HowyGuardHow do I verify payment requests and bank detail changes?
Write one rule: before paying a new account or changing anyone's bank details, phone them on a number you already had, never one from the email asking. Log each call. For larger payments, have a second person approve before money moves, if you can. Keep the rule and the log as proof.
Payment verification means confirming a payment request some other way than the one it arrived by, usually a phone call. It's how you catch business email compromise.
Check if you already have it
You're done if there's a written call-back rule that everyone who pays bills knows, a log showing it's being used, and, if your form asks about dual control, a second person approving larger payments.
How to set it up
Phone to confirm before any payment or bank detail change
Any setup, needs everyone who pays bills or changes payment details
- Write one rule and share it with anyone who pays bills: before paying a new account or changing someone's bank details, we phone them to confirm.
- Use a phone number you already had, from an old invoice or their website. Never use a number from the email asking for the change.
- Keep a simple log: date, who asked, who you called, and what they said.
- For larger payments, have a second person approve before money moves, if you can.
- Treat urgent or secret payment requests as a warning sign, even when they seem to come from someone you know.
How to show it's true: Keep the written rule and the call-back log.
- You work alone and your form asks about a second person approving: answer honestly. A call-back rule is still worth having.
Check the dollar amount on your form. Some forms ask about a second approver only above a set amount, and some ask about every bank detail change.
How to show it's done
Keep the dated written rule and the call-back log (date, who asked, who you called, what they said). Start the log the day you adopt the rule. File both in your proof folder.
Common questions
Does replying to the email count?
No. If the request came by email, call a number you already had.
I work alone. How can a second person approve?
You can't, so answer that question honestly. Keep the call-back rule anyway.
What if the request seems to come from the owner?
Same rule. Call the owner's usual number to confirm.
Sources
- Canadian Anti-Fraud Centre: Frauds targeting businessesantifraudcentre-centreantifraude.ca
- RCMP: Business email compromisercmp.ca
- Get Cyber Safe: Business email compromisegetcybersafe.gc.ca