Why underwriters ask about it
AI-enabled funds-transfer fraud — a cloned voice or perfect fake email authorizing a payment — is now covered (and asked about) by cyber insurers. The control they look for is out-of-band verification.
How to fix it
- Rule, no exceptions — including "the boss," including "urgent": any new payment instruction, bank-account change, or vendor detail change is verified by a second channel — a callback to a number you already had on file.
- Never verify using contact details provided in the request itself.
- Train everyone who touches money on the rule; post it where payments happen.
Evidence to keep
the written rule, signed by everyone who can move money.