What should our rule be for changing where money goes?

Every other defense in this topic reduces the odds. This one, followed consistently, stops the loss even when everything else has already failed and nobody noticed a thing. It costs nothing to implement and most businesses do not have it written down anywhere.

What the rule should say:

• Any change to where money goes gets verified by voice, on a number you already had. New supplier banking details, changed wire instructions, a first payment to a new vendor, an employee's direct deposit. Not a number from the email, the attachment, or a text that followed.
• Email never verifies email. If the request came by email, the confirmation cannot.
• Above a threshold you set, two people approve. Pick a number that fits your business and write it in the policy. What matters is that there is a figure and that everyone knows it, rather than what the figure is.
• Nobody is exempt. Especially not the owner. The most effective version of this attack impersonates the person who can override the rule, and it works because staff are reluctant to question them. If you own the business, say out loud and in writing that you expect to be verified too, and then do not get irritated when it happens. That one sentence from you is worth more than any product you could buy.
• Urgency is a reason to slow down, not speed up. Real transactions survive a ten minute delay. Put that in the rule explicitly, because urgency is the lever every one of these pulls.
• Nobody gets in trouble for checking, or for raising something that turns out to be fine. If people are worried about looking foolish, they stop asking.

Make it one page and get it signed. Not a policy document nobody reads. A page that anyone who touches payments has read and signed, revisited once a year and whenever someone new joins the finance side. The signature matters less for compliance than for the fact that it makes the conversation happen.

Two things that make it stick: give your staff explicit permission to delay a payment, in writing, so that declining to pay something today is clearly the right call rather than a judgment call. And run it once as a drill, so the first time anyone makes that callback is not the day it is real.

We will help you write it, and we will sit with your bookkeeper and go through it. It is the cheapest hour in security and we would rather spend it with you than spend the day after a wire goes out.