Payment fraud is one of the most expensive problems a small firm can face, so we've turned our own approach into a free Payment Verification Policy you can download, review with your attorney and roll out at your company. You'll find it below.
How payment fraud usually works
- A compromised or look-alike email account sends new wire instructions that appear to come from a vendor, client, title company or colleague.
- The timing is deliberate: right before a closing, a payroll run or a vendor's due date.
- Urgency or secrecy: "Please handle this today and keep it quiet."
- Voice and video impersonation. Attackers can now imitate a familiar voice. A phone call that sounds like your managing partner isn't proof on its own.
Often nothing on your network is "hacked" at all. The criminal only needs one person to follow the instructions.
A simple verification procedure
- Any change to bank details triggers verification. No exceptions for urgency or seniority.
- Call back on a known number, from your own vendor file, the signed engagement letter or a number you've used before. Never use a number, link or contact supplied in the request.
- Confirm the details out loud: payee name, bank, account and routing numbers and the amount. Have the other person read them to you, not the other way around.
- Use a second approver for payments above a threshold you choose.
- Use a pre-agreed phrase or second question for high-risk requests from executives, so a cloned voice can't pass on familiarity alone.
- Document the verification: who called whom, on what number and when.
- Tell clients up front how you will and won't send payment instructions, for example "We'll never change wire instructions by email."
Free download: Payment Verification Policy
We're giving this policy away because the fix for this problem is a rule that everyone follows, not a piece of software. It is a short, plain-language policy built around one rule: before we change any vendor's bank details or send a payment based on an email, we call and confirm using a phone number we already have on file, never a number from the email or invoice.
The download includes the core one-page policy, a set of optional additions (a second approver, handling voice and video requests, record keeping, training and an employee acknowledgement), and a place for your firm's details.
- Download the Payment Verification Policy (Word, editable)
- Download the Payment Verification Policy (PDF)
It is a template, not legal advice. Have your attorney review it, adjust it to your firm and your obligations, and then walk your team through it. A policy only works if the people who handle payments know it and follow it.
Technical controls that help
- MFA on email, which makes account takeover harder
- Email authentication (SPF, DKIM, DMARC) so others can't easily spoof your domain. See our DMARC guide
- External-sender tags and look-alike domain warnings
- Alerts for new inbox forwarding rules, a common sign of a compromised account
These lower the risk, but the verification procedure is what actually stops the payment.
If money has already been sent
Contact your bank immediately and ask about recalling the transfer. Speed matters. Report it to the FBI's Internet Crime Complaint Center (ic3.gov), notify your insurer as your policy requires, and have your IT provider check whether an email account was compromised. For law firms, involve your malpractice carrier and ethics counsel as appropriate.
FAQ
Is calling back enough now that voices can be cloned?
A callback still works if you place the call to a number you already trust. The risk is accepting a call that comes to you, or calling a number given in the request.
Should we stop accepting wire instructions by email?
Many firms tell clients they'll never change instructions by email, and always confirm by phone using known numbers. Use secure portals where possible.
Does cyber insurance cover wire fraud?
Sometimes, often with limits or under a separate coverage. Ask your broker.
Still have a question?
Ask Little Sprout for general information. To review your payment-verification steps and email protections, schedule a free 15-minute discovery call.