Make verification part of the job

Imagine a supplier asking your finance team to change its bank details. The invoice is expected. The email sounds familiar. Payment is due today, and someone is waiting for confirmation. An employee notices the unusual request and hesitates. This is the moment the awareness training was meant to prepare them for. What, exactly, are they allowed to do next?

Dubai Electronic Security Center's “Don’t Get Played” campaign (external source, opens in a new tab), launched on October 1, encourages people to pause and verify suspicious requests. It highlights urgency, secrecy, unusual demands, and attempts to prevent independent checks. An employer has to make that pause possible when a payment is already due.

Recognizing a warning sign is the beginning of a decision. The employee still needs a reliable contact, a clear approval route, and permission to delay the payment while the request is checked. If those are missing, the organization has left a difficult judgment with the person facing the deadline. Another reminder to be vigilant will not supply the missing phone number or decide who can hold the payment.

For a bank-detail change, the check needs to confirm both the request and the payment details through an independently established contact. The FBI's 2017 guidance on business email compromise (external source, opens in a new tab) recommends using previously known telephone numbers to verify fund-transfer requests. A number supplied in the email cannot serve as that independent check. Nor is identifying a familiar person enough: confirm what they are asking the business to change, then record the result.

Managers have a part in this, too. Suppose the employee follows the procedure and the request turns out to be genuine. If their reward is a complaint about slowing things down, the written instruction and the working instruction have diverged. Treat a properly made check as part of completing the transaction. A genuine request still needs to pass the process, including when it comes from someone senior.

Not every routine message needs a phone call. Define the changes that warrant additional verification, such as new payment details or an unexpected request for sensitive information. Keep the route proportionate to the consequence, and provide an alternative when the usual approver is unavailable. Otherwise, a sensible safeguard can become an invitation to invent a workaround.

Try the opening scenario with the people who would handle it. Ask them to find the contact, explain the approval, and show how they would record the check. The useful discovery may be a missing instruction rather than a missed warning sign. Fix that gap while the payment is still imaginary.