Guide · Payments · Business

Why dual approval beats another urgent payment email

The email looks like your director. The invoice looks like last month’s, except the bank details. Someone is “in a meeting” and needs it paid before close of business.

A second approval step will not catch every fraud. It catches the ones that rely on one person feeling rushed.

The rule

No new beneficiary, and no change to an existing supplier’s bank details, goes out on one person’s say-so.

1. The person who prepares the payment is not the only person who releases it.
2. Bank-detail changes are confirmed on a phone number you already stored — not the number in the email or WhatsApp chat that asked for the change.
3. “Urgent” does not skip the rule. Urgency is the point of the scam.

If you are a one-person business, the second check can be your accountant or a partner. The point is a second brain, not a second software licence.

What to keep on file

• Legal name of the supplier
• Bank, account number, and branch code you last paid successfully
• A phone number you dialled before, stored by you — not copied from the latest PDF
• Who approved the last change, and the date

When a “new account” arrives, compare it to that file before anyone opens the bank app.

What this does not replace

Dual approval does not investigate a payment that already left. It does not prove who sent a spoofed email. If money has moved, call your bank the same day, keep the emails, and then build a clear file of what happened.

That follow-up is what a confidential fraud assessment is for. The payment rule is how you make the next attempt harder.

Start this week

Pick the one payment type that hurts most if it goes wrong — usually supplier bank-detail changes. Write the rule in one paragraph. Tell the person who pays. Put the supplier phone list somewhere they can reach without opening the suspicious email.

One rule, used every time, beats a long policy nobody reads under pressure.