1
Personal stakes
Pay, benefits and reviews affect you directly, so you open and act quickly.
How it showed up here"Your bonus is ready".
Payroll, Benefits & HR Scams
This short course is required for everyone at Charitybuzz. It takes about ten minutes: a few focused lessons, a quick quiz, and a confirmation that goes on your training record. Everything in it comes from the kinds of messages and requests our team is actually receiving, so what you learn here is what you will use at work.
What this covers How attackers use HR and payroll topics — pay, benefits, reviews, tax forms — to steal logins and redirect paychecks.
What this is about
Everyone cares about their pay, benefits and performance review, which makes HR-themed messages the most reliably opened. Attackers use that in two ways:
- Against you personally: a fake "benefits enrollment", "bonus", "tax form" or "performance review" that leads to a sign-in page.
- Against HR and Finance: a fake request, apparently from an employee or leader, to change direct-deposit details so the next paycheck goes to the attacker.
Both arrive by email or text, and both depend on you acting before you check.
Take the message apart
A fake direct-deposit change sent to HR in a colleague's name. Click every detail that should make you stop. There are 6.
0 of 6 red flags found Click anything in this message that looks suspicious.
Direct deposit update
Hi,
I recently switched banks and would like to update my direct deposit before the next payroll.
The payroll portal keeps giving me an error, so could you make the change for me manually? New details:
Lakeview Digital (online-only bank) — routing ending 0417, account ending 1385
I'm in meetings all day, so email is best.
Thanks,
Chris
Sent from my iPhone
Link goes to:—
Click anything in this message that looks suspicious.
Spot the signs
Quick check: for each item, decide whether it is a red flag or looks fine.
0 of 6 answered
An email from "an employee" asking HR to change their direct-deposit account before Friday's payrollThis is the classic payroll-diversion scam. Verify by speaking to the employee on a number you already had, and follow the change process.
A message saying "Your performance review is ready, sign in to view" with an unfamiliar linkReviews are delivered through our own systems. A sign-in link in a message is a red flag.
HR announces open enrollment on Slack and points to the benefits portal you already useIt comes through a channel you trust and points to a system you already know. If in doubt, confirm with HR.
A text saying a bonus is waiting and asking you to confirm your bank detailsBonuses are paid through payroll. No one needs your bank details through a text.
An email with an attachment named "W2-update.html"Tax forms do not arrive as web-page attachments. An .html file opens a fake page on your computer.
You open the payroll system by typing its address yourself and see your pay detailsThis is the safe way to look at pay information.
Why this works on smart people
2
Authority
The message appears to come from HR or a leader.
How it showed up here"People Operations has shared a document".
3
Deadlines
Enrollment windows and payroll cut-offs make urgency believable.
How it showed up here"Update before the payroll deadline".
4
Privacy
Pay is private, so we do not ask colleagues about it, and a scam benefits from that.
How it showed up here"Please keep this confidential".
How this lands at Charitybuzz
The HR-related scams aimed at a company like ours look like these:
HR & Finance
The direct-deposit change
A message that looks like it is from an employee or a leader asks HR to change where their pay is deposited.
The tell
Requests by email or text, a nearby payroll deadline, and a sender address that does not match.The right move
Call the employee on a number you already had to confirm. Use the formal change process, with a second approver.Everyone
The performance or bonus document
A message says a performance review, bonus letter or compensation document is waiting for you and asks you to sign in.
The tell
It arrives from outside, often with Gmail's External label, and wants you to sign in.The right move
Do not click. Ask HR directly on Slack, and report the message.Everyone
The tax form or benefits notice
An email asks you to open an attached form or confirm your Social Security number for a W-2, benefits or insurance update.
The tell
It asks for sensitive details through a link or attachment.The right move
Go to the official system yourself, or ask HR. Never send sensitive details by email or text.Red flags to watch for
A request to change bank or deposit details
The top red flag for payroll. Always verify by phone.
A sign-in page for a review, bonus or form
Real HR documents live in systems you already use.
The External label on HR-themed mail
HR messages should come from inside Charitybuzz.
Requests for your SSN or bank details
Never by email, text or link.
A payroll or enrollment deadline pressure
Check the date with HR directly.
An .html, .zip or macro attachment
Real forms are PDFs or in a portal.
Secrecy about pay
"Do not tell anyone" is a warning.
A sender that is not @charitybuzz.com
Check the actual address.
A real HR message
- Comes from an @charitybuzz.com address or a system you use
- Points to a portal you already know
- Never asks for bank or SSN details by message
- Can be confirmed with HR directly
- Has no External label
A fake HR message
- Comes from outside or a look-alike address
- Pushes its own sign-in link
- Asks for bank, SSN or login details
- Names a tempting document you did not expect
- Has an urgent deadline
What to do instead
Check who it is really from
Real HR mail comes from @charitybuzz.com.
Go to the system yourself
Type the payroll or benefits address, or use your bookmark.
Confirm changes by phone
For deposit changes, call the employee on a number you already had.
Never send sensitive details by message
SSN, bank and login details do not belong in email or text.
Report it
Use Gmail's Report phishing and tell John and HR.
If you clicked — or entered something
Entered your login on a fake page? Change your password now
Do it from myaccount.google.com and review Your devices.
Shared your SSN or bank details? Tell HR and your bank today
Consider a fraud alert or a credit freeze, and watch your accounts.
Changed someone's deposit details by mistake? Tell HR and Finance immediately
Payroll can often stop or recall a payment if you act before it is paid.
Report it — even if you think you got away with it
In Gmail, open the message, click the ⋮ menu and choose Report phishing. Then email [email protected] with a one-line summary of what you did (clicked, opened a file, typed a password, approved a prompt). Fast reports let IT block the sender for everyone.
Typed your password? Change it now
From a device you trust, go to myaccount.google.com by typing it yourself, change your password, and review Security → Your devices. If you reuse that password anywhere else, change it there too.
Approved a sign-in prompt or read out a code? Call IT immediately
This is the most urgent case: the attacker may already be in your account. Contact Charitybuzz IT ([email protected]) right away so they can end every session and reset access.
Opened an attachment or installed something? Stop and tell IT
Don't keep working on that device and don't try to "clean it up" yourself. Leave it on, disconnect it from Wi‑Fi if you can, and contact IT.
Key takeaways
- Confirm every deposit change by phone, with a number you already had.
- HR documents live in systems you know. A sign-in link in a message is a red flag.
- Never send SSN, bank or login details by email or text.
- The External label on HR-themed mail is a warning.
- Report fast. Payroll can often be stopped if you act in time.
Knowledge check
Confirm your training record
This creates the completion record Charitybuzz keeps for compliance. Please use your work details.
Training complete
Your completion has been recorded. Thank you for helping keep Charitybuzz, our nonprofit partners, and our bidders safe.
Certificate ID: —
View & print certificateKeep this handy
- Confirm every deposit change by phone, with a number you already had.
- HR documents live in systems you know. A sign-in link in a message is a red flag.
- Never send SSN, bank or login details by email or text.
- The External label on HR-themed mail is a warning.
- Report fast. Payroll can often be stopped if you act in time.