Aipedia: Payroll bureaux

Payroll diversion and AI-enabled bank detail fraud

Aipedia, by the Apex broking team · Last reviewed 2026-10-30

Payroll diversion happens when a fraudster persuades a bureau or employer to change an employee's bank details, and AI makes the requests far more convincing. The loss can fall between PI, crime and cyber cover unless the policies are set up together.

Part of: AI in payroll bureaux

In short

Bank details are among the most valuable data a bureau holds. Fraudsters can use AI to write convincing emails in an employee's style, clone a manager's voice to approve a change, or create fake documents. If a bureau changes details without proper verification and salary goes to the fraudster, the employer still owes the employee and may claim from the bureau. PI may respond if the bureau negligently failed to verify the request, subject to the wording, while direct theft of funds is usually a crime or social engineering matter. Callback verification on known contact details remains the key control.

How the fraud works

Payroll diversion is simple: a request arrives, apparently from an employee, asking for their salary to go to a new account. The bureau or the employer updates the record, the next pay run goes to the fraudster, and the real employee notices only when their pay does not arrive. By then the money has usually moved on.

AI has made this easier. A generative AI tool can write in an employee's style using public posts. Voice cloning can produce a convincing call from a finance director approving a change. Fake bank letters and identity documents are easier to produce. Some attacks target the bureau's own staff, others a client's HR team, and some compromise an email account so the request comes from a genuine address.

The duties that apply

The bureau owes its client reasonable care and skill under section 13 of the Supply of Goods and Services Act 1982. Bank details are personal data, so the bureau as processor must keep appropriate security under its Article 28 terms, and the ICO expects security measures proportionate to the risk. For bureaux under AML supervision, HMRC's approach to payroll agents and the Money Laundering Regulations 2017 require policies and controls, although payroll diversion is primarily a fraud and security issue rather than an AML one.

HMRC and CIPP have published no payroll-specific guidance on AI-enabled fraud. The standard expected is therefore what a competent bureau would do given widely known fraud methods.

What can go wrong

Illustrative scenario: a bureau receives an email from a client's employee asking to update bank details, followed by a call from someone who sounds like the client's payroll contact confirming the request is genuine. The bureau updates the record. The employee was never involved, and the call was a cloned voice. Two months' net pay goes to the fraudster before the employee raises it. The employer pays the employee again and asks the bureau to make good the loss.

Variations include several employees targeted at once, a compromised client portal used to change details in bulk, or a fake instruction to redirect a whole pay run.

How PI, crime and cyber usually split the loss

Three covers can be involved, and their edges differ by wording:

PI: if the client claims the bureau negligently failed to verify the change, PI may respond to that liability claim, subject to the terms. Some PI wordings exclude losses from fraud or the transfer of funds.
Crime or social engineering cover: usually needed for the bureau's own direct financial loss, for example if it reimburses the employer voluntarily. See social engineering and fund transfer fraud and commercial crime insurance.
Cyber: usually relevant where systems or email accounts were compromised, including investigation and notification costs.

Deepfake approvals are covered in more detail in deepfake payment scams insurance.

Practical controls

The following controls are the most effective against payroll diversion:

Verify every bank detail change by calling back on contact details already held, never those in the request.
Do not accept a voice or video call alone as approval.
Use a portal with multi-factor authentication for changes, and notify the employee at their old details.
Flag several changes in a short period, or changes just before payday.
Agree with clients in writing who can authorise changes and how.
Read payslip chatbots if employees can request changes through a bot.

How Apex helps

Apex arranges professional indemnity for payroll bureaux alongside crime and cyber cover, and can check how the three policies fit together for a diversion loss. See also AI in payroll bureaux.

Sources

Frequently asked

What is payroll diversion fraud?

A fraudster persuades a bureau or employer to change an employee's bank details so that salary is paid to the fraudster's account. AI makes the requests more convincing, through realistic emails, cloned voices and fake documents.

Is the bureau liable if it changed bank details on a fake request?

It can be, if a competent bureau would have verified the request and did not. The employer still owes the employee their pay, and may claim the loss from the bureau. Clear contractual verification procedures help show what was agreed and followed.

Does PI cover payroll diversion losses?

Sometimes. PI may respond to a negligence claim from the client, subject to the wording, but some policies exclude fraud or fund transfer losses. The bureau's own direct loss usually needs crime or social engineering cover, and system compromise is usually a cyber matter.

How can a bureau stop deepfake approvals?

Do not treat a phone or video call as proof. Call back on a number already on file, require approval through an authenticated portal, and confirm changes with the employee at their existing contact details. Train staff to expect convincing voices.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.