§ 01The brief
Employees started calling HR on payday to say their pay had not arrived. Someone had logged into the payroll portal with an HR manager's stolen password and changed 61 employees' bank details to prepaid card accounts.
§ 02What I did
- 1.
Mapped every changed account to its receiving bank or card program, so each one could get its own recall request.
- 2.
Filed the CCS report and sent each receiving institution a short evidence sheet with the portal's audit log.
- 3.
Worked with the company's payroll provider so employees were paid again while the recalls ran.
§ 03The outcome
Receiving institutions returned $388,000. The remaining $224,000 had been withdrawn at ATMs and was covered by the company's insurer after the evidence file was submitted.