Fake Payroll Update Requests on Telegram
Fraudsters use Telegram to impersonate employees and request direct-deposit changes, diverting wages by exploiting the app's anonymity.
Part of: Fake Payroll Update Email Scam
Last reviewed: 1 June 2026
Payroll diversion can reach payroll or HR through Telegram, where a message from a supposed employee requesting a bank-detail change exploits the app's username-based identities and anonymity. With little to verify behind the account, an impersonator can request a change that diverts an employee's wages.
The informal channel removes the cues that would prompt verification, and the immediacy of chat encourages a quick response. A recognised name on a Telegram account can reduce suspicion enough for payroll to act without an independent confirmation.
How this scam works on Telegram
The attacker messages payroll or HR on Telegram posing as an employee, asking to update their direct-deposit details, often citing a new bank and requesting the change before the next pay run.
The username-based identity and chat format discourage formal verification. The attacker supplies new account details and relies on the change being applied without a confirming call to the genuine employee.
If payroll updates the record, the next salary payment is diverted to the criminal. Because Telegram identities can be changed or abandoned, tracing the impersonator is difficult, and the fraud surfaces only when the real employee reports missing pay.
Common red flags
- A Telegram message requesting a direct-deposit change
- A username-based account claiming to be an employee
- A request timed just before a pay run
- A new bank account explained only vaguely
- A bank-detail change requested only through chat
- Pressure to apply the change quickly
How to protect yourself
- Verify payroll changes by phone with the employee on a known number
- Never action direct-deposit changes from a chat message alone
- Treat username-based identities as unverified by default
- Require a secondary verification step for all payroll changes
- Apply a confirmation window before new bank details take effect
- Keep payroll requests within official, auditable systems
How to report it
- Report the account using Telegram's in-app reporting feature
- Notify your bank immediately if any pay was diverted
- File a report with your national cybercrime or fraud centre
Frequently asked questions
An employee messaged payroll on Telegram to change their bank details. Is that enough?
No. Telegram identities are based on usernames that can be changed or abandoned, so the account proves nothing. Confirm any direct-deposit change by phone with the employee on a known number before updating payroll.