A payment verification procedure to stop wire fraud

The Canadian Anti-Fraud Centre collects reports of fraud and cybercrime from across Canada, and business payment fraud follows a few familiar patterns. Each one ends with an employee sending real money to an account the fraudster controls, usually because the request looked routine and urgent at the same time.

• Vendor impersonation: an email from a supplier, or a look-alike domain, announcing new banking details before the next invoice
• Compromised mailbox: an attacker inside a real vendor's or your own mailbox replies in an existing thread with altered instructions
• Executive impersonation: the 'CEO' or 'managing partner' asks for an urgent, confidential transfer, sometimes now using cloned voice or video
• Payroll diversion: an 'employee' asks HR to update direct-deposit details
• Closing and settlement fraud: altered payout instructions in real estate, legal or lending transactions

The core control is simple: any new payee, any change to payment details and any unusual request is confirmed by calling the requester on a number you already had, not one supplied in the request.

Write it precisely so it cannot be satisfied by a shortcut:

1. 01

   Use a known number

   From the vendor master file, a signed contract or the vendor's official website, never from the email, invoice or signature block in the request.

2. 02

   Speak to a known person

   Ideally someone you have dealt with before. Ask them to confirm the details read back to them, rather than reading them out yourself.

3. 03

   Record the call

   Who called, whom they spoke to, the number used, date and time, and the result, attached to the payment record.

4. 04

   No reply-to-email confirmation

   Replying 'please confirm' to the same email thread confirms nothing if the thread is compromised.

Two people should be needed to release any payment above a threshold that fits your business, and every payment to a new or changed payee regardless of amount. In online banking, set up separate roles so one person creates a payment and another approves it, and make sure the approver sees the destination account, not just the amount.

Set thresholds based on what you could afford to lose, not on what is convenient. Review them yearly, and watch for payments split to stay just under the limit.

Fraudsters manufacture urgency: a deal closing today, a supplier threatening to stop shipments, a CEO who is 'in a meeting and can't talk'. The procedure has to hold precisely when someone senior asks to skip it.

Put it in writing, signed by leadership, that no one, including the owner, may instruct staff to bypass verification, and that staff who follow the procedure and delay a genuine payment will be backed. Give finance a short script: 'Our policy requires a callback before any change. I'll call you on the number we have on file.'

Controls drift. Every few months, pick a sample of payee changes and check that each has a callback record and a second approval. Run a tabletop with finance on a business email compromise scenario. Include a fake change-of-details request in your phishing simulations for accounts payable.

On the technical side, reduce the number of convincing requests that reach finance at all: MFA on every mailbox, alerts for new forwarding rules, external-sender tagging, and DMARC enforcement so your own domain cannot be spoofed to your vendors. Microsoft's incident response playbooks for phishing and password spray describe how attackers get the mailbox access these frauds depend on.

We investigate payment fraud when it happens and help finance teams design controls that hold up.