A payment rule your team will actually follow
Fake invoices, changed bank details and cloned voices all end the same way: a payment to an account nobody checked. Pick your bank, your team size and the payments you make, and get one page: who approves what, the call-back on new bank details, a code word, the setting to switch on at your bank, and a letter telling suppliers about the one-day hold.
Your answers are saved in this browser only. Nothing is sent to us.
Your bank
Your team and payments
Hold on new or changed bank details
Your limits
A second person approves anything over $5,000 (about twice a usual payment), and the owner approves anything over $20,000 (about half the largest). New payees and changed details always get the call-back and the hold, whatever the amount.
Name the second approver. It should be someone who doesn't usually set up payments.
Cyber insurance applications ask whether transfers over $5,000 or $25,000 and every change of bank details are confirmed on a second channel. This rule answers yes to both; keep the call notes, because claims are refused when the call-back can't be shown.
Your payment rule
[COMPANY]: PAYMENT RULE
Agreed by [owner] on [date]
1. New payee or changed bank details
- Call the supplier on the number already in our records (the
contract, the supplier file, a contact saved before the request).
Never a number from the email, the invoice, the signature or a
voicemail.
- Write down who you spoke to, when, and what they confirmed.
- The new details wait one business day before the first payment,
whoever asks and however urgent it sounds.
- [second approver] checks the bank details (not just the amount)
before the first payment.
2. Who approves what
- Up to $5,000: [who pays the bills] pays, to a payee already on
file.
- Over $5,000: [who pays the bills] sets it up and [second approver]
approves it in the bank.
- Over $20,000: [owner] approves it personally, as well as the second
approver, and it doesn't go out the same day it was asked for
unless it was planned before.
- Nobody approves a payment they set up themselves.
3. Urgent or secret requests
- A request to pay quickly, quietly or outside the usual process is
checked the same way as a new payee, even when it seems to come
from the owner.
- Payment requests from the owner or a manager are confirmed by
calling their own mobile, or by asking for the code word. The code
word is never written in email or chat and changes when someone
leaves.
- [owner] agrees in advance: "I will never be annoyed that you
checked."
4. The bank
- Turn on Chase Dual Control (security settings, manage users). It
needs at least two online banking users; the person who creates a
payment can't approve it, and it covers bill pay, external
transfers, wires and ACH, not transfers between your own accounts.
Set each user's daily limit in Access & Security Manager. Switching
it off later needs a call to Chase, which is the point.
- No national name check in the US. Ask Chase whether account
validation runs on new ACH payees.
5. If money has gone to the wrong place
- Call the bank's fraud line at once (not the branch) and ask for a
recall; give the amount, time and receiving bank.
- File at ic3.gov the same day, whatever the amount.
- Tell [owner] and call the insurer's claims line before doing
anything else with the supplier or the sender.
Read and agreed: ______________________ Date: __________Written with biz59.net/tools/payment-rule · 2026-10-25
Bank setting from: chase.com/business/online-banking/access-manager; privatebank.jpmorgan.com (Chase Dual Control how-to). Menus move; if yours looks different, ask the bank for the feature by name.
Letter to your suppliers
Subject: How [Company] handles changes to your bank details Hello, From [date], whenever a supplier's bank details change, we will call you on the number we already have on file to confirm them, and the new details will wait one business day before we make the first payment to them. We won't act on new bank details sent only by email, attached to an invoice or given in a call we didn't make, even if they look like they come from you. Invoice fraud now often uses real mailboxes and cloned voices, and this check protects your money as much as ours. Please let us know who we should call and on which number, and tell us by phone if you ever plan to change banks. Payments to your current account are not affected. Thank you, [name] [Company]
Putting it in place
An hour, once. Switch on the bank setting with the second approver at the next desk, agree the code word out loud (never in email or chat), send the letter to your regular suppliers, and print the rule for whoever pays the bills. The owner signs it, because the rule only works if staff know the boss won't mind being called back.
Why each check is there, the cases from the 2019 voice clone to Arup's $25.6m video call, and what the five checks cost a 12-person company in a year are in our article a cloned voice asks for a wire. Your insurer asks about the same call-backs: the cyber insurance application check shows which answers matter.
A starting point, not legal or banking advice. More free tools: biz59.net/tools.