Define the operational boundary
Payment fraud succeeds when a convincing message can change trusted master data or bypass normal approval. Attackers may compromise a supplier, impersonate an executive or exploit knowledge from previous correspondence. Email filtering helps, but the decisive control is a business process that treats destination changes and unusual urgency as high-consequence events.
Document the systems, identities, information and external dependencies inside the decision. The most important failure paths are compromised supplier mailboxes, lookalike executive requests, unverified beneficiary changes, urgent exceptions outside normal approval. Assign one accountable owner and record any boundary that remains outside the current work. This prevents a technically sound control from being mistaken for protection of a wider process it cannot actually cover.
Design controls around the real workflow
Require bank-detail changes through a controlled workflow and verify them using a previously established contact channel. Separate request, verification, master-data update and payment approval where practical. Do not use telephone numbers or links contained only in the change request. Define thresholds and exceptions before an urgent transaction occurs.
Build the control path from independent callback verification, segregated master-data authority, payment thresholds, verified contact registry, rapid financial escalation. Each layer should have a stated purpose, an implementation owner and a safe failure mode. Test ordinary work as well as privileged and emergency journeys. Where the strongest option cannot yet be used, document the temporary safeguard, residual consequence and date by which the design will be reconsidered.
Operate from evidence
Monitor new beneficiaries, recent detail changes, payment overrides and unusual approval patterns. Preserve the request, verification record and system change as one auditable transaction. Train finance and procurement teams with realistic examples, while giving them a fast escalation route that does not punish a cautious pause.
Useful operational evidence includes change requests, callback records, beneficiary history, approval events, related mailbox activity. Protect that evidence from routine administrators where practical, define how long it remains useful and make gaps visible. Measures such as changes independently verified, urgent exceptions, time to bank escalation, fraud simulations reported should trigger a review, escalation or investment decision; a dashboard without an accountable response path is only decoration.
Prepare for failure and misuse
Prepare immediate contacts for banks, affected suppliers, leadership and qualified advisers. If fraud is suspected, stop pending transactions where authorised, preserve evidence and contact the financial institution through verified details. Review related accounts and messages because one fraudulent request may indicate wider mailbox or supplier compromise.
Exercise a scenario that removes a trusted dependency or exposes an abused privilege. Require the team to use real contacts, alternate authority, preserved records and recovery procedures. Capture what was known, what remained uncertain and which decision changed the outcome. Improvements should be verified through a repeated technical check rather than closed when a document is approved.
Move from a pilot to sustained control
Begin with one representative service and complete the sequence: map the payment-change journey, define independent verification, separate authority, enable monitoring, exercise a suspicious request. Publish the minimum standard, the exception route and the evidence required for acceptance. Expand only after the pilot shows that owners can operate the control without hidden manual work or unsafe workarounds.
Review the design after major platform, supplier, identity or business-process changes. Retire obsolete access and configuration rather than carrying every historical exception forward. Report progress in terms of reduced attack paths, faster verified recovery and clearer ownership. This keeps the programme connected to operating risk instead of measuring activity alone.
What to do next.
- ✓Verify changes using known contact details.
- ✓Separate request, change and approval authority.
- ✓Monitor new beneficiaries and overrides.
- ✓Provide a rapid escalation route.
- ✓Preserve the complete transaction record.
- ✓Exercise finance and procurement teams.
Use guidance responsibly
Technology, provider behaviour and legal requirements change. Validate implementation details against current official documentation, test changes safely and obtain qualified legal advice where required.
Zanele Dlamini
Threat Awareness ContributorExplores email risk, human decision points and layered safeguards that help organisations resist common attack paths.
More from this writerPriya Govender
Data Protection ContributorFocuses on information protection, privacy-aware monitoring and evidence that helps organisations control sensitive data responsibly.
More from this writer