← All Blogs

Dual approval only stops invoice fraud if you split the right two jobs

By Best IT MSP Editorial Team - Updated October 21, 2026 - 12 min read

The Best IT MSP editorial team maintains this directory's provider data across the US and Canada. We rank providers on verified rating and firmographic data, label paid placement, and do not sell IT services.

What is the dual approval rule that stops invoice fraud?

Dual approval splits two jobs between two people. One person can change a supplier's bank details. A different person releases the money. Neither can do both, so a fraudulent bank detail change cannot pay itself.

The scale sits in the FBI's own count, and every figure here carries its year. The FBI's Internet Crime Complaint Center logged 24,768 business email compromise complaints in 2025 and $3,046,598,558 in reported losses for that year, inside a national total of 1,008,597 complaints and $20.877 billion across all crime types in 2025. Over a longer window the FBI records 305,033 incidents and $55,499,915,582 in exposed losses between October 2013 and December 2023.

The attack arrives as paperwork. An email comes from a supplier you already pay, saying the bank account has changed. Somebody in accounts payable updates the record and pays the next invoice on its due date. Nothing on your side was hacked, no malware ran, and no alert fired. The Association for Financial Professionals surveyed 465 treasury practitioners in January 2026 and found 76 percent of US organizations experienced attempted or actual payments fraud in 2025, with 74 percent affected by business email compromise.

This article covers one control in depth. Business email compromise is not phishing sets out the attack and the payment rules around it. Here we name the two halves of the rule, the person who must not hold both, and the honest limit of what your IT provider can do.

Why dual approval on the payment amount catches nothing

Dual approval on the payment amount catches nothing, because in invoice fraud the amount is correct. The invoice is genuine. The work was done. The total matches the purchase order and the delivery note. Your second approver checks all of that, finds it right, and approves it.

The field under attack is the account number, and it changed one step earlier. Invoice fraud enters through the vendor master file, not the payment run. By the time a payment reaches an approver, the record it points at is already wrong, and the approver is comparing the payment against that same wrong record. Two people have now looked at it. Neither looked at the thing that moved.

That is why the loss is so large next to its volume. Business email compromise produced $3,046,598,558 of reported losses in 2025 from only 24,768 complaints. Almost none of that money was stolen in any technical sense. It was paid out on purpose, by a member of staff following a correct process against a corrupted record.

The payment approval threshold is the second thing that goes wrong. Most written rules say that payments above a set figure need a second approver. A bank detail change carries no dollar value, so no threshold can ever fire on it. The fraudster then sends an ordinary invoice for an ordinary amount, comfortably under your limit, into the new account. One approver, no second pair of eyes, and the rule you wrote never applied.

• Amount thresholds fire on the payment and never on the record behind it.
• Round limits invite a $9,400 invoice that clears on a single signature.
• Recurring suppliers sit below the limit every month, so the diverted account gets paid again before anybody reconciles.

Which two jobs must never sit with one person

To make dual approval work, separate the supplier record from the payment release. Three jobs sit in this process, and the pair that decides everything is the first and the third.

• Maintain the supplier record, including the bank account number and a verified phone number.
• Verify a requested change by calling the supplier back, then record who called and on which number.
• Release the money, by approving the payment run or holding the bank authorization.

One person holding jobs one and three has unlimited authority over where your money goes. Break that pairing before you argue about thresholds. NIST puts the principle in a single line, defining separation of duty so that no user should be given enough privileges to misuse the system on their own. If the bookkeeper maintains the vendor record and also releases payments, that person holds enough privilege on their own, and so does anybody who takes over their mailbox.

Make the trigger the change, not the amount. Any new or amended bank account for an existing supplier goes to the second person before a single payment is released to it, at any value. The approver then has one field to look at. Old account number, new account number, who verified it, and on what number.

A second approver who checks the amount is not a control. A second approver who checks the account number is.

Small teams cannot spread three jobs across two people, and pretending otherwise produces a rule nobody follows. The workable version leaves the bookkeeper doing everything except one step. Either the owner approves the bank detail change, or the owner holds the final release inside the bank. Pick one, write it down, and keep it dated. Review it once a year, or sooner if your headcount or your banking platform changes.

What the FBI and the FTC actually publish about verification

The FBI's published instruction is shorter and vaguer than most summaries of it. Its standing announcement on business email compromise tells you to use secondary channels and/or two-factor authentication to verify requests for changes in account information. That is the whole sentence. It does not name a channel, and it does not say where to get the phone number.

A separate FBI alert supplies the missing half. In May 2025, writing about impersonation campaigns, the Bureau advised recipients to independently identify a phone number for the person and call to verify their authenticity, and to verify the new contact information through a previously confirmed platform or trusted source. Independently is the operative word. You find the number. They do not supply it.

So a number printed inside the request is worth nothing. The number on the new remittance slip, in the signature block, in the PDF header or on the reply address all arrived with the fraud. Out-of-band verification means the only number that counts is one you held before the request landed, which is why the supplier record has to carry a verified phone number as well as an account number.

The FTC's small-business page on business email imposters is worth reading for what it does not cover. Published in December 2018 and still live, it deals with someone spoofing your domain to deceive your customers, and it tells a small business to make sure the provider offers email authentication technology, to install the latest patches and updates, to consider intrusion prevention software, and to train your staff to spot cyber threats. Four recommendations, every one of them technical, and not a second approver or a call-back among them. The page never turns around to face the other direction, the one that takes your money, where a supplier's bank details change inside your own ledger. Follow it to the letter and you finish with a hardened outbound domain and a payment process exactly as it was.

That gap is the point rather than a criticism of the agency. Federal advice on this exact scam sends a small business to its email provider. The control that decides the outcome sits in the payment process, and nobody puts it there except the owner.

Does anyone publish an effectiveness figure for dual approval?

No. No government body and no primary study publishes an effectiveness figure for dual approval or separation of duties inside a payment process. There is no CISA percentage, no NIST measurement, and no published recovery rate conditional on the control being in place.

Knowing that absence is useful before somebody sells you something. A vendor claiming dual approval prevents 90 percent of invoice fraud is quoting a figure with no published source behind it, so ask which study, which year, and which sample. The honest case for this control is structural rather than statistical. It removes a single point of authority, which is the one thing this fraud needs.

What the published data does establish is narrower and still enough. 74 percent of US organizations were affected by business email compromise in 2025. The crime cost $3,046,598,558 in reported losses that year, out of $20.877 billion across all reported internet crime. None of that evidence names a control that works. It establishes that the loss is routine, large, and concentrated in the one process you can change this week for nothing.

What can your IT provider actually do about invoice fraud?

Your IT provider cannot stop a payment your own business authorized, and cannot separate a genuine supplier email from a fraudulent one when the supplier's mailbox is the compromised account. That message is real mail. It passes email authentication because it genuinely came from the supplier.

Microsoft's own documentation marks where the technical control stops. Impersonation protection in Microsoft Defender for Office 365 ships inert, because by default, no sender email addresses are configured for impersonation protection, either in the default policy or in custom policies. It is also a manual list with a ceiling. You can name a maximum of 350 users for user impersonation protection in each anti-phishing policy and a maximum of 50 custom domains.

The next limit decides this attack. Microsoft states that mailbox intelligence protection doesn't work if the sender and recipient previously communicated via email, and your supplier has emailed you for years. The lookalike domain case is not much better, since impersonation can pass email authentication checks if the attacker created a lookalike domain and published valid DNS records. Microsoft adds that anti-phishing protection for all cloud mailboxes doesn't include impersonation protection, so a tenant without Defender for Office 365 has none of it.

Five things your provider genuinely can do are listed below.

• Enforce multi-factor authentication on every mailbox, including shared and service accounts, so your side is not the compromised one.
• Audit mailbox rules and forwarding, including the ones CISA warns adversaries hide so they are not visible in Outlook or Exchange Administration tools.
• Configure impersonation protection, which ships switched off, and name your finance staff and your largest suppliers in it.
• Flag external senders in the message list, so a lookalike domain is visible before anybody replies.
• Confirm whether your accounting and banking platforms can enforce an approval on a supplier bank detail change, and say plainly when they cannot.

Ask three questions and date the answers. Which of our platforms can enforce an approval on a bank detail change, and is it switched on? Who is named in our impersonation protection list today? When did you last audit mailbox rules, and how many did you find? A provider who answers with a product name has answered a different question. Measuring the training that sits around all this is covered in report rate, not click rate.

What to do if the payment has already gone out

To recover a fraudulent payment, call your bank within the hour rather than the next morning. The FBI states that time is of the essence and tells victims to immediately contact your financial institution and request a recall of the funds along with any necessary indemnification documents. That wire recall is the step that has a clock on it.

Then report it to the FBI, because the filing is what opens the government's freeze route. The Bureau asks victims to file at its complaint center as soon as possible, regardless of the amount lost. There is no dollar floor to clear first.

A named federal process sits behind that filing once the money leaves the country. FinCEN's Rapid Response Program has interdicted more than $1.8 billion in stolen funds since the program's inception, and a victim reaches it only by filing a complaint with law enforcement, which FinCEN names as the FBI's Internet Crime Complaint Center or the nearest US Secret Service field office. A business that waits a week to report has skipped the step that can freeze the money.

The full incident checklist, including preserving the mailbox and hunting for forwarding rules, sits in business email compromise is not phishing and is not repeated here. The asymmetry is the thing to hold on to. Recovery depends on a phone call made in hours. Prevention depends on a sentence written in advance, by somebody who was not under pressure.

Three sentences to write down this week

Write three sentences, date them, sign them, and keep them where your bookkeeper can point at them while somebody applies pressure.

• Name the person who approves any change to a supplier's bank account, and state that it is never the person who enters it.
• State that no payment is released to a new or amended bank account until that approval is recorded, at any amount.
• Record every call-back in the payment file: who called, which number, where the number came from, and the date.

None of this costs anything and none of it is an IT project, which is exactly why it rarely gets scheduled. Nobody sells a second signature. This is a non-technical control and it stays that way. Nothing here makes a business safe, and no honest provider claims otherwise. It removes the single point of authority this fraud depends on, whether the request arrives by email, by phone or in a cloned voice. The voice version is covered in the deepfake voice call your finance lead will receive this year, and the targeting differences sit in phishing vs spear phishing vs whaling.

We are an independent directory, so we have nothing to sell you here. Take the three provider questions to three merit-ranked firms in your city and compare the answers. The one who tells you which half of this they cannot fix is the one doing the work.

FAQ

What is dual approval in a payment process?

Dual approval means two different people complete a payment, with one entering it and another approving it. For invoice fraud the split that matters is different. Whoever can change a supplier's bank details must not be able to release the payment. NIST defines the principle so that no user should be given enough privileges to misuse the system on their own.

Does dual approval actually stop invoice fraud?

It stops the fraud from paying itself, if you apply it to the bank detail change rather than the payment amount. No authority publishes an effectiveness percentage for it, so treat any quoted figure as unsourced. The FBI recorded $3,046,598,558 in business email compromise losses in 2025, nearly all of it paid out through approved payments.

What dollar threshold should trigger dual approval?

None, for a bank detail change. A change request carries no amount, so a threshold can never fire on it, and the trigger has to be the event itself. For payment amounts, pick a figure your business could not absorb this month. 74 percent of US organizations were affected by business email compromise in 2025.

Can my IT provider stop invoice fraud?

No, not on its own. A fraudulent email sent from a genuinely compromised supplier mailbox is real mail and passes authentication. Microsoft states that mailbox intelligence protection doesn't work if the sender and recipient previously communicated via email. Your provider can enforce multi-factor authentication, audit mailbox rules, and configure impersonation protection, which ships with no senders configured.

How fast do I have to report a fraudulent wire transfer?

Immediately. The FBI says time is of the essence and tells victims to request a recall of the funds along with any necessary indemnification documents, then file a complaint regardless of the amount lost. FinCEN's Rapid Response Program has interdicted more than $1.8 billion since the program's inception, reached only through that law enforcement complaint.

← All Blogs