Free Wire Transfer and Payment Verification Policy Template

This policy protects [Company Name] (the "company") from payment fraud, including business email compromise, fake invoices, and impersonation of vendors, customers, employees, and executives. It sets the steps every person must follow before the company sends money, adds a payee, or changes where a payment goes.

Why it matters. Money sent to a criminal is often moved on within hours and can be hard or impossible to recover, even when the bank acts quickly. Verifying a request before paying it is the most reliable protection.

Relationship to other obligations. This policy supports the company's information security program, its banking agreements, and any cyber or crime insurance it carries. Where a bank agreement, contract, or insurance policy sets a stricter requirement, the stricter requirement applies. Have qualified legal counsel and the company's insurance broker review this policy before relying on it.

This policy applies to every owner, employee, and contractor of [Company Name] who requests, approves, sets up, or sends payments, or who maintains vendor, customer, or employee payment records. It covers wire transfers, ACH and direct deposit payments, checks, and company credit and virtual card payments, and any other way the company moves money.

Business email compromise (BEC)

A scam in which a criminal uses a hacked or look-alike email account, a phone call, a text, or a video meeting to impersonate someone the company trusts and request a payment or a change in payment details.

Payment instruction change

Any new or changed bank account, routing number, payment address, remittance email, or payment method for a vendor, customer refund, or employee.

Known contact

A phone number or person already on file before the request arrived, from the signed contract, the vendor setup form, or a record verified earlier. Never a number, link, or person supplied in the request itself.

Call-back verification

Calling a known contact, starting the call yourself, to confirm a request directly with the person who would legitimately make it.

Dual approval

A payment that must be approved by two different authorized people before it is released.

Stop and verify, and tell the policy owner, whenever a request shows any of these warning signs. One red flag is enough.

• A new or changed bank account, especially at a different bank, in a different name, or in another country.
• Urgency, pressure, or secrecy: "pay this today", "the deal will fall through", "keep this between us".
• A request to pay by wire, gift card, or cryptocurrency, or to split a payment across several accounts.
• An email address or website that is slightly different from the real one, or a reply-to address that does not match the sender.
• A sender who will not take a phone call, or who says they are traveling, in a meeting, or have a new phone number.
• A request that skips the usual process, such as an invoice sent straight to a clerk instead of through purchasing.
• A voice, video, or message that sounds like a known person but makes an unusual request. Criminals now use AI to imitate voices.

Never by email alone. No payment instruction change is accepted on the strength of an email, text, voicemail, chat message, letter, or invoice, even if it appears to come from a known vendor or a company leader. The request is the start of the process, not the approval.

Call back on a known number. Before any change is saved, the staff member calls the vendor, customer, or employee using a known contact, never a phone number, link, or contact in the request. They confirm the change with a person they recognize or who can be confirmed through the company's records, and confirm both the old and the new account details.

Document it. The staff member records who requested the change, how it arrived, the number called, who confirmed it, and the date and time. Records are kept with the vendor or employee file.

Second-person review. A second authorized person reviews the documented verification and approves the change before it is saved in the accounting or banking system. The person who received the request may not be the only person who approves it.

New vendors and payees. A new vendor or payee is set up only from a signed vendor setup form, contract, or purchase order supported by a known business contact, and the bank details on it are confirmed by call-back verification before the first payment.

Confirm after the change. After a change is made, the company sends a confirmation to the vendor or employee contact already on file, not to the address that requested the change, so that a fraudulent change is noticed quickly.

Dual approval. Every payment of $5,000 or more requires approval by two different authorized people before it is released, and payments must not be split into smaller amounts to avoid this rule. Every payment to a new payee, or to changed bank details, requires dual approval regardless of amount.

Separation of duties. Wherever staffing allows, the person who sets up or changes a payee is not the person who releases payments to that payee, and the person who prepares a payment is not the person who approves it. Where the company is too small for this, the owner or an outside accountant reviews payment activity at least monthly.

Approved invoices only. Payments are made only against an invoice or request that matches a purchase order, contract, or confirmed order, and that has been approved through the company's normal process.

A request to send money, buy gift cards, or change payment details that appears to come from an owner, executive, or colleague is verified by calling that person on their known number or speaking with them in person, every time. There are no exceptions for urgency, seniority, travel, or confidentiality.

Support for staff. No one will be disciplined or criticized for delaying a payment to verify it. Leaders, including the Chief Executive Officer, are expected to welcome a call-back.

Changes to an employee's direct deposit account are made only through the company's secure payroll or HR system with multi-factor authentication, or on a signed form delivered in person. A change requested by email is confirmed with the employee in person or by calling the phone number in the employee's HR file. The employee is notified at their existing contact details after any change.

The Controller keeps the following protections active with each of the company's banks and reviews them at least once a year:

• Positive Pay for checks and ACH, so the bank pays only items that match what the company issued or authorized.
• ACH debit blocks or filters, so only approved companies can pull money from company accounts.
• Dual control in online banking, so one person creates a wire or ACH batch and a second person releases it.
• Bank alerts to the company owner or finance lead for new payees, changed payee details, and payments over the dual-approval amount.
• Multi-factor authentication for every online banking user, with separate logins for each person and no shared credentials.

Banking access. Online banking is used only from company-managed devices. Banking users are reviewed at least every three months and removed the same day a person leaves or changes roles.

Invoices, statements, and the company website include a notice that [Company Name] will never change its bank details by email, and that customers should call the company on a known number before paying any new account. When a customer reports a suspicious request that appears to come from the company, it is treated as a possible security incident.

Report any suspicious request, even one that was not paid, to the Controller right away. If money may have been sent to a criminal, act within minutes, not days:

1. Call the bank's business fraud line immediately, using the number in the company incident response plan, and ask it to recall the payment and contact the receiving bank. Ask what indemnification or other documents it needs.
2. File a complaint with the FBI Internet Crime Complaint Center at ic3.gov with the full transaction details, whatever the amount. Early reports give the FBI the best chance to help freeze funds.
3. Do not delete the emails or messages. Save them, including the full email headers, and do not reply to the sender.
4. Notify the company IT provider or IT staff so the email account can be checked for compromise, passwords reset, and suspicious inbox rules removed.
5. Notify the cyber or crime insurer as the policy requires, and before hiring outside help.
6. Warn the real vendor, customer, or employee who was impersonated, using their known contact.

Afterwards. The Controller records what happened, how the request got through, and what will change, and reports it to the Chief Executive Officer. Legal counsel decides whether any notice is owed to others.

Everyone who requests, approves, sets up, or sends payments completes training on this policy when they start and at least once a year. Training uses real examples of fake invoices, bank-change requests, executive impersonation, and cloned voices, and practices the call-back rule. Completion is recorded by the Controller.

Monitoring. The Controller spot-checks verification records and vendor master changes at least every three months, and reviews bank alerts as they arrive.

Exceptions. The verification steps in this policy have no exceptions. Any other exception must be approved in writing by the Chief Executive Officer and recorded.

Enforcement. Skipping a verification step, or pressuring someone else to skip one, may result in disciplinary action, up to and including termination, consistent with applicable law. Reporting a mistake promptly is always the right choice.

Policy review. The Controller reviews this policy no later than October 2, 2027, and after any attempted or successful payment fraud. Changes are approved by the Chief Executive Officer.

I have read and understand the [Company Name] Wire Transfer and Payment Verification Policy. I will never change payment details based on an email alone, I will verify requests by calling a known contact, I will follow the approval rules for every payment, and I will report suspicious requests immediately.

Approval. Sign below to approve this document for adoption by [Company Name] after it has been reviewed by your legal counsel. Until it is signed, it is a draft and is not in effect.

Revision history. Record every change to this policy below. Increase the document version and obtain approval again each time the policy is revised.

This document was generated from a starter template provided by Preferred Data Corporation. It is general information only. It is not legal advice and it is not a substitute for advice from a licensed attorney. Using the template does not create an attorney-client, consulting, or other professional relationship.

Preferred Data Corporation is not a law firm or an insurer. It makes no representation that this document is complete, current, or suitable for any particular organization, industry, jurisdiction, or regulatory requirement. To the fullest extent permitted by law, it is not responsible or liable for any loss or damage arising from the use of this template or of any policy created from it. You are solely responsible for how you adapt, adopt, and enforce it.

Laws, regulations, insurance requirements, and contracts that apply to your organization may require different or additional terms. The facts, deadlines, and legal references in this template were checked against their sources on the date shown as "Template content last reviewed" in Document Control, not on the effective date, and may have changed since. Before you adopt, publish, or rely on this document, and in every case where you have a legal, regulatory, or contractual obligation, have it reviewed by qualified legal counsel.

In an actual security incident or data breach, contact your attorney, your cyber insurer, and law enforcement where appropriate. Do not rely on this template alone to decide whether, when, or how to notify anyone.

If Preferred Data Corporation prepared this document for you as part of its services, your service agreement governs those services. The content of this document is still general information and should be reviewed by your own counsel before you adopt it.

This template is provided "as is", without warranties of any kind, including accuracy, completeness, or fitness for a particular purpose. Links to laws, agencies, and other websites are provided for convenience and may change. Use of this template is also subject to the Website and Free Resources Disclaimer and the Terms of Service at preferreddata.com/legal/disclaimer and preferreddata.com/legal/terms-of-service.

To report an error, contact Preferred Data Corporation at preferreddata.com/contact or (336) 886-3282 and include the Document ID shown in Document Control. Corrections are listed in the template changelog on the template's page at preferreddata.com/policy-templates.