Secure the identities that can reach the bank
Start with the accounts that can reset credentials, approve payments or change beneficiaries. CISA recommends multifactor authentication and encourages organizations to use phishing-resistant methods where possible. Banking security therefore includes the company email system as well as the bank portal because attackers can use a compromised mailbox to intercept reset links, imitate executives or redirect payment instructions.
Give each employee a named account instead of shared credentials. Remove access immediately when roles change. Administrators should have stronger authentication and fewer daily-use privileges than ordinary staff. If the bank supports hardware security keys, number matching or other stronger factors, prioritize them for employees who can release wires or ACH files.
Protect mobile numbers and recovery methods used for authentication as carefully as passwords. A strong bank password can still be undermined if an attacker can reset the account through a poorly controlled email inbox or phone recovery process.
Separate payment creation from payment release
A single employee should not normally be able to create a new payee, enter a high-value payment and approve it without independent review. Use dual approval where available and set dollar thresholds that match the company’s normal activity. A $150,000 wire should not follow the same approval path as a $75 office-supply payment.
The goal is to make fraudulent instructions require more than one compromised identity. Assign one role to prepare payments and another to release them. Review whether administrators can bypass the normal workflow, and limit the number of people with that authority. The control should be simple enough that staff do not create informal workarounds.
For very small firms where two employees are not always available, design a compensating control such as owner approval above a threshold or delayed release for new beneficiaries. The control should be realistic enough that staff actually follow it.
Verify changes to payment instructions outside email
Business email compromise remains a major source of loss. The FBI’s IC3 reported roughly $3 billion in BEC losses for 2025, and the FTC warns businesses that scammers impersonate executives, vendors and other trusted parties to redirect payments. The most effective practical response is to verify sensitive changes through a known, independent channel.
If a vendor emails new bank instructions, call a previously verified phone number from the contract or vendor master record. Do not use the phone number included in the change request itself. Apply the same rule to internal messages asking for urgent wires. A five-minute callback can interrupt a fraud that would otherwise move funds beyond recovery.
Add a special rule for first time payments and changed bank instructions. Those events deserve more verification than a recurring payment to a beneficiary whose details have been unchanged and independently confirmed for months.
Use bank controls for checks, ACH and wires
Ask the bank which controls apply to each payment rail. Check positive pay can compare presented checks against an issued-check file. ACH debit blocks and filters can restrict which originators are allowed to debit the account. Wire templates, beneficiary controls, dollar limits and dual approval can reduce the chance that a compromised user can send unrestricted payments.
Controls should reflect the company’s actual activity. A business that never allows external ACH debits can use a stricter block than a company with many authorized debitors. Exception review also needs an owner. A control that generates alerts but no employee checks them before the decision deadline provides little protection.
Ask the bank what happens when an exception is not reviewed by the cutoff. Some positive pay systems default to pay and others to return. That setting can materially change the protection, so it should be a deliberate business decision.
Monitor accounts and reconcile quickly
Daily transaction visibility shortens the time between fraud and detection. Use bank alerts for new payees, password changes, large transfers and unusual activity, then reconcile the bank account against the accounting ledger on a defined schedule. High-volume accounts may need daily review rather than waiting for month-end.
Separate monitoring from payment initiation when staffing allows. An employee who did not create the payment is more likely to notice an unexpected beneficiary or duplicate amount. Keep a record of reviewed exceptions so recurring anomalies do not become accepted simply because they appeared several times.
Review reconciliations for patterns as well as individual errors. Repeated small unauthorized amounts, changed check numbers or unusual timing can be more important than one obvious large transaction because fraud often begins with testing.
Write the response plan before an incident
If a fraudulent transfer is discovered, speed matters. The FBI advises victims of fraudulent transfers to contact the financial institution immediately and request a recall, while preserving transaction and communication records. The company should know the bank’s fraud contact route, who has authority to speak for the business and which internal leaders must be notified.
The plan should also cover credential resets, suspension of compromised users, preservation of email and system logs, vendor notifications and reporting to appropriate law enforcement. Because business accounts do not receive every consumer protection that applies to personal accounts, do not assume an unauthorized electronic transfer will be automatically reimbursed. Review the business account agreement and bank security procedures in advance.
Include the bank’s after hours fraud number and the account information needed for escalation in the plan. The first employee who discovers the problem should know exactly whom to call without waiting for a manager to search old correspondence.
Editorial Verdict
Design fraud controls around the payment process.
The strongest setup combines secure identities, role separation, independent verification, bank-level payment controls and fast reconciliation. Technology helps, but the decisive control is often the workflow that prevents one email or one compromised user from moving money alone.