# Check the request, not the voice: payment changes at work

A short check for any request to change bank details or make an unusual payment, so a convincing fake call, message or video call cannot move money on its own.

Workflows · v1.1 · draft · https://hayzlabs.com/workflows/payment-change-check/

In short:
- Stop, and do not reply or call any number in the request; a convincing voice, face or video call is not a check.
- Call back on a contact from your own records and ask them to confirm the change, the amount and the new account's last four digits.
- Have a second person approve before any money moves, and record the outcome and where the contact came from.

> [!NOT ADVICE]
> This is a general check and not advice on your organisation's own payment rules. If your company or bank has a procedure, follow it, and use this page for the gaps.

**Produces:** a payment change or an unusual payment that has been confirmed through a contact you found yourself, approved by a second person and written down, or a clear refusal.

**Use it when** anyone asks you, by email, call, chat or video, to change bank details, pay a new account, or make an urgent or unusual payment.

**Not when** a payee and their details are unchanged and the payment is routine.

**You need** a trusted source for contact details (your directory, the contract, a previous invoice, or a supplier portal you reach through your own bookmark), a second person who can approve, and somewhere to write it down. For calls to you or your family at home, use [AI voice scams: hang up and call back](https://hayzlabs.com/guides/hang-up-and-call-back/) instead.

## Why a voice or a face is not a check

Business email compromise (fraud where someone poses as a boss or supplier by email to redirect payments) is one of the largest loss categories in fraud complaints: $3.05 billion in 2025 IC3 complaints, next to investment fraud at $8.65 billion ([FBI IC3 2025 report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf), complaint data). CNN reported that an Arup employee in Hong Kong made 15 transfers totalling HK$200 million (about US$25.6 million) after a video call with deepfaked colleagues. Arup confirmed that "fake voices and images were used" and that "none of our internal systems were compromised" ([CNN, via ABC17, May 2024](https://abc17news.com/money/cnn-business-consumer/2024/05/16/british-engineering-giant-arup-revealed-as-25-million-deepfake-scam-victim/), press report). People cannot reliably tell a cloned voice from a real one ([the evidence is in our voice-scams guide](https://hayzlabs.com/guides/hang-up-and-call-back/)), so the check rests on where the contact details came from and on a second person.

## Steps

| # | Step | Who | Time | Check |
|---|---|---|---|---|
| 1 | Stop. Do not reply to the message, and do not call any number in it. | Person | 1 min | Nothing has been paid or changed. **If it fails:** tell your finance lead now. |
| 2 | Write down the request: who it claims to come from, what changes, the amount, the deadline and how it arrived. | Person | 3 min | All five items are written. **If it fails:** write "unknown" for any gap. |
| 3 | Find a contact for the real person or company from your own records, never from the request. | Person | 3 min | You can say where the contact came from. **If it fails:** you have no independent contact, so do not pay; go to step 7. |
| 4 | Call that contact. Ask them to confirm the change, the amount and the last four digits of the new account, out loud. | Person | 5 min | They confirm all three. **If it fails:** do not pay; go to step 7. |
| 5 | Show a second person your record and where the contact came from. They approve or refuse. | Second person | 5 min | The approver is not the requester and has seen steps 2 to 4. **If it fails:** no payment. |
| 6 | Make the change or payment, or decline it. | Person | 2 min | The action matches what was approved. |
| 7 | Record the outcome. If a check failed, or you were asked to hurry or keep it quiet, tell the person responsible. | Person | 1 min | The record exists and is saved where others can find it. |

> [!CHECK]
> Step 3 is the gate. Can you say where the contact details came from? If the answer is "the message", you have not checked anything.

> [!OUR RULE]
> No payment change goes through without a call-back to a contact you found yourself and a second person's approval. The call-back follows FBI advice to verify a caller by hanging up and calling a number you find yourself ([FBI PSA I-120324](https://www.ic3.gov/PSA/2024/PSA241203)). The second approver, the record and the times are ours, and no study tests them.

## Scripts

For step 4:

```text title="Call-back script · v1.0"
Hello, this is <YOUR_NAME> at <YOUR_ORGANISATION>. I am calling about a
request to <WHAT_CHANGES>. Can you confirm that you asked for this, the
amount of <AMOUNT>, and the last four digits of the new account?
```

Replace the following:
- `<YOUR_NAME>` and `<YOUR_ORGANISATION>`: who you are.
- `<WHAT_CHANGES>`: the change, such as `move future payments to a new bank account`.
- `<AMOUNT>`: the amount, or `no amount` if the change has none.

For step 7, in the place your team keeps records:

```text title="Payment-change record · v1.0"
Date: <DATE>
Request: <WHAT_CHANGES>, <AMOUNT>, arrived by <ARRIVED_BY>
Contact used: <CONTACT_SOURCE>
Confirmed by call-back: <CONFIRMED>
Second approver: <SECOND_APPROVER>
Outcome: <OUTCOME>
```

Replace the following:
- `<ARRIVED_BY>`: email, phone call, chat or video call.
- `<CONTACT_SOURCE>`: the directory, contract or earlier invoice you used.
- `<CONFIRMED>`: yes or no, and the time of the call.
- `<SECOND_APPROVER>`: the name of the person who approved.
- `<OUTCOME>`: paid, changed, declined or escalated.

Leave full account numbers out of the record.

## Cases that trip people up

- **A video call.** End the call and begin at step 1. A face and a voice on a call do not count as a check.
- **A request that seems to come from your manager.** Use their number from the directory in step 3. The second approver is someone other than your manager.
- **A one-person business.** Ask someone outside it, such as your accountant, to be the second person.

## How to tell it worked

- Every change has a record with a contact source that is not the request.
- Some real requests take longer, because step 4 needs a person to answer.
- It has failed if you find yourself using a number from the request "just this once". Stop and start at step 3.

## Sources

1. FBI IC3. 2025 Internet Crime Report. Complaint data. [Link](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)
2. CNN, via ABC17. Report on the Arup deepfake video-call fraud, 2024. Press report. [Link](https://abc17news.com/money/cnn-business-consumer/2024/05/16/british-engineering-giant-arup-revealed-as-25-million-deepfake-scam-victim/)
3. FBI. Public service announcement I-120324, 2024. Government advice. [Link](https://www.ic3.gov/PSA/2024/PSA241203)