PAYMENT VERIFICATION FOR BUSINESSES: VERIFY BEFORE MONEY MOVES
A business payment can be processed successfully and still be fraudulent.
An attacker may impersonate a supplier, employee, executive, customer or service provider and attempt to change where money is sent or persuade someone to make an unusual payment.
The central principle is simple:
BEFORE BUSINESS MONEY MOVES, VERIFY THE PERSON, PURPOSE, AMOUNT AND DESTINATION.
1. WHY PAYMENT REQUESTS REQUIRE VERIFICATION
A payment request may look familiar because it uses a known company name, invoice format, email signature or conversation history.
Those details do not prove that the request is genuine.
The request may involve:
- A new bank account
- A changed beneficiary
- A changed account number
- An unusual amount
- An urgent payment
- A request to bypass normal approval
- A request to keep the payment confidential
- A request from a compromised business account
2. VERIFY THE PAYMENT, NOT JUST THE MESSAGE
Do not treat the message containing payment instructions as the only source of truth.
Verify important details through a trusted, independent channel.
For example, use a previously known telephone number or established business contact rather than a new number supplied in the suspicious message.
The goal is to verify the instruction independently of the channel that delivered it.
3. CHECK THE CORE PAYMENT DETAILS
Before approving a high-impact or unusual payment, confirm:
- Who is being paid?
- Why are they being paid?
- What amount is being paid?
- Which account or beneficiary will receive the money?
- Is the payment expected?
- Does it match the invoice or agreement?
- Has any payment detail recently changed?
- Has the appropriate person approved it?
4. USE APPROVAL CONTROLS
Businesses should establish approval requirements for payments according to their size, risk and financial processes.
Higher-risk payments may require additional review or approval.
Examples include:
- High-value payments
- New beneficiaries
- Changed bank details
- International payments
- Unusual refunds
- Emergency payments
- Payments outside normal business patterns
The exact threshold should be determined by the organization.
5. DO NOT LET URGENCY REPLACE VERIFICATION
An attacker may say:
“Pay immediately.”
“The supplier will stop work today.”
“The director approved this.”
“Do not call to confirm because this is confidential.”
Urgency can be legitimate, but urgency should not automatically remove verification controls.
If the payment is important enough to make urgently, it is important enough to verify safely.
6. BUSINESS EXAMPLE
A supplier sends an email saying its bank account has changed and asks the company to use the new account for today's payment.
The email looks normal.
Instead of replying to the email and accepting the new details, the company contacts the supplier using an established contact method already held in its records.
The supplier confirms whether the change is genuine.
That independent verification can prevent a fraudulent transfer.
7. PRACTICAL BUSINESS CHECK
Before an unusual or high-impact payment:
□ Verify the request independently. □ Confirm the beneficiary. □ Confirm the amount. □ Confirm the purpose. □ Check for recent changes. □ Follow the organization's approval process. □ Record important verification where appropriate.
WHY THIS MATTERS
Payment fraud often succeeds by exploiting normal business processes rather than technical weaknesses.
A simple verification step can interrupt an otherwise convincing fraudulent request.
VERIFY BEFORE YOU TRUST.
A familiar message is not sufficient evidence for an irreversible financial action.