There’s a very successful spam campaign out now spoofing legitimate ADP payroll invoice emails. They most commonly arrive as:
Subject: Payroll Invoice
In reality, they come from previously infected personal computers spanning the globe.
An example of the above:
‘from 60-240-131-86.static.tpgi.com.au ([22.214.171.124])
It doesn’t take a trained email professional to realize that’s not ADP emailing.