How do cyber insurance forms expect me to check a payment to a new account?

What exactly does the form ask?

These are the forms' own words, with the form and page each comes from.

A protocol for confirming all payment or funds transfer instructions/requests from a new vendor, client or customer via direct call to that vendor, client or customer using only the telephone number provided by the vendor, client or customer before the payment or funds transfer instruction/request was received?

Please confirm that, before you transfer funds to an account that you have not paid into before, you obtain authorization from the recipient of the funds via an authentication method which is different to the original method used to request the transfer:

What does it mean for a small firm?

This is different from a change of bank details. It covers the first payment to anyone new, including a client you are paying out to.

How do I answer it truthfully?

Make it a step in the payment process: a new account gets a call to a known number before money moves, and the person who calls notes the date and who confirmed.

What can an outside reading show, and what can it not?

An outside reading can see registered domain names that differ from yours by a letter or two, the names used to send a forged invoice or a change of bank details.

It cannot see who you pay or how a payment is approved.

Which questions sit next to this one?

• Supplier bank detail changes
• Wire authorization and sign-offs
• Money sent to a fraudster: what to do