Real partners can wait ten minutes for a call-back. The requests that can't wait are the ones worth checking, even when they sound like the boss.
A few months ago I wrote about the vendor email that says "We've changed banks," and the ten-minute habit that stops most of what follows. (The vendor you didn't check.) That note is on Instagram this week, the last full week of Cybersecurity Awareness Month, and I want to take it one step further. What happens when the person asking for money isn't a vendor at all?
Read enough of these requests and you start to hear the same handful of words. Today. Quietly. Before the bank closes. I'm in a meeting, just take care of it. Don't loop anyone else in yet. None of those is suspicious on its own. People really are in meetings. But put together, they shrink the time between the ask and the payment until there's no room left for anyone to check.
Urgency is a tell.
Real partners can wait ten minutes.
That's why I don't put much faith in training that teaches people to spot the fake. The logos are good now, and so is the grammar. Voices can be copied from a short recording. Asking a busy person in accounts payable to judge what's real by ear is asking them to win a contest that was rigged before they sat down.
What works is a rule that doesn't care how convincing the request sounds. Before money moves on a new instruction, or to new account details, somebody hangs up and calls back on a number they already had. Not the number in the email, and not the one the caller kindly offers. The one in your vendor file or your company directory. If the request was real, you've lost ten minutes. If it wasn't, you've kept the money.
The rule has one weak spot, and it sits at the top of the org chart. Most staff will happily call back a vendor. Far fewer will call back the owner, because it feels like accusing her of being an impostor. So the request that sounds most like the CEO is the one most likely to sail through. The people running these schemes understand this perfectly well, which is why so many of them borrow the boss's name.
The fix costs nothing, and only the boss can supply it. Tell your team, out loud and once, that any request for money in your name should be called back on your regular number before it goes out. Tell them you'd rather be called back than surprised. Then the first time someone actually does it, thank them. In front of people, if you can. That moment teaches more than any policy document, because it shows the team the rule applies all the way up.
At the bank, being verified was just part of the day. Nobody took it personally, because everyone was checked. In a fifteen-person company it can feel personal, which is exactly why it has to be said out loud rather than assumed.
One small assignment for this week. Ask your team what they would do if a wire request arrived this afternoon in your voice, or from your email address. Ask it plainly and listen. If what you hear is "send it, I guess," you've learned something worth far more than ten minutes.
Want to know how your controls hold up? Start a conversation