Payment Verification Procedures That Stop Fraud
Most business payment fraud is stopped by one habit: verifying changes and unusual requests through a separate channel. A simple procedure with call-backs, dual approval and thresholds.
Invoice fraud, fake boss requests and business email compromise all end the same way: someone in your business sends money to the wrong account. A clear verification procedure is the most effective control against all of them.
A simple procedure
- New payee or changed bank details: call the supplier on a number from your records, not from the request, and confirm with someone you know.
- Unusual or urgent requests, especially from executives: call the requester on a known number. See executive impersonation.
- Payments above a threshold: require a second approver. See dual approval.
- Record the check: who called whom, when, and what was confirmed.
- No exceptions for urgency or seniority.
Supporting habits
- Tell suppliers you always verify bank changes by phone.
- Test new payees with a small payment and confirm receipt.
- Watch for requests to keep things confidential.
- Train the finance team with real scenarios. See finance team training.
Email and chat are not verification channels. If an account is compromised, replies come from the fraudster.
Related: business email compromise and changed bank details fraud. For more, see our guide to business cybersecurity.
Frequently asked questions
What is a call-back check?
Phoning the supplier or colleague on a number you already have, not one in the request, to confirm a payment or bank change is genuine.
What if the supplier is annoyed by the check?
Most suppliers welcome it, because it protects them too. Tell them in advance that you always verify.
Should the procedure have exceptions?
As few as possible. Urgency and seniority are exactly what fraudsters use, so they should not bypass checks.
Sources
- Cybersecurity for Small Business, US Federal Trade Commission
- Small organisations guide to cyber security, UK National Cyber Security Centre
- APP scams, UK Payment Systems Regulator
