I called her about something else and she just happened to say, "oh, and by the way, I got your new direct deposit account set up."

I told her I hadn't asked for a new direct deposit account to be set up. She sent me the email, and lo and behold, it was as scammy as can be.

We've since implemented a lot of the same practices others here have talked about. ACH payroll changes are all sent with a filled out form on our own document and verified in person. All wire transfers are initiated through an in person request. We have semi annual fraud training etc.