Business Email Compromise — where criminals impersonate a director, supplier, or client to redirect payments — is one of the most costly frauds affecting small businesses. The defence is simple: a phone verification rule.
Implement a policy that any payment request above a set amount (start with £500 or whatever feels right for your business) must be verbally confirmed before processing.
The key is to call using a phone number you independently know — not the one in the suspicious email. Use the number from the contact's business card, your records, or their official website. Do not reply to the same email chain.
This rule should apply to:
- Unexpected payment requests from management or directors
- Any supplier asking you to update their bank account details
- Solicitors or estate agents sharing bank details for large transfers
- Any email claiming urgency around financial matters
Fraud at the Bristol marketing agency was only possible because the assistant processed a payment without picking up the phone. A 30-second call would have prevented £13,800 in losses.
Tags