The Second Key: Payment Authority Controls for UK Firms That Change Staff
A fraudulent invoice is rarely a test of whether a business trusts its staff. It is a test of whether the business has designed a payment process that works when trust is stretched by distance, leave, turnover or a plausible-looking email. For many UK SMEs, the first serious attempt at payment fraud arrives before the approval process has been written down. The control exists in the owner’s head, the finance manager’s habits and a bank mandate that was signed several years ago. That is enough until it is not.
A near-miss that turned on a phone call
Consider a composite example drawn from common patterns rather than a single company. A building products firm in the Midlands receives an invoice for £48,000 from a regular supplier. The email says the supplier has changed banks and asks for future payments to go to a new account. The accounts assistant prepares the payment. The managing director is travelling and replies to a text message with the words ‘looks fine’. The bank’s Confirmation of Payee check returns a name mismatch, so the payment is held for review. The firm then calls the supplier using the number held in its own records. The supplier has not changed banks. The invoice is fraudulent.
No money is lost. But the near-miss is instructive. The firm had two signatories on its bank mandate, yet the practical control was one prepared payment and one informal approval. The bank’s warning saved the day, not the firm’s process. Had the payment been smaller, or the name check less clear, the outcome could have been different.
Where informal authority breaks down
Payment authority usually fails at three points. The first is staff turnover. The person who knows why a supplier is paid from a particular account, or who can spot an unusual request, leaves. Their knowledge leaves with them. The second is remote working. Approval by message or email can feel efficient, but it separates the approver from the source document and from the person preparing the payment. The third is supplier bank-detail change. It is a routine administrative event, which is precisely why it is a common fraud vector. A firm that treats every bank-detail change as ordinary is relying on vigilance rather than design.
These points share a common feature: they create a gap between the person who can move money and the person who can see whether the movement is legitimate. A robust process closes that gap without assuming that any individual will always be present.
Set thresholds before the invoice arrives
An approval matrix should be agreed by the board or the owners, recorded in writing and reviewed at least annually. It should set out who may approve payments at different values and what evidence the approver must see. A simple structure might be: payments below £1,000 require one authorised approver; payments from £1,000 to £10,000 require two authorised approvers; payments above £10,000 require two approvers plus an independent callback to the supplier. The figures should reflect the firm’s cashflow and risk appetite, not an aspirational policy that staff quietly ignore.
The matrix should also name deputies. If the finance director is on leave, the firm should know in advance who steps in and what limits apply. ‘Whoever is around’ is not a control. Nor is a single named person who can approve everything. The aim is not to slow the business down, but to ensure that speed does not depend on one individual’s memory.
Dual authorisation means two separate people, not two clicks
Dual authorisation is often described as a bank mandate feature. In practice, it is a behavioural control. Two authorised individuals should review and approve a payment through separate credentials. They should not share a password, a token or an inbox. One person may prepare the payment; another should approve it. If both are in the same office, the second approver should still see the invoice, the supplier record and the bank details. If they are remote, the same evidence should be available on screen, and the approval should be recorded in the payment system rather than given verbally.
For higher-value payments, the second approver should be able to see that a callback has taken place. A tick box is not enough. The record should show who called, when, which number was used and what was confirmed.
Callback verification: use a number you already hold
A callback is only useful if it is independent of the request. The firm should call the supplier on a number already held in its supplier master data or on the supplier’s verified website, not on a number printed in the invoice or email that prompted the change. The caller should confirm the invoice number, the amount and the bank details, and should record the date, time and name of the person spoken to.
Confirmation of Payee is a helpful UK payment check, but it should not be the only control. It compares account names and can flag mismatches, yet it does not prove that the supplier requested the change. For new suppliers, the same principle applies: verify the bank details through an independent channel before the first payment, not after the first invoice.
A quarterly test of who can move money
Controls drift. People change roles, joiners arrive and leavers retain access longer than expected. A quarterly authority test gives the firm a simple way to check that the written matrix still matches reality. The test need not be elaborate. It should cover four areas.
First, reconcile the bank mandate to the current staff list. Confirm who the signatories are, what limits apply and whether dual authorisation is switched on for the accounts that matter. Second, review users in the payment system. Check who can create payments, who can approve them and who holds administrator rights. Remove leavers on their final day, not at the end of the month. Third, review supplier master data changes for the quarter. Sample a handful of bank-detail changes and confirm that each was independently verified. Fourth, walk through a payment from invoice to approval. Ask whether one person could create and approve a payment without another person seeing it. If the answer is yes, the control has a gap.
The test should be documented and reported to the board or owners. A short record of what was checked, what was found and what was fixed is more useful than a policy that is never examined.
Making the second key part of the culture
A second signature or a second approval is not a statement of distrust. It is a recognition that payment fraud exploits moments when people are busy, travelling or trying to be helpful. The firm that explains this clearly is more likely to get cooperation than the firm that imposes controls without context. Staff should feel able to question a payment, even when a director has asked for it to be processed.
The practical conclusion is straightforward. Write down the approval matrix. Separate preparation from approval. Verify bank-detail changes by callback. Test the system every quarter. The first fraudulent invoice may still arrive, but it should meet a process rather than a gap.
