Personally VERIFY employee change requests before processing
State employees are a big target of fraudsters, who will use attacks to gain access to state system credentials. Cyber criminals will also attempt to divert payroll, and file fraudulent claims so that they can steal benefits. Payroll and HR employees for the Commonwealth should never make changes to employee personal or banking information without having validated that the request was authorized by the employee. Internal controls should be in place to ensure both the requester and the request are legitimate.
Action steps
Do not rely solely on electronic submissions like texts, emails or calls to make employee changes. These methods of communication can be cloned and spoofed.
PAUSE and VERIFY personally with any employee requesting an important change such as bank accounts, addresses or other personal information.
Use Zoom, Teams or in-person meetings to ensure you are dealing with the actual employee and that the request is legitimate.