For businesses, sending a payment often feels routine. An employee enters the details, clicks a few buttons and the transaction is on its way. But what happens when the person initiating that payment has unknowingly typed an extra zero, or they click “send” too soon? Or what if the information they're using has been altered by a fraudster? By the time an error or fraudulent transaction is discovered, the money may already be gone.
One way businesses can reduce risk is by building dual control into their payment processes.
Click on the video in the link below to learn more.
What Is Dual Control?
Dual control is a process that requires two people to participate in certain financial transactions. Typically, one employee initiates a payment while another independently reviews and approves it.
This doesn't mean every payment needs to become a two-person process, but businesses can determine which transactions or activities warrant an additional layer of review based on their operations and risk. For example, a business might require dual approval for:
- ACH files
- Wire transfers
- Payroll
- Bill payments
- Adding or modifying payees
- Creating or changing payment templates
- Transactions above a certain dollar amount
The goal is to make it more difficult for a fraudulent transaction or mistake to move through the payment process unnoticed.
Why One Person May Not Be Enough
Everyone has an off day, and even the most trustworthy employees can make mistakes. Payment processes involve account numbers, dollar amounts, dates, routing information and other details where a small error can have significant consequences.
And of course, fraud can make things even more complicated. Business email compromise and other scams frequently rely on convincing employees that a fraudulent request is legitimate. A request to update a vendor's account information, for example, might appear to come from someone the employee regularly works with.
If the same person can both make the change and approve the resulting payment, there may be no natural checkpoint where someone questions the request. Dual control creates that checkpoint. The second employee isn't simply clicking "approve." Ideally, they're independently reviewing the transaction and asking whether the payment makes sense before it is released.
Making the Review Meaningful
Simply requiring two people to click buttons doesn't automatically create an effective control. The second employee should understand what they're approving and have enough information to identify something that doesn't look right. Depending on the payment, that could include verifying the recipient or vendor, the payment amount, the destination account, the payment date, the purpose of the transaction, any recent changes to payment information and whether the transaction matches the original request.
Businesses should also consider how employees communicate when something looks suspicious. If an employee notices a change in payment instructions, for example, verifying the information through a known, trusted contact method can help avoid relying on a potentially compromised email conversation.
The effectiveness of dual control comes from independent review, not simply having two people involved.
What About Small Businesses?
Dual control isn't only for large organizations with entire teams dedicated to accounts payable. Smaller businesses may have fewer employees, which can make the separation of duties more challenging. However, that doesn't mean additional controls are impossible.
A business with only a few employees may be able to establish an approval process involving the owner, manager or another trusted employee. The specific approach will depend on the organization's structure and the payment services available through its financial institution.
If there aren't enough employees to establish a traditional two-person workflow, [talk with your financial institution about other available controls/we would love to discuss other available controls].
Build the Pause Into the Process
Fraud prevention doesn't always require another piece of technology. Sometimes, it means creating a deliberate pause before money moves. Dual control provides an opportunity for someone other than the person initiating a transaction to stop, review the details and question anything that doesn't look right.
That pause could catch a typo. It could uncover a fraudulent payment request. It could reveal that someone changed information they shouldn't have. Or it could simply confirm that everything is exactly as it should be.
No single fraud prevention measure can eliminate risk. But adding thoughtful controls to your payment process can make it harder for fraud and mistakes to get through.
If your business doesn't currently use dual control, we would love to talk with you about your available options. Reach out to your local branch to learn more.
Heartland Bank is a family-owned community bank serving 15 Nebraska locations, committed to improving the lives of our customers, associates, and communities. We’re proud to be a seven-time honoree on American Banker’s Best Banks to Work For list.
.png)
-2.png)
-1.png)
.png)
