Before any payment changes or urgent payment goes out

Adopted ______ by ______. Review annually. Post where finance works.

Any change to payment details, and any urgent payment request, is verified by calling a number you already had on file, never a number in the message.
Payments above a threshold you set require two people to approve, in two channels.
Executives and finance staff agree a spoken codeword for urgent requests; a request without it waits.
Treat urgency itself as a warning sign. Legitimate partners can wait an hour.
Record every verification: who called whom, when, what was confirmed.
Report attempted fraud to the FBI's IC3 and your bank the same day; speed matters for recovery.

☐ Payment verification procedure adopted and signed by finance

☐ Dual approval threshold set

☐ Codeword agreed and refreshed quarterly

☐ Ten-minute deepfake awareness module completed by finance, HR, and executives

☐ Vendor payment-change requests routed to one mailbox with verification

☐ Bank callback contacts recorded

☐ Cyber insurance checked for social engineering coverage

From the AI Governance Commons fraud and deepfake kit, CC BY 4.0. Not legal advice.