Paying a workforce: batch payments and their failure modes

Graduate · enrolled learners

This lesson opens with MyPayrollHR, September 2019.

What happened

MyPayrollHR was a payroll processing company that ran payroll for around a thousand client businesses, moving pay to roughly 250,000 employees. In September 2019 it collapsed amid a fraud by its operator, and in the collapse something worse than a missed payday happened: pay that had already been deposited into employees' bank accounts was reversed. Using the same automated clearing house access that delivers direct deposit, roughly 35 million dollars was pulled back out of workers' accounts, leaving many with zero or negative balances, their rent and bills bouncing, for pay they had already earned and received. The processor had the authority to move everyone's money at once, and when it failed, that authority ran in reverse across the entire workforce simultaneously. Many workers were eventually made whole after banks and regulators intervened, but the episode showed the failure mode of batch payroll: a single processor holds the power to pay, and to un-pay, thousands of people in one action.

The decision point

Paying a workforce is done in a batch: one processor, given access to move money, pays everyone at once through a system like the automated clearing house. That concentration is efficient and it is the risk, because the same access that sends a batch of payments can reverse or block it, and a failure or fraud at the processor hits every worker simultaneously, not one at a time. MyPayrollHR is the case where the batch ran backwards: pay already delivered was clawed back from a quarter of a million accounts through the very rails that had delivered it. The failure modes of batch payroll are therefore not just a missed run but a mass reversal, a mass block, or a mass misdirection, each landing on the whole workforce at once because the authority is pooled in one place. So the decision when running payroll through a processor is to treat that processor's access as a concentrated risk to be bounded: to know what it can do to funds after they are sent, whether pay can be reversed, under what conditions, and to structure the arrangement so that a processor's failure cannot silently pull back or withhold pay from everyone, because the convenience of paying a workforce in one action is inseparable from the danger of one action going wrong for all of them.

Recorded loss

$35,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.