What is the call-back rule for changed bank details?

What is the rule?

Verify all payment requests especially if there's a change in banking details. Contact the sender using a trusted phone number, not the one provided in the email.

The Canadian Anti-Fraud Centre advises firms to verify all payment requests, especially when banking details change, and to contact the sender using a trusted phone number, not the one in the email.

The RCMP recommends a two-step check for payment requests: confirm the request through another means, such as a phone call, and do not rely on email alone.

Why does a phone call work against look-alikes?

Use a two-step verification process for payment requests. Contact the source through another means of communication (e.g. by phone) to confirm the request is legitimate. Do not rely on email alone .

A look-alike controls everything in its own emails: the name, the signature, the phone number. It does not control the number in your file from before the request arrived.

The Canadian Anti-Fraud Centre also encourages dual authorization for wire transfers.

How do I make it a firm rule?

Businesses are encouraged to implement internal controls such as requiring dual authorization for wire transfers and regularly reviewing cybersecurity protocols.

1. Write down that no change of bank details is acted on without a call to a number already on file.
2. Keep the number in your client or supplier record, not in an email thread.
3. Require a second person to approve any payment to new details, as the Canadian Anti-Fraud Centre suggests with dual authorization for wire transfers.
4. Record who called, which number and when, before the payment goes out.