Welcome to The Senroc Download! The month of October is Cybersecurity Awareness Month. This month we’re bringing you a special series dedicated to the many forms a cyber attack can take, how to detect them, and ways you can practice with your team. The end goal will be the start of your organizations incident response plan!

Payment fraud against small businesses rarely involves a dramatic break-in. The usual version is simpler: an attacker sits inside a compromised mailbox and quietly reads for weeks. They learn who pays whom, what the invoices look like, and how the two companies talk to each other. Then they wait for a genuine invoice to go out and follow it with a short, polite note, “we’ve changed banks, please use the details below”.

Everything about the request is correct. The invoice number matches. The tone matches because they have read months of correspondence. The timing matches because the work really was done. Nothing triggers suspicion and no security tool flags it because there is nothing malicious in the message. It is an email from a real account saying a plausible thing.

The reason this remains the most expensive attack on small businesses isn’t sophistication. It’s that it targets a process rather than a computer. Somebody in accounts payable is doing exactly their job, following the instructions in front of them, and the money leaves through the front door, properly authorized.

Takeaway: The uncomfortable question to sit with this week: if an email arrived tomorrow from a supplier you regularly use, about an invoice you were genuinely expecting, asking you to change the bank details: what in your process would catch it? For most small businesses the honest answer is nothing because everything about the request looks legitimate. It’s not a training failure, but the habit below is a quick way to rectify it.

The habit is a single rule and it needs no judgment to apply: bank details are never changed on the strength of an email, a text, or a document attachment. They are changed after a phone call to a number you already hold. Never the number in the message asking for the change.

It has to be a rule rather than a guideline because judgment is precisely what this attack defeats. Asking staff to spot a suspicious request means asking them to detect something intended to look unremarkable. Asking them to make a phone call requires no detection at all. It works even when the request is entirely convincing.

Worried about a supplier being annoyed with the request? Say it as a positive expectation rather than a suspicion, “we always confirm banking changes by phone” is something you can tell suppliers with a straight face and most will commend you for the caution.

Takeaway: Write the rule down this week and share it with: whoever pays invoices and whoever can approve a payment. Make it explicitly clear that nobody will ever be criticized for slowing a payment down to make this call. Then apply the rule in reverse: if your own bank details ever change, expect your customers to ring you, and don’t be irritated when they do!

Take one payment your business made last month — a real one, ideally to a supplier you pay regularly — and trace it backwards with whoever handles it. Who requested it, how did the request arrive, who approved it, and what would have had to be different for it not to have been approved?

Most owners find one of two things. Either the approval is a formality because the person approving has no independent way of knowing the details are right or there is no second person to verify because the business is small enough that one person does everything. Both are common, and neither is a failing, but they’re worth knowing about.

The most useful part is at which exact step would a changed bank account have been noticed? Walk it slowly. The answer is usually a step that doesn’t exist yet, and now you know precisely where to add it rather than sprinkling process everywhere.

Takeaway: Do this exercise this week, and write down two things: where the callback step goes, and who makes that call when the usual person is away. The second matters more than it sounds. Payment fraud lands disproportionately on the day the regular approver is on holiday because the attacker has been reading the mailbox and knows the calendar. If your business is small enough that one person does all of this, the drill is still worth the time. The answer is simply that the callback rule is one you keep for yourself!