Fake payroll check scam

This is the fake-check scam dressed as employment onboarding. Right after hiring, the "employer" sends a check for "equipment costs + your first paycheck advance" and instructs you to deposit it, keep the wage portion, and wire the rest to "our equipment vendor" or "our IT contractor."

The check is fake. Funds appear available within a few days due to federal regulation, but real check clearance can take two weeks. By the time the bank reverses the deposit, the wire is gone and you owe the bank the difference.

• A check arrives before your start date.
• The check is much larger than your agreed wage.
• The employer asks you to wire a portion to a vendor on Day 1.
• The "equipment vendor" accepts only wire, Zelle, gift cards, or crypto.
• Urgency: "the vendor needs to ship today so you have it for your start date."
• You haven't filled out W-4, I-9, or direct-deposit forms yet — but you have a "paycheck."

1. Real employers don't send checks before W-4 / I-9 are completed. Federal tax law requires those forms.
2. Real employers don't send their employees money to forward to vendors. Vendors get paid directly.
3. Wait 14+ days before treating any check as "cleared." Funds availability ≠ clearance.
4. Verify the company. If the check is from a different entity than your employer, that's another flag.
5. Apply the rule: if you're being asked to wire part of your first paycheck somewhere, the paycheck isn't real.

• Contact your bank immediately. Some wires can be recalled within hours.
• Freeze your account so the inevitable check reversal doesn't trigger overdrafts before you can cover it.
• Capture every email, every check copy, every wire receipt.
• Report to the FTC, IC3, your bank's fraud department, and the wire service.
• Talk to your bank about a hardship plan if you can't immediately cover the reversal.
• Watch for follow-on identity-theft consequences — you almost certainly shared SSN.

• Do not wire the "equipment vendor" portion of an onboarding check.
• Do not assume "funds available" means the check is real.
• Do not continue working for the "company" expecting reimbursement — they don't exist.
• Do not engage with "recovery agents" who appear after the loss.

• FTC: reportfraud.ftc.gov — the broadest US fraud intake; reports flow to thousands of law-enforcement agencies.
• FBI IC3: ic3.gov — the right destination when the scam is internet-enabled (phishing, BEC, romance, crypto).
• CFPB: consumerfinance.gov/complaint — for complaints about banks, money transmitters, payment apps, credit cards, debt collection.
• IdentityTheft.gov — if any identity information (SSN, driver's license, account credentials) was shared.
• Your bank or payment platform. Call the number on the back of your card or use the app's in-product help. Time matters — wires can sometimes be recalled within hours; ACH and Zelle are harder but worth trying.