Separate a persuasive instruction from the evidence needed to authorize a sensitive change.
Identify the point where trust changes
A routine business conversation can become a sensitive instruction when it changes a payment destination, grants access or alters an approved record. Define these transitions so staff know when the ordinary communication channel is no longer enough to establish authority.
Use a route established before the request
A new phone number or reply address supplied in the instruction is part of the instruction, not independent confirmation. Use your organization’s established verification process and known contact information. Record what was verified and by whom, without replacing the required approval steps.
Keep identity and authority separate
Recognizing a person does not establish that the requested action is authorized. A legitimate account may be compromised, and a genuine employee may still lack approval for the change. Review the source, purpose and authority as distinct parts of the decision.
Design for pressure and exceptions
Urgency can make an unclear process easier to bypass. Explain what staff should do when a deadline approaches, the usual approver is unavailable or the request does not fit the standard workflow. Give them a practical escalation route and a clear way to pause an unverified change.
Retain a useful decision record
The record should show the request, verification route, approvals and outcome appropriate to the process. Review exceptions and near misses to improve the workflow. A training exercise can help staff practise these decisions without using real customer transactions or changing production systems.
When a familiar conversation becomes a payment change
A supplier’s usual email thread contains a request to use a different bank account. The wording is credible and the message may even come from a compromised genuine mailbox. Replying to that thread confirms only that someone controls the conversation. Pause the change and use a contact route established before the request, following the organisation’s approval process. Record who verified the request, how the independent route was selected and who authorised the final action. Treat this as an example of workflow control, not a conclusion that any particular message is fraudulent.
Evidence to collect
- Identify the payment or account detail being changed and the business deadline involved.
- Use a previously established contact record rather than a number or link supplied in the change request.
- Keep independent verification and final approval distinct where the organisation’s process requires it.
- Record unresolved discrepancies and escalate them through the agreed finance and security route.
What a useful result looks like
Test the process with staff who receive urgent requests, including deputies covering absences. A useful exercise asks what happens when the known contact is unavailable or the request appears to come from senior leadership. Avoid making the control depend on detecting spelling mistakes, an unfamiliar accent or an obviously suspicious address; those signals can be absent.
Can caller ID or a familiar voice prove the request is genuine?
Neither should replace the approved verification route. Caller information and voices can be imitated or manipulated. The control should depend on independently established contact details and documented authority, with escalation when verification cannot be completed.