The fake HR payroll update request

This is an illustrative training example, not a real request from Claro or any HR team. In this scenario the email appears to come from 'HR' or a 'Payroll Team' and says a new policy requires you to re-submit your bank account details or confirm payroll information through a linked form. It reads like a normal internal announcement and often lands close to payday.

The pretext relies on how much people care about being paid correctly and on time. A request from HR feels routine and non-optional, so employees tend to comply rather than question it. The linked form looks like an ordinary internal survey or update page, which makes handing over sensitive details feel like a normal task.

It reaches staff directly in the work inbox, sometimes reinforced by a follow-up reminder to create a sense of an official, deadline-driven rollout. Timing it around payday or a benefits cycle makes the story more believable, because employees expect payroll-related admin during those windows.

It is convincing because it targets the one thing everyone acts on quickly: their salary. The fear of a delayed or missed payment discourages careful checking, and the form quietly collects full bank account numbers and personal identifiers. Once submitted, those details can be used to redirect pay or commit wider identity fraud.