Earlier this month we said to verify payment changes by voice. That works well, right up until the person who would have made the call is new, or busy, or junior enough not to want to question an invoice from a long-standing vendor.
A habit protects one person. A written rule protects the organization.
What “out-of-band” means
You’ll hear this called out-of-band verification. It just means checking a request through a different channel than the one it arrived on. An emailed request gets verified by phone, using a known, trusted number that did not come from the email. Replying to the email doesn’t count, because the reply goes to whoever sent it.
What the rule needs to cover
A workable policy fits on one page. It needs five things.
- What triggers verification. A new vendor. Changed bank details for an existing vendor. A change to payroll direct deposit. Any payment over a threshold you choose. Any request that arrives through a channel it normally wouldn’t.
- Where the phone number comes from. Your own records, such as the vendor file or the original contract. Not the request, and not the letterhead on the attached invoice. Both can be forged.
- Who verifies and who approves. Named roles, with a named backup for when someone is out. “Someone should check” is not a control. A point person is.
- What gets written down. One line in the file: who called, which number, who answered, and the date.
- Who it applies to. Everyone. If the executive director is exempt, you don’t have a policy, because the executive director is exactly who an attacker will pretend to be.
A simple template
Payment verification rule
Applies to: everyone, including the executive director and board officers.
Verify before paying when: a new payee is added; bank details change; direct deposit changes; a payment exceeds $____; a request arrives by an unusual channel.
How: call the number already in our records. Never use contact details from the request.
Who: [role] verifies; [role] approves; [role] is the backup.
Record: date, number called, person spoken to, outcome.
Fill in the blanks, and you have a policy.
Tell your vendors
Once the rule is in place, let your regular vendors know: “If your bank details ever change, expect a call from us to confirm.” Most will be glad to hear it. Attackers impersonate vendors too, and the vendor would much rather you called than paid someone else.
Make it outlast the people who wrote it
None of this needs software. It needs a decision, written down, that survives turnover. The person who knows to be careful today may not be here next year, and the new bookkeeper deserves a rule to point to when an urgent request lands on their desk.
This week’s action
Draft the one-page rule and get it approved at your next board or staff meeting.
Next in this section: nobody reports what gets them blamed.