Cyber fraud often targets people and payment processes rather than technical systems.
Not every cyber incident starts with malware. Many financial losses begin with a convincing email, a rushed instruction or a fraudulent request to change supplier banking details. Cybercriminals target finance, procurement, payroll and executive assistants because these teams can authorise or influence payments.
Business email compromise, invoice fraud and executive impersonation attacks are effective because they exploit trust and urgency. A fake instruction may appear to come from the CEO, CFO, a known supplier or an internal manager. With AI-generated text and voice tools becoming more convincing, organisations can no longer rely on instinct alone.
Why this matters
The strongest defence is often a simple, well-enforced business process. Independent verification, segregation of duties and staff awareness can prevent losses even when an email looks legitimate. Management should treat payment verification as a cyber control, not only a finance procedure.
What management should consider
- Require independent callback verification for banking detail changes.
- Use known contact details rather than contact details included in the suspicious request.
- Apply dual approval for unusual or high-value payments.
- Train finance and procurement staff to challenge urgency and secrecy.
- Review mailbox forwarding rules and suspicious inbox changes.
- Enable multi-factor authentication for email accounts.
- Keep evidence of approval and verification steps for audit and investigation purposes.
Common pitfalls to avoid
Relying on email approval for unusual payments.; Using contact details supplied in the suspicious request.; Treating payment fraud as a finance issue only..
Key takeaway
A legitimate-looking email should not be enough to change banking details or trigger an unusual payment. Strong verification procedures protect the organisation from preventable losses.
Practical first step
Review the banking detail change process and require independent verification through a known contact channel before the next payment run.
How Nexia SAB&T can assist
Nexia SAB&T can assist with phishing simulations, payment control reviews, email security reviews and role-based cyber awareness training for finance and procurement teams.
Author details: Rob Galetti | IT Audit and Cybersecurity | Nexia SAB&T
Date: 29 July 2026
