Payroll bank account details

Detects employee payroll bank account details: a payroll/salary account or direct-deposit phrase combined with a BSB, a bank account number or a named employee/payee field. Phrase-only mentions (policies, scam warnings) stay discovery-only.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Enforce tiers need a populated BSB, account number or employee field beside the payroll phrase; the previous 75 tier fired on the phrase alone. Payroll-change scam warnings and self-service help pages stay at 65. Medium because HR onboarding correspondence with the same fields is itself sensitive.
Detection quality: Topic verified
Jurisdictions: global
Regulations: Privacy Act 1988 (Cth), Fair Work Act 2009 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
Frameworks: ISO 27001, ISO 27701
Data categories: financial
Scope: wide
Risk rating: 7
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:payroll\s+bank(?:ing)?\s+(?:account\s+)?details|(?:salary|wages?|pay)\s+(?:bank\s+)?account(?:\s+details)?|direct\s+deposit\s+(?:details|authori[sz]ation|form)|employee\s+bank(?:ing)?\s+details|bank\s+account\s+details\s+for\s+(?:salary|payroll|pay|wages)|nominated\s+(?:bank\s+)?account\s+for\s+(?:salary|wages|pay))\b

Corroborative evidence keywords

net pay, pay cycle, pay run, pay period, payslip, superannuation, effective from, change of bank details, payroll officer, direct credit, bank account, account number, account no, [object Object], routing number, sort code, IBAN, SWIFT, [object Object], employee (+92 more)

Proximity: 300 characters

Should match

Payroll bank account details - change form Employee name: Avery Teston Employee ID: 004471 Account name: A Teston BSB: 064-000 Account number: 12345678 Allocation: 100% of net pay, effective from the pay run of 12/08/2026. — Populated change form - employee, BSB, account number and allocation (85)
Direct deposit details received for new starter Employee: Jordan Whitlock Please key into the payroll system before Thursday. — Direct deposit note with a named employee only (75)
this record references the payroll bank account details held on file — Phrase-only reference (65 discovery)

Should not match

Policy guidance: employees can update their payroll bank account details in the self-service portal. Never send your BSB or account number by email. — HR guidance naming the fields without values
Direct deposit authorisation form Employee name: __________ BSB: ___-___ Account number: __________ — Blank authorisation form - placeholder values
Training module: scammers impersonate staff and ask payroll to change salary account details to a new BSB. Verify every request by phone. — Security awareness training
unrelated generic text — Unrelated
template example placeholder record identifier — Template wording

Known false positives

HR policies, payroll help pages and payroll-redirection scam warnings. Mitigation: No populated BSB, account number or employee field, and guidance/training framing is excluded.
Supplier or customer bank details that mention salary accounts. Mitigation: Still requires a payroll/salary/direct-deposit phrase; reviewers should confirm the payee is an employee.