Voice Clone Fraud
Targeting HR & Payroll

How Payroll Diversion via Voice Cloning Works

Payroll diversion is not a new fraud category — criminals have been attempting it by email for years. What voice cloning adds is the most convincing possible authentication: the employee's own voice. The attack follows a consistent pattern:

Attack Variations Beyond Basic Payroll Diversion

Executive Impersonation for Off-Cycle Payroll

A criminal clones a CEO or CFO's voice and calls the payroll director or HR leader directly. The request is for an off-cycle payroll run — a "confidential retention bonus" for a key employee, an "emergency payment" that must clear before end of month, or an "advance" on a future payroll cycle. For organizations that outsource payroll to an external firm, these attacks are often routed through the accounting or CPA firm managing the payroll relationship instead. The executive instructs the payroll team to process the payment quickly and to keep it confidential until it clears. Both instructions prevent verification: the urgency bypasses the standard approval process, and the confidentiality instruction prevents the payroll team from consulting colleagues.

Vendor and Benefits Provider Impersonation

A criminal poses as a representative from a benefits provider — a 401(k) administrator, health insurance carrier, or FSA vendor — and calls the HR or benefits coordinator claiming a "banking update" is needed to process employer contributions or employee premium payments. The HR coordinator, accustomed to interactions with benefit vendors, provides updated ACH information or authorizes a redirect of employer benefit payment flows to a fraudulent account.

New Hire Fraud via Voice Cloning

A criminal applies for a position with a fabricated identity, successfully navigates the hiring process, and is onboarded as a new employee. Then, using voice cloning to impersonate a hiring manager or HR director, the criminal calls the payroll setup team and provides fraudulent banking information for their own "new hire" payroll account — or modifies a legitimate new hire's onboarding information to redirect their first paycheck. This attack is particularly sophisticated and indicates a high level of pre-attack reconnaissance.

Voice-Based Employee Data Extraction

Not all voice-based HR attacks target payroll directly. A criminal posing as an executive or HR colleague can call HR staff and request sensitive employee data — Social Security numbers, salary information, benefits elections, emergency contacts — under the pretext of a legitimate business need. This data is then used for identity theft, tax fraud (fraudulent W-2 filings), or to build more convincing pretexts for subsequent financial attacks against specific employees.

Why HR Is Structurally Vulnerable

HR departments have a professional culture of responsiveness and service. Staff are hired and trained to help employees navigate their relationship with the organization — benefits questions, payroll issues, policy concerns. This service orientation is exactly what makes the department effective, and exactly what voice clone attackers exploit.

Remote and hybrid work has normalized the handling of sensitive HR changes by phone. Before 2020, a direct deposit change request might have required a form submitted in person or a visit to the HR office. Now, phone and email requests for sensitive changes are standard practice at most organizations. The behavioral baseline that voice clone fraud exploits — "of course you can update your direct deposit by calling HR" — was established and reinforced during years of remote work accommodation.

Additionally, HR staff often have access to the entire employee population's sensitive financial data. A single successful social engineering call to an HR generalist can expose payroll accounts for hundreds of employees, not just the individual being impersonated. The attack surface per HR employee is uniquely broad.

HR-Specific Prevention Controls

Training HR Staff: Urgency Is the Primary Red Flag

KnowBe4's analysis of 67 million simulated security tests shows that security awareness training reduces susceptibility by 86% over 12 months. For HR staff specifically, training should focus on three reflexes: recognizing urgency as a social engineering signal rather than a service priority, requiring written confirmation before processing any sensitive change regardless of who is calling, and understanding that confidentiality instructions ("don't tell anyone about this") from a caller are a classic social engineering technique designed to prevent verification.

Simulated vishing exercises — where a trainer calls HR staff posing as an executive or employee requesting a sensitive change — are particularly effective. These exercises build the verification reflex in a low-stakes environment. HR staff who have practiced recognizing and responding to a cloned-voice scenario are measurably more resistant to the real attack.

What to Do If Payroll Was Diverted

1. Notify the payroll processor immediately — request that any pending payment to the fraudulent account be halted or reversed before the next disbursement cycle.
2. Contact the sending bank — if a wire has already processed, request a recall. Banks can only act if funds remain in the receiving account.
3. Contact the receiving bank — provide the fraudulent account details and request a fraud hold.
4. File an FBI IC3 report at ic3.gov — if the total loss across all diverted paychecks meets $50,000 and is reported within 72 hours, the FBI's Financial Fraud Kill Chain can be activated. This mechanism froze $561.6 million in 2024.
5. Contact the nearest FBI field office — particularly if multiple employees were targeted or if the attack appears coordinated.
6. File an FTC report at reportfraud.ftc.gov.
7. Notify affected employees — employees whose banking information was fraudulently changed should be notified immediately. They may also need to take steps to protect their personal bank accounts if those details were exposed.
8. Preserve all evidence — call logs, any voicemails, the details of what was said during the fraudulent call, all payroll change records, and bank transaction documentation.