Two People for Every Payment: Bank Controls for Small Offices
When one person can send money alone, one convincing email can cost a business dearly. How to set dual approval, payment limits and alerts with your bank.
Most small businesses train staff to spot fake emails. Far fewer set their bank to require a second person before money leaves. The training can fail on a busy Friday in December. The second approver is still there.
The scale of the problem explains why a process is worth the friction. In a September 11, 2024 public service announcement, the FBI put exposed losses from business email compromise at more than $55 billion, for incidents reported from October 2013 through December 2023. Its advice includes using “secondary channels and/or two-factor authentication to verify requests for changes in account information.” The controls below are the bank-side companion to that verification.
Five controls and what each one stops
| Control | How it works | What it helps with |
|---|---|---|
| Dual approval | “Dual approvals require two people to approve transactions,” per PNC; no single person may both create and approve an ACH or wire | One fooled or compromised employee |
| Payment limit | A ceiling on a single transaction, or on a day’s total, set at the bank | A large loss on a single approval |
| ACH block or filter | A block rejects all ACH debits; a filter allows only approved originators | Unknown companies pulling money from the account |
| Positive Pay | The bank compares presented checks against details you supply and flags mismatches | Altered or counterfeit checks |
| Alerts | Notices for transactions over a threshold, new payees, and sign-ins from unfamiliar devices | Catching it quickly |
Availability varies by bank and account type, and some of these carry a monthly fee. Community banks may offer them under other names, so describe what you want done and ask what they call it.
Set the rule
A control with no written rule gets bypassed the first time someone is out sick. PNC’s payment fraud checklist suggests requiring “dual approval on payments above a preset threshold.” For a small office, the policy can fit on a sticky note:
Over $X: two people, always
New payee or changed bank details: two people plus a call-back, any amount
Requested by email or text: never released the same hour
Owner traveling: a named backup approver, set up in advance
Pick a threshold that makes sense for your payment sizes. PNC also warns that rigid approval timelines can delay payments and encourage workarounds, which means the backup approver matters. A two-person rule works only if the second person can be reached.
The call-back belongs in the same rule
A second approver looking at the same fake email will approve it too. PNC recommends “requiring verbal confirmation for new or changed wire instructions,” and advises pausing and calling back on a number you already have on file. That is the step that gets out of the attacker’s channel. Our article on building a pause into the workday has wording your team can use when the sender claims to be the boss, and our payroll guide covers direct-deposit changes, which fit the same rule.
Two common objections
“We’re only three people, and we trust each other.” The rule isn’t about trust. It protects the person at the keyboard, who otherwise bears the whole weight of a mistake. In a very small office, the second approver might be the owner on a phone app.
“I’m the owner and the only one with access.” Then the risk is concentrated in one login. Use the bank’s strongest sign-in option, and have a trusted person, an accountant or a bookkeeper review the account independently at least monthly. PNC recommends separating payments from reconciliation where one person does both. Where you can’t separate them, have someone check afterward.
Set-up checklist
- List who can create, approve and view payments today. Remove anyone who no longer needs it, including former employees and old accounting logins.
- Give each person their own login. Shared credentials defeat dual approval.
- Turn on the bank’s strongest sign-in method for every user.
- Set alerts to a person outside the payment process.
- Agree on who the backup approver is for vacation weeks.
- Test it: run a small real payment through the full process before you need it.
If money has already moved
The FBI’s instruction is speed: contact your financial institution right away to request a recall of the funds, and file a complaint at ic3.gov as soon as possible. Ask the bank specifically whether a recall is possible and what information it needs. Keep the emails intact, including full headers. Then look at which control failed and adjust the rule. A mistake usually tells you where the process had a gap.
Bank controls don’t stop a fake message from reaching your staff. Pair them with sender checks on the email side. Our guide to email authentication for small businesses covers your own domain.
A one-page version for your team
Write the rule where the people doing the work can see it, and say what happens when someone objects. A short version might read: “Payments over the threshold need two people. New or changed bank details need a call to the number we already have. The owner has agreed not to ask anyone to skip these steps, so if a message from the owner asks you to, treat it as a fake.” That last sentence does a lot of work, because urgency from the boss is the pressure these messages depend on.
Review the rule once a year, and any time someone with payment access leaves. Departures are when permissions tend to be forgotten, and an old login left active undoes the whole arrangement.