Contact: Shannon Tufts, Senior Advisor for Cybersecurity
Payroll systems across UNC System institutions are being targeted at an alarming rate with increasing levels of sophistication and ultimately success. Recent incidents leveraged phishing-harvested employee logins, passwords, and MFA tokens to access systems involved in making direct deposit change requests. Some of those changes were approved and took effect on a payday, negatively impacting valued employees.
Please remind your payroll and HR teams to treat every banking change as unverified until the employee confirms it through a channel you already trust, such as a call to a number on file or an in-person conversation.
- Do not rely on an individual’s email (work-related or personal) that requested the change. Look closely at any voided check or unfamiliar account before approving the direct deposit change.
- Report suspicious messages to your IT security team and your payroll team. If you need additional assistance, feel free to reach out to the UNC System team and we will connect you with the appropriate team to support your campus.