Never change an employee's payroll bank account, or a supplier's payment details, using email alone.
An attacker who gets into an employee's or a supplier's mailbox can send the request from the genuine address. A scammer can also register a near-identical domain and copy the name and signature. Either way, the email looks right because it is, apart from the bank details.
The process
- Before updating any bank details, call the employee or supplier on the phone number already held in your HR or accounts records, or speak to them in person. Never use a number provided in the email.
- Require a second person to approve the change.
- Record how the request was verified and by whom.
In construction, the supplier version is the big one
Mandate fraud against contractors and consultants, where a subcontractor's bank details are "updated" just before a large valuation is paid, is one of the most expensive frauds in the sector. The same call-back rule stops it.
If you'd like help writing this into your finance procedure, or want mailbox protection that catches the lookalike domains, ask us.
Want a hand with this? Talk to us.