Respond to a suspicious payroll email

Introduction

If you receive an email that looks like it is from Payroll Operations and claims there is a processing error, treat it as suspicious. These messages may be phishing attempts designed to get you to click a link, open an attachment, or share sensitive information.

What to do right away

1. Do not reply to the email.

2. Do not click any links or open any attachments.

3. Do not enter any login details, payroll information, or personal data.

4. Report the suspicious email to your IT department or helpdesk immediately.

5. Delete the email from your inbox after reporting it.

How to report the message

When you contact your IT department or helpdesk, include the sender name, subject line, and any details that may help them investigate the message. If your organization has a phishing reporting process, follow that process as well.

If you already interacted with the email

If you clicked a link, opened an attachment, or shared information, report it right away to your IT department or helpdesk. Quick reporting can help reduce risk and allow your team to take the right next steps.

Additional information

For safety, always verify unexpected payroll-related messages through a trusted internal channel before taking action. If something feels off, do not engage with the email.