Should we tell clients how we will and will not ask for payment?

What does the statement do?

Consider telling your suppliers or customers what to look out for (such as 'we will never ask for your password', or 'our bank details will not change at any point'). This gives the recipient another chance to detect a phish.

The UK National Cyber Security Centre suggests telling suppliers and customers what to look out for, such as 'our bank details will not change at any point', so a false email gets another chance to be caught.

A client who has been told your bank details never change by email has a rule to apply when an email says they have.

What should it say?

1. Our bank details will not change by email.If you get a message saying they have, call us at the number on our engagement letter.
2. We send payment instructions only from addresses ending in your real domain, for example @yourfirm.example.
3. We will never ask you to pay to a personal account or by gift card.
4. If an email from us feels rushed or unusual, call before you pay.

Where should clients see it?

Ensure staff are familiar with the normal ways of working for key tasks (such as how payments are made), so they're better equipped to recognise unusual requests.

The NCSC also suggests making sure staff know the normal way key tasks such as payments are done, so unusual requests stand out.

1. Put it in the engagement letter and on every invoice.
2. Repeat it in the email footer that goes with payment requests.
3. Say it out loud at the start of a matter that involves a large payment.