Woman looking stressed while holding receipts and a bunch of credit cards

Someone impersonated her through a random Gmail account, contacted HR directly, and requested a change to her direct deposit information. HR responded and sent the necessary paperwork through the company’s payroll provider. The scammer filled it out using her name and work details, signed it with a signature that wasn’t hers, and the change went through without anyone actually contacting her to confirm the request was legitimate.

Her August 28 and September 4 paychecks landed in an account that doesn’t belong to her. She discovered the problem when her regular deposit notification didn’t arrive and flagged it with HR, who has since filed a fraud claim with the payroll provider.

💸 Take Back Control of Your Finances in 2025 💸
Get Instant Access to our free mini course
5 DAYS TO A BETTER BUDGET

HR’s response also included a question about whether she checks her account regularly, since she hadn’t immediately noticed the first missing paycheck. She does check her account routinely and simply missed one notification, a detail that doesn’t change where the actual failure occurred, verifying the change request before processing it.

Her Employer Still Owes Her the Wages

Under Illinois law, specifically the Illinois Wage Payment and Collection Act, employers are required to pay employees all wages earned, and the obligation to pay wages generally isn’t extinguished simply because the employer sent the money to the wrong destination. Her employer processed a payroll change based on an unverified request, and that failure of process doesn’t shift the underlying wage obligation onto her. She earned that money through work already performed, and the fact that it was misdirected due to a security failure on the employer’s or payroll provider’s end doesn’t change that the wages are still owed to her.

Can She Be Made to Wait for Fund Recovery

Employers generally cannot condition payment of earned wages on the outcome of a separate fraud investigation or recovery effort. The wages were legally earned and due on the normal payroll schedule, and Illinois wage law doesn’t include an exception allowing an employer to delay payment indefinitely while waiting to see whether stolen funds get recovered from a fraudulent account.

If her employer attempts to withhold reissuing her pay until the payroll provider or receiving bank successfully claws back the funds, that likely constitutes a wage payment violation independent of the fraud itself. The employer’s dispute with the payroll provider or the fraudulent account is a separate matter from their direct obligation to pay her.

Whether She’s Entitled to the Fraudulent Paperwork and Related Records

She likely has a reasonable basis to request copies of records directly relevant to her own wages and personal information, particularly documentation showing how and when the fraudulent change was processed. Illinois law doesn’t create one blanket statute mandating production of every document she listed.

But personnel and payroll records tied to her own employment and pay generally fall within what an employee can reasonably request. And a company facing a fraud incident involving an employee’s wages has strong practical and legal incentive to be transparent, especially given the liability exposure involved.

What the Law Requires

The Illinois Personal Information Protection Act (PIPA) governs how personal information is handled and requires notification in the event of a data breach involving personal information, though the specific application here depends on exactly what qualifies as “personal information” under the statute and whether this incident meets the technical definition of a breach under that law.

Given that her name, employment details, and banking information appear to have been involved in this fraud, it’s reasonable to ask directly whether this incident triggers PIPA’s notification requirements, and an employment attorney could clarify exactly how that statute applies to this specific scenario.

Whether to File a Police Report Independently

Filing her own police report is worth doing regardless of the employer’s fraud claim with the payroll provider. Her employer’s claim addresses the payroll provider’s own investigation and potential recovery process, but a police report creates an independent record specifically documenting that she was the victim of identity theft and wage theft through impersonation. That record can matter for her own credit protection efforts, for any potential civil claims down the line, and for establishing a clear timeline if this situation escalates or additional fraudulent activity surfaces using her identity.

Additional Protective Steps Worth Taking

Freezing credit with Equifax was a good first step, and extending that freeze to Experian and TransUnion as well would provide more complete protection, since credit monitoring services don’t always cover all three bureaus by default. Filing a report with the FTC through IdentityTheft.gov creates an official federal record and provides a personalized recovery plan.

Monitoring bank accounts and any other financial accounts closely for the coming months, given that her name, signature, and employment information were all used fraudulently, would also be a reasonable precaution, since this type of targeted fraud sometimes precedes additional attempts using the same stolen information.

Where This Leaves Her

The core legal position here is straightforward. She’s owed her wages regardless of where the payroll provider sent them, and her employer’s obligation to pay her isn’t contingent on recovering the stolen funds first.

Continuing to push for the specific documentation already requested, filing an independent police report, and consulting briefly with an employment attorney familiar with Illinois wage law would help confirm the specifics of her rights under PIPA and the Wage Payment and Collection Act, while also giving her leverage if the employer continues to delay reissuing the two missing paychecks.


Featured on Cents + Purpose: