Fraud controls: the checks that must stay inside

Key takeaways

Fraud prevention in a small business rests on a few checks that must stay in-house: verifying any change of bank details by phone to a known number, approving payments separately from preparing them, controlling admin access and reviewing unusual transactions. Outsourced teams follow these checks and flag concerns; the business owns them and makes the final call.

• Verify every bank detail change by calling a known number.
• Never let one person prepare and approve a payment.
• Phishing is the most common cyber attack UK businesses report.
• Providers flag; the business decides.

Why must fraud checks stay in the business?

Because fraudsters target whoever can move money or change payee details, and an outsourced team is another route in. Keeping the final checks inside means a criminal must fool both the provider and someone who knows your suppliers and staff. It also keeps responsibility for losses where the authority is.

• Which business processes should you never outsource?
• Bank mandates and payment authority: keep the keys

Which frauds hit small businesses most?

The UK government's Cyber Security Breaches Survey consistently finds phishing is the most common type of attack businesses identify. In finance, it often appears as fake supplier invoices, bank detail change requests and emails impersonating a director asking for an urgent payment.

• Fake bank detail change requests from 'suppliers'.
• Emails impersonating a director asking for urgent payment.
• Fake invoices for goods never ordered.
• Payroll diversion through changed employee bank details.

• Business email: who controls the mailboxes?
• Payroll: outsource the run, keep the sign-off

Which checks stay in-house?

The ones that need knowledge or authority only the business has.

• Approving bank detail changes after a call-back.
• Releasing payments, with dual approval above a limit.
• Approving new suppliers.
• Granting and removing system access.
• Reviewing the monthly exceptions report.

• Financial controls that never leave the business
• System access for outsourced teams: fast but safe

What should an outsourced team do?

Follow the checks every time, never act on urgency alone, flag any request that changes payee details or bypasses the normal process, and keep an audit trail. A good provider trains staff to recognise these frauds and will thank you for strict rules.

• BPO data security: protecting data with outsourced teams
• Outsourcing red lines: write them down before you sign

What does this look like in practice?

A pattern we see: an email from a 'supplier' asks to update bank details before a large payment. Where the rule is a call-back to the number already on file, approved by a manager, the fraud stops at the first step.

• See client work
• BPO Solutions for UK businesses

Fraud controls checklist

• Call back on a known number for any bank change.
• Separate payment preparation and approval.
• Use dual approval above a limit.
• Turn on email authentication and multi-factor login.
• Review exceptions monthly.

• Payroll: outsource the run, keep the sign-off
• Insurance cover: your broker advises, you decide

Next step

Ask your team, and your provider, what they would do if a supplier emailed new bank details today. If the answer is not 'call the number on file', write the rule this week.