Five rules hold under pressure
A verification protocol only works if it is short enough to remember during a stressful call. Ours rests on five rules.
- A change request never verifies itself. A new phone number, a new email address or a letter on letterhead in the same message as a bank change proves nothing.
- Call a number you already had. Use the number in the vendor master or the signed contract, never the one in the request.
- Someone else makes the call. The person who received the request does not confirm it.
- Two people release. Any new payee, any changed bank account and any payment above a set threshold needs a second person to release it in the bank portal.
- Urgency means slow down. No executive can waive the protocol, and every executive agrees to that in writing.
The article on five controls that stop vendor bank-change fraud explains each control in more depth.
Executives sign the protocol too
Impersonation attacks borrow an executive's authority. The protocol only holds if executives accept that a payment they request will be called back like anyone else's, and that the AP specialist who delays an urgent wire to verify it has done the job right. We ask each executive to sign the rule, and we brief executive assistants separately, because requests often pass through them first.
The vendor master invites impersonation
A vendor master full of dormant records gives an attacker more names to impersonate and an insider more records to repurpose. We look for duplicates, vendors with no verified bank details, bank accounts shared between vendors or with employees, and changes made shortly before a large payment. Once the cleanup is done, the same tests can run every month through continuous controls monitoring.
Drills show where the protocol bends
Procedures read well on paper. A drill shows whether the AP specialist calls back when a convincing email arrives at 16:50 on the Friday before a holiday weekend. We script email, voice and vendor-portal attempts that resemble real attacks, run them with written approval from management and HR, and review the results with the team without naming individuals. Repeating the drills each year, using the plan we hand over, keeps the protocol in practice rather than in a folder. Our training programs can add payment-fraud drills as a recurring module.