payroll data and payroll funds from theft, fraud, and unauthorized access.
The definition splits usefully into two halves that people tend to conflate. Protecting the money is about payments going where they should, which is threatened by both email fraud from outside and manipulation from inside. Protecting the data is about Social Security numbers, addresses, and bank details not leaving your control, which carries legal consequences separate from any financial loss.
Both matter, and the controls overlap, but the distinction is worth holding because the failure modes look completely different. A diverted paycheck is discovered within days when someone complains. A stolen W-2 file may not surface until employees start having tax returns rejected months later.
Why Small Businesses Are Targeted
Small businesses are targeted not because they hold more valuable data, but because they hold the same data with fewer controls around it, and attackers know it.
According to Occupational Fraud 2026: A Report to the Nations, from the Association of Certified Fraud Examiners (ACFE), which examined 2,402 cases across 143 countries and territories, the typical organization loses an estimated 5 percent of revenue to fraud each year. The median loss per case was $104,000, and cases ran a median of 12 months before being detected.
Two findings from that study land hardest on a small employer. More than half of the cases traced to either a lack of internal controls or an override of the controls that existed. And the smallest organizations in the study carried the highest median loss of any size band, which is the opposite of what most owners assume.
Missing controls describe exactly the situation a growing business is in: nobody has built the check yet, or one person is trusted enough to bypass it. Neither is negligence. Both are how a small company naturally operates until someone decides otherwise.
Payroll fraud also makes up a bigger share of the cases at small employers. In the same ACFE study, payroll schemes turned up in 13 percent of cases at organizations with fewer than 100 employees, against 8 percent at organizations with 100 or more.
The Threats That Actually Happen
Five schemes account for nearly everything a small employer will realistically face. Two come from outside, three from inside, and the countermeasures differ accordingly.
Notice the split between the outsider and insider tags above. Outsider attacks target a person, using email to make a fraudulent request look routine, and are stopped by verification procedures. Insider fraud exploits a process, using the absence of a second pair of eyes, and is stopped by separation of duties and review.
Investing in only one category is the most common structural mistake in small-business payroll security, because it leaves the other wide open.
Direct Deposit Diversion: The Highest-Value Fix
Direct deposit diversion is an email that asks payroll to send an employee's pay to an account the sender controls. If you do one thing after reading this, do this one. It is the attack with the best ratio of loss prevented to effort required, and the control is free.
The scheme is simple. Payroll receives an email that appears to come from an employee, asking to update their direct deposit details before the next run. The tone is casual and the timing is plausible. The new account is usually a prepaid card, and the funds are withdrawn before anyone notices the paycheck did not arrive.
Per an FBI Internet Crime Complaint Center public service announcement, 1,053 complaints reporting this email-based evolution of the payroll diversion scheme were filed between January 1, 2018 and June 30, 2019, with total reported losses of $8,323,354 and an average loss of $7,904 per complaint. The dollar loss from direct deposit change requests increased more than 815 percent over that period.
The rule needs a paper trail as much as it needs stating. One record per request turns a verification you remember doing into one you can point at, which matters for the change that was fine and even more for the one that was not.
The stronger version of this control removes payroll from the loop entirely: employees update their own bank details through a self-service portal protected by multi-factor authentication, and payroll never processes a change based on a message at all. If your system supports employee self-service, turning it on is a security decision as much as a convenience one.
W-2 Phishing
W-2 phishing is a request for the whole workforce's tax forms, sent by a criminal impersonating an executive. It is the second outsider attack, and the one with the worse aftermath, because it exposes every employee at once rather than diverting one paycheck.
A spoofed email appearing to come from a company executive lands with someone in payroll or HR, asking for a list of all employees and their Forms W-2. It arrives during tax season when such a request seems ordinary.
One reply hands over names, addresses, and Social Security numbers for the entire workforce. Criminals use that data to file fraudulent tax returns before the real employees file theirs.
The IRS maintains dedicated reporting channels for exactly this scheme, which tells you how routine it has become. Per the IRS guidance for businesses and payroll service providers, employers that lose data should email dataloss@irs.gov with W2 Data Loss in the subject line.
The data-loss email should give the business name, employer identification number (EIN), contact details, a summary of how the loss occurred, and the number of employees affected, without attaching any employee personal data. If the request arrived but nobody sent anything, report the email itself to phishing@irs.gov instead, with W2 Scam in the subject line.
Two controls prevent it. First, a standing rule that bulk employee data is never sent by email, to anyone, including the owner. Second, telling your team explicitly that no executive will ever email asking for W-2 information, so the request itself is the red flag rather than something to be evaluated on its merits.
Insider Fraud and Ghost Employees
Insider payroll fraud is theft by someone who already has legitimate access to the payroll process, and the ghost employee is its signature scheme. It is harder to talk about than email attacks, because it involves the possibility that someone you trust is stealing. The controls are not accusations. They are the things that make trust unnecessary.
The Cybersecurity and Infrastructure Security Agency (CISA) defines an insider as anyone who has or had authorized access to an organization's resources, and an insider threat as the potential for that access to be used to harm the organization. That definition covers the bookkeeper, the departed office manager whose login still works, and the accountant you share files with.
Ghost employees are the classic scheme: someone on the payroll who does not work there, either invented outright or a departed employee never removed, with pay routed to an account the perpetrator controls. It requires the ability to add or retain a payee without anyone checking, which is precisely what a one-person payroll function provides.
Inflated hours and rate changes are subtler: extra hours added to a timesheet, overtime that was never worked, or a pay rate nudged upward. Each instance is small enough to look like an error if caught, which is what makes the scheme durable.
The detection method for all of these is the same and takes fifteen minutes: compare the payroll register, the list of everyone you paid, against your actual roster, name by name, every quarter. Anyone being paid who should not be shows up immediately. Then check that pay rates match what was approved, and look at any overtime against the approvals.
| A | B | C | D | E | F | G | H | |
|---|---|---|---|---|---|---|---|---|
| 1 | Name on the payroll register | Employee ID | Department | On the current roster? | Last day, if departed | Rate matches the approved rate? | Action | Checked by |
| 2 | SAMPLE A. Rivera | SAMPLE 0042 | Service | Yes | Yes | None | SAMPLE You | |
| 3 | SAMPLE M. Oyelaran | SAMPLE 0051 | Front desk | No | Not checked | Stop pay, investigate before the next run | SAMPLE You | |
| 4 | ||||||||
| 5 | ||||||||
| 6 | ||||||||
| 7 | ||||||||
| 8 | ||||||||
| 9 | ||||||||
| 10 | ||||||||
| 11 | ||||||||
| 12 | Note | Work from the register outward. A ghost shows up as a name being paid that nobody on the roster recognizes. |
The Controls That Matter
The controls below are ordered by return on your time rather than by security-framework category. The first group closes most of the realistic risk and costs nothing.
The honest assessment: if you only ever do the first group, you have addressed the majority of what actually happens to businesses your size. Multi-factor authentication, two-channel checks on bank changes, and never emailing W-2 data together close both high-value outsider attacks. The second and third groups turn a set of good habits into something that survives staff changes and growth.
CISA's guidance for small and medium businesses lists the same control among its four essentials: strong passwords are no longer enough on their own, and multi-factor authentication can block many common attacks by requiring a second proof of identity. Start with the accounts that matter most here, which are payroll, business email, and the bank portal.
One item deserves emphasis because it is invisible until it matters: removing payroll access when someone leaves. Access lists drift constantly, and an ex-employee or ex-contractor with live credentials is a risk that grows with every departure. Making access removal a line on your IT offboarding checklist is what makes it happen reliably rather than when someone remembers.
Separation of Duties on a Tiny Team
Separation of duties means the person who prepares payroll is not the only person who sees it before the money moves. The textbook version is useless at small scale, so here is the one that works when a single person does everything administrative.
The reason this matters more than it sounds is the ACFE finding cited earlier: more than half of cases trace to missing controls or overridden ones. At a small company the control is usually missing rather than overridden, simply because nobody built it. Building the minimum version costs one review step per pay run.
What to Look For in Payroll Software
Your software choice handles the technical layer you cannot build yourself. Five features carry most of the weight, and they are worth checking before you buy rather than after.
| Feature | What it does | Why it matters at your size |
|---|---|---|
| Multi-factor authentication | Requires a second factor beyond the password to sign in | CISA warns that attackers can get past even a complex password; a second factor makes a stolen password insufficient on its own |
| Role-based access control | Limits what each user can see and change based on their role | Lets you give someone the access their job needs without exposing every salary and Social Security number in the company |
| Audit logging | Records who changed what and when, permanently | Makes changes attributable, which is both a deterrent and the only way to reconstruct what happened after an incident |
| Employee self-service | Employees update their own bank details and addresses | Removes the email-request attack path, because payroll never processes a change from a message |
| Independent security certification | A third party has audited the provider's security controls | You cannot audit a vendor yourself; a recognized certification is the practical substitute |
The last row is the closest thing to a shortcut available to a small employer. You have no realistic way to evaluate a vendor's internal security posture, so a recognized independent audit standing behind it is what you have instead. Ask for it during evaluation; a provider that cannot produce anything is telling you something.
Where Payroll Data Actually Lives
Payroll data protection starts with an inventory, because the payroll system is almost never the only place the data sits. Social Security numbers, bank account details, dates of birth, garnishment orders, and full wage histories accumulate copies as a business grows, and it is the copies that get lost.
The software features above protect what is inside the system. Everything below is what leaked out of it, usually for a good reason at the time, and it is where a small company is genuinely exposed.
| Where a copy ends up | Why it is there | What to do instead |
|---|---|---|
| Exported spreadsheets | Someone needed to check a number and the report was easier to read outside the system | Export to answer the question, then delete the file. A report you export every month is a report the system should be giving you directly. |
| Email to your accountant or bookkeeper | It is the fastest way to send a register or a tax form | A shared folder with a named access list, so the file lives in one place you can revoke rather than in two mailboxes permanently |
| Personal inboxes | New hire paperwork and tax forms arrive by email and stay there | Collect documents through a portal that files them against the employee record, then clear the mailbox |
| Laptops and phones | Payroll gets run from home and the downloads folder keeps whatever it is given | Work inside the system and skip the download. What was never on the device cannot leave with it. |
| Paper in a drawer | Signed forms, voided checks, and older files nobody digitized | A locked cabinet, a short list of who holds a key, and a shredding date rather than an indefinite pile |
Two habits do most of the work. Anything leaving the system travels as a link to a folder with a named access list rather than as an attachment, so access can be withdrawn later instead of living in someone else's inbox forever.
The second habit is disk encryption on every device that touches payroll. It means a lost laptop is a locked box, and on a current business laptop it is a settings toggle rather than a project.
Retention is the other half of this question, and it has its own rules: how long each record must be kept and how to destroy it properly are covered in the guide to payroll records.
The security side of retention is narrower. A record you no longer need is still a record that can be stolen, so the disposal date is a control and not just a filing convention.
Remote and Hybrid Payroll Processing
Remote and hybrid payroll needs a few extra rules, because payroll used to be run from one machine in one office and is now frequently run from a kitchen table. The assumptions built into older security advice no longer hold.
Four things change. The network is not yours, and home routers are patched less often than office equipment. The device may be personal, shared with family and running whatever software the household installed. Public Wi-Fi becomes a possibility for someone processing payroll from a coffee shop. And screens are visible to people who should not be seeing salary data.
The mini-policy is short enough to fit in an email: process payroll on a company-managed device, or a personal one that is password-protected and up to date; never over public Wi-Fi; always with multi-factor authentication; and never with payroll data downloaded to the local machine. That last rule does the most work, because data that stays in the system cannot be lost with the laptop.
If It Happens: The First Hour
In the first hour after a payroll incident the order is fixed: your bank, then the FBI, then the IRS if W-2 data was exposed, then the affected employees. This is the part you will need under pressure, when reading calmly is not an option, so print it or save it somewhere findable.
Two points explain the sequence. The bank comes first because recovery of diverted funds depends almost entirely on how fast the transfer is flagged, which is why the FBI tells victims to contact their bank immediately and request a recall.
The second point is timing for employees. Telling them comes early, not after you have finished investigating, because they need to act on their own behalf and the delay is what turns a data incident into a trust problem.
State breach notification law is the part that outlasts the first hour. Per the Federal Trade Commission's data breach response guide, every state, the District of Columbia, Puerto Rico, and the Virgin Islands have enacted breach notification legislation, so the question is not whether you have an obligation but which one applies and on what clock.
The notification rules themselves differ by state. Florida, for instance, requires notice to affected individuals without unreasonable delay and no later than 30 days after the breach is determined, with a Social Security number among the data elements that trigger the duty.
One thing is deliberately missing from the list: working out who is at fault. That question matters later and helps nothing in the first hour. The employee who replied to a convincing spoofed email did what the attack was designed to make them do, and treating it as a personal failure makes the next person hesitate to report, which is a far more expensive outcome.
Quick Self-Check
Six questions. Any no is a specific thing to fix this week rather than a general concern.
None of this requires security expertise. It requires deciding who can do what, verifying changes that move money, and looking at the payroll register four times a year.
Frequently Asked Questions
What is payroll security?
Payroll security means keeping both the money and the data in your payroll process out of the wrong hands. It deals with two different problems: outsiders who try to redirect payments or steal employee records, and insiders who take advantage of weak internal checks to be paid more than they are owed. In a small business it comes down to three habits: controlling who can open payroll, confirming any change to bank details before acting on it, and comparing what was actually paid with what should have been paid.
How do you keep payroll data secure?
Five habits do most of the work. Require multi-factor authentication on every payroll and email login. Give each person role-based access, meaning they see only what their job needs. Treat any request to change bank details as unverified until you confirm it through a second channel. Keep Social Security numbers out of email attachments and use a self-service portal for anything that must be shared. Finally, check who has payroll access every quarter, because access lists drift whenever people change roles or leave.
What is payroll fraud?
Payroll fraud is the manipulation of a payroll system to obtain money the perpetrator is not entitled to. The common schemes are ghost employees, where someone who does not work at the company remains on payroll; falsified hours or overtime; unauthorized changes to pay rates; expense reimbursement abuse; and direct deposit diversion, where bank details are changed so pay goes to an account the fraudster controls. Some schemes are run by insiders and some by outsiders using email deception.
How common is payroll fraud at small businesses?
Payroll fraud makes up a noticeably larger share of fraud at small employers than at big ones. The Association of Certified Fraud Examiners reviewed 2,402 cases for Occupational Fraud 2026: A Report to the Nations, and payroll schemes figured in 13 percent of the cases at organizations under 100 employees, compared with 8 percent at larger organizations. Across every type of fraud, the study estimates that organizations lose roughly 5 percent of revenue a year. Half of the cases ran a year or longer before anyone noticed, the middle case cost $104,000, and the median loss was highest at the smallest organizations. More than half of all cases came back to controls that were missing or that someone overrode, which describes most businesses where one person owns the entire payroll process.
What is payroll diversion fraud?
Payroll diversion is a type of business email compromise, meaning fraud that starts with a deceptive email. The criminal poses as an employee and asks payroll or HR to switch that person’s direct deposit to a new account before the next pay run. The new account is usually a prepaid card that is emptied fast. An FBI Internet Crime Complaint Center announcement counted 1,053 complaints about this scheme from January 2018 through June 2019, with reported losses of $8,323,354, an average of $7,904 per complaint, and said losses from direct deposit change requests grew by more than 815 percent across that span.
How do I stop direct deposit change fraud?
The answer is a rule with no exceptions: every bank detail change gets confirmed through a second channel before payroll touches it. When the request comes by email, phone the employee on a number already in your records rather than one given in the message. An even stronger option is a self-service portal protected by multi-factor authentication, where employees enter their own changes and payroll never acts on a message. The verification rule itself costs nothing, and it closes the route that the payroll diversion scheme depends on.
What is the W-2 phishing scam?
The W-2 phishing scam is an email, forged to look as if it came from a company executive, that asks someone in payroll or HR to send over every employee’s Form W-2. Those forms carry names, addresses, and Social Security numbers, so a single reply puts the whole workforce at risk and lets criminals file fraudulent tax returns to collect refunds. The IRS has set up separate reporting routes: a business that lost data should email dataloss@irs.gov, while one that received the email without sending data should report it to phishing@irs.gov, using the subject lines W2 Data Loss and W2 Scam respectively.
Do I need an IT department to secure payroll?
No. The controls that eliminate most small-business payroll risk are administrative rather than technical: multi-factor authentication, role-based access, a verification rule for bank changes, removing access when people leave, and a quarterly review of who is on the payroll. Choosing payroll or HR software that provides access controls and audit logs handles the technical layer for you. What you cannot outsource is the decision about who is allowed to do what, and the discipline of actually reviewing it.
How often should I audit payroll?
Plan on a light check every quarter and a deeper one once a year, which suits most small businesses. Each quarter, match the names on the payroll register to the people who actually work for you, look over every bank detail change made since the last review, and go through the access list again. Once a year, go further: pay rates, overtime patterns, and a reconciliation against your tax filings. The quarterly rhythm matters because fraud found within three months costs far less than fraud found after a year.
What should I do if payroll data is breached?
Act quickly, because recovery depends on speed. If money was diverted, call your bank right away and ask it to recall the funds. Report the incident to the FBI at ic3.gov. When W-2 or Social Security data was exposed, email dataloss@irs.gov with W2 Data Loss as the subject line, and give the business name, employer identification number, contact details, what happened, and how many employees are affected, but no employee personal data. If the W-2 request arrived and nobody sent data, report that email to phishing@irs.gov instead. Tell affected employees the same day, reset credentials, and look up your state’s breach notification rules.