Clear Path step · Business · No money moves on one message

Verify every payment change on a second channel, with two people

OngoingAbout 45 minNowWith whoever pays the bills

No payment or bank-detail change goes out until someone has called a number you already trusted.

Why it matters: Business email compromise and invoice fraud succeed by asking for routine-looking changes. AI makes the email, voice or video convincing, so the defense has to be a procedure that doesn't depend on spotting a fake.

Do it

  1. Build a known-good contact list for vendors, clients and your bank, from contracts and past invoices, not from emails.
  2. Adopt the rule: any request to pay, change bank details or redirect payroll gets a callback to the number on that list.
  3. Require a second approver above a threshold you set, and in your bank portal if it supports dual control.
  4. Make urgency and secrecy a stop sign, including from the owner.
  5. Know the first hour if money goes out: call your bank to request a recall, then report at ic3.gov.

Say this: If anyone asks us to pay, or to change where money goes, I call the number on our list before anything moves.

Check it worked: No payment, new payee, vendor bank change, payroll change or gift card purchase happens without a callback to a known number and, above a set amount, a second approver.

Simply put

It's like a bank vault that needs two keys turned at once: one person can be fooled, two checking separately are much harder to fool. A callback to a number you already have doesn't care how real the email, voice or video seemed.

In detail

Finance teams rate the callback the most effective control they use against business email compromise; the two-channel verification guide has the survey. It's also the habit that transfers directly to AI agents: an agent asked to pay a new account should trigger the same callback.

As a story

Thursday afternoon, an email arrives from your regular supplier. Same name, same signature, same invoice layout. They've changed banks, it says, so this month's payment should go to the new account. A voicemail follows that sounds just like their accounts manager.

Your bookkeeper doesn't reply. She opens your known-good contact list, finds the supplier's number from last year's contract and calls it.

The real accounts manager hasn't changed banks and sent nothing. Your bookkeeper pays the invoice to the usual account, forwards the email to whoever handles IT and mentions it to you at the end of the day. Nothing moved that shouldn't have.

If this is new to you: Worried a callback will annoy a real vendor? Tell them it's your policy for everyone, every time. A real vendor loses a minute; a fake one loses the payment.

Points toward the Long View: the same callback for any AI agent asked to pay a new account.

Read more