How do cyber insurance forms expect me to check a supplier's change of bank details?

What exactly does the form ask?

These are the sources' own words, with the source and page each comes from.

When a vendor or supplier requests any change to its account details (including routing numbers and account numbers), do you confirm requested changes via an out-of-band authentication (a method other than the original means of request)?

A protocol for confirming any vendor, client or customer account information change requests (including requests to change bank account numbers, contact information or mailing addresses) via direct call to that vendor, client or customer using only the telephone number provided by the vendor, client or customer before the change request was received?

Before processing an electronic funds transfer or changing vendor account details, does the Applicant or their employees confirm the request by a secondary means of communication* and using the original contact information on file?

Please confirm that, before any change is made to a third party's account details, you obtain authorization from the third party via an authentication method which is different to the original method used to request the change:

They send a spoofed email informing the business of a change in payment details.

What does it mean for a small firm?

The fraud the question is about is common: an email that looks like it is from a supplier says its bank has changed. The Canadian Anti-Fraud Centre describes it.

Note the detail. One form wants the phone number you had before the request came in, not one in the email.

How do I answer it truthfully?

Write the rule down: no change of bank details is made until someone calls the supplier on the number already on file and the supplier confirms it. Answer Yes only if that is what happens every time.

What can an outside reading show, and what can it not?

An outside reading can see registered domain names that differ from yours by a letter or two, the names used to send a forged invoice or a change of bank details.

Your DMARC and SPF records are public. Anyone can read whether mail servers are told to refuse mail forged in your domain's name.

It cannot see your suppliers' mailboxes or how your staff handle a request.

Which questions sit next to this one?

• Payments to a new account
• Fraud training for payment staff
• DMARC
• Money sent to a fraudster: what to do