Payroll runs Friday. Tuesday morning, the office manager gets an email from Kayla in the shop.
It comes from Kayla's address. It has her signature at the bottom. It is three sentences: she switched banks, can the deposit go to the new account this cycle, sorry for the short notice.
Nothing about it looks wrong, because almost nothing about it is fake. The mailbox is real. The person typing is not Kayla.
The login was real. The session wasn't hers.
The way in is a fake Microsoft 365 sign-in page. Microsoft's security team documented one version of this in April: malicious ads and poisoned search results sitting at the top of results for searches like "Office 365," or the common misspelling "Office 265." You click, you sign in, and you have handed over more than a password. The fake page passes your login through to Microsoft in real time and keeps the session token that comes back.
That token is the thing that matters. It is the "you're already signed in" state your browser carries around all day. With it, someone can open your mailbox from somewhere else without your password and without your phone buzzing. Microsoft's researchers watched stolen sessions get refreshed roughly every thirty minutes to keep them alive. Ordinary multi-factor authentication does not stop this, because it was never built to.
They read your mail before they write to you
Once inside, they do not blast an invoice at you. They search. Microsoft's team watched them hunting for words like payroll, HR, finance, human resources, and admin, working out who in the company handles money and who handles people.
Then the email goes out to whoever runs payroll. It arrives from the employee's own mailbox. Microsoft noted the subject line was identical across compromised users: "Question about direct deposit."
Here is the part that should bother you most. Before sending it, they build a rule in that employee's mailbox that quietly moves any incoming message containing "direct deposit" or "bank" into a hidden folder.
So when you reply, "Hi Kayla, sure, send over the form," she never sees it. You did the responsible thing and asked a question. The answer landed in a folder she does not know exists. From your side the conversation looks normal. From hers, it never happened.
The amount is small on purpose
A fraudulent wire request gets a second look. One paycheck does not. It lands inside a normal payroll run, at a normal time, for a normal amount, and it clears.
Then it happens again next cycle, and the one after, until somebody notices. The first person who usually notices is the employee, on payday, when the money is not there.
Microsoft documented at least one case where the attacker gave up on emailing HR entirely and simply signed into the payroll system as the employee to change the bank details directly. One documented case. It does not take many.
Arctic Wolf's threat researchers tracked a related wave in July 2026 built on fake voicemail notifications, with hundreds of organizations targeted across the United States, Canada, and Europe. The FBI's complaint center logged 24,768 business email compromise complaints in 2025, up from just over 21,000 the year before. The lure keeps changing. The last step does not.
The rule that actually helps
You do not need new software for most of this. You need one written rule and the willingness to hold it when it is inconvenient.
No bank detail or direct deposit change happens because of an email. Ever. The employee makes the change themselves, signed in to the payroll system, with their own credentials. If a request arrives by email, it gets a phone call to a number you already had on file. Not a reply. Not the number in the signature block.
Two more things worth doing.
One person enters a payroll change, a second person approves it. Two sets of eyes on the one transaction that is easiest to fake.
And look at the inbox rules. Ask your IT provider to check for rules that filter on financial words, and to check on a schedule rather than once. If nobody is looking at that, it is a gap worth saying out loud.
Where you can, move to passkeys instead of texted codes and push approvals. Microsoft's guidance is direct on this: phishing-resistant sign-in is what breaks the session-theft trick. Ordinary MFA still reduces a lot of risk. It just does not close this particular door.
If it already happened
Call your bank and your payroll provider the same day. Money that moved by ACH can sometimes be pulled back early and rarely later. Preserve the emails. Do not delete the mailbox rule, because it is evidence. Report it at ic3.gov. And tell the employee before payday, so they are not the last to know their rent is short.
None of this is exotic. The FBI's complaint center has documented payroll diversion since at least 2019. What changed is the polish. Real mailboxes, real signatures, real conversations, and a hidden folder so that you and your employee never compare notes.
The defense is boring, and boring is what works here. A rule, a phone call, and somebody actually checking.