Overpayment recovery records

Detects salary and wage overpayment recovery records for an identified employee: overpayment notifications, recovery letters and repayment agreements, with the overpaid amount, repayment instalments or overpayment period.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium: the primary phrases also appear in policies, guidance, blank forms and news, so enforce tiers require a populated field with a non-placeholder value and 85 adds a record-specific populated detail plus independent corroboration. Person and record values are customer-defined, so the field regexes use labelled loose values with a placeholder guard. 85/75 are heuristic evidence tiers, not measured accuracy.
Detection quality: Topic false positive
Jurisdictions: au, global
Regulations: Fair Work Act 2009 (Cth), Industrial Relations Act 2016 (Qld), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
Frameworks: ISO 27001, ISO 27701
Data categories: financial, employment, pii
Scope: wide
Risk rating: 4
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:overpayment\s+(?:recovery(?:\s+records?)?|repayment|notifications?|notices?|letters?|arrangements?|agreements?|debts?)|(?:salary|wages?|pay(?:roll)?)\s+overpayments?|recovery\s+of\s+(?:an?\s+)?overpayment|overpaid\s+(?:salary|wages|pay))\b

Corroborative evidence keywords

written agreement, agreed in writing, repayment arrangement, instalments, signed, payroll error, per fortnight, per pay, payroll deduction

Proximity: 300 characters

Should match

Salary overpayment notification Employee name: Avery Teston Payroll number: 88213 Overpayment period: 01/07/2026 to 12/09/2026 Gross overpayment: $2,145.80 Repayment arrangement: $50.00 per fortnight by payroll deduction Written agreement signed by the employee. — 85: overpayment notification with employee, period, gross overpayment, repayment and signed agreement
Overpayment recovery - repayment plan Staff member: Morgan Teston Amount to be repaid: $780.00 Instalments of $65.00 per pay, agreed in writing on 20/09/2026. — 85: repayment plan with staff member, amount to be repaid and instalments agreed in writing
Overpayment recovery letter to employee: Jordan Staffson - draft for HR review. — 75: recovery letter naming the employee, no amounts
overpayment recovery — 65: bare phrase only - discovery tier

Should not match

If a salary overpayment happens, the employer and employee should discuss and agree on a repayment arrangement in writing. This fact sheet explains the rules. — FWO-style guidance - must stay at or below 65
Overpayment recovery agreement Employee name: __________ Gross overpayment: $______ Repayment amount: $______ — Blank agreement template - must stay at or below 65
The council recovered wage overpayments from hundreds of staff after a system fault, according to a media release. — News - must stay at or below 65
unrelated generic text without domain phrases — No relevant topic phrases present

Known false positives

Policies, procedures, regulator guidance, fact sheets and training material that name the record type. Mitigation: Enforce tiers require populated fields; guidance has labels without values, and policy/guidance/training/media-release framing is excluded by the NOT-group.
Blank forms, templates and system configuration screens. Mitigation: Blank lines, bracket placeholders, XXX and n/a/tbc values are rejected by the placeholder guard; template/fixture words are excluded by template-exclusion.
News, statistics and vendor marketing. Mitigation: No populated person or record fields, so these stay at 65 discovery.
Centrelink / benefit overpayment debt letters (not payroll). Mitigation: They are equally personal debt records; person field still required for 75.