Separate an urgent payroll message from an authorized instruction, especially when it changes payment details.
Urgency does not establish authority
A message that uses a manager’s name or refers to an upcoming payday can still require verification. Payroll changes are attractive targets because they can redirect money or expose private information. CISA recommends recognizing phishing, using strong credentials and enabling multifactor authentication. Those protections support a careful workflow; they do not make every message received by a protected account trustworthy.
Create a known route for sensitive changes before a request arrives. The authorized person should verify the instruction using established contact information or the employer’s secure process. Do not make a newly supplied phone number or link the sole evidence that the requester is genuine. This guide describes a process check, not a method for accessing someone else’s account.
Keep verification and processing separate
A fictional payroll coordinator receives an email asking for a payment change immediately before cutoff. A safer organizational response is to pause that change within the employer’s established process, verify it through a known channel and record the outcome. Whether payroll should proceed with existing instructions is a decision for the authorized employer and provider, not for an external article.
Where practical, separate the person preparing the change from the person approving it. In a small team, define an alternative control rather than sharing one login among staff. Shared credentials make it harder to determine who performed an action and can weaken the value of an audit trail.
Document enough to explain the outcome
The verification record should identify the request type, date, authorized reviewer and status. Keep bank details and identity documents in the designated secure system. A general exception log can point to that record without reproducing its contents. If a suspicious request was received, preserve the relevant evidence using the organization’s security process.
After a confirmed change is processed, verify its effective date and communicate through the approved channel. If the request cannot be verified, retain the unresolved status and escalate to the responsible person. Do not invent a workaround to meet an artificial deadline. Accurate payroll depends on both correct numbers and trustworthy instructions about where those numbers should lead.
Continue with Secure access · Exception log · Payroll cycle.