Strengthen controls around routine requests
Strong payment controls don’t rely on employees identifying every fraudulent request. They create consistent processes that apply regardless of who makes the request.
Verify payment instruction changes independently
Changes to banking information should be confirmed through a previously verified contact method already on file.
Example: A supplier emails updated account information. Rather than relying on the contact details provided in the email, the Payments team confirms the change using an existing phone number or historic contact record.
Maintain separation of duties
Critical payment activities should be performed and independently reviewed by several individuals. Each step, from creating and approving changes to releasing payments, should require oversight from a different employee to help detect errors, prevent fraud and ensure…
Never share a One-Time PIN (OTP) with anyone over the phone, including people claiming to be bank officials, as legitimate employees will never ask for this code to “verify” your identity.