Payment Fraud Controls Every Leader Should Set Up With Their Assistant

Assistants and bookkeepers often sit at exactly the point fraudsters target: the inbox where payment requests arrive and the workflow where invoices get paid. Business email compromise (BEC) — where criminals impersonate executives or vendors to redirect payments — has been reported by the FBI's Internet Crime Complaint Center (IC3) as one of the costliest categories of cybercrime in its annual reports.

The good news is that a few clear controls stop most of these attempts. This guide covers the common schemes and the controls to set up with your assistant.

The common schemes

1. The fake executive request

An email appears to come from the CEO: "I need you to process an urgent wire for a confidential deal. Don't discuss with anyone. I'm in meetings all day." The sender address may be spoofed or a lookalike domain.

2. The vendor bank-change request

A message appears to come from a real vendor: "We've changed banks. Please update our details for the next payment." Sometimes the vendor's own email has been compromised, so the message comes from a genuine address.

3. The fake invoice

An invoice arrives for a service that sounds plausible — a domain renewal, a software subscription, a directory listing — from a company you don't actually use.

4. The gift card request

"Can you pick up some gift cards for a client thank-you? I'll reimburse you. Send me the codes." A long-standing scam that still works.

5. Account takeover

A compromised account — yours, the assistant's or a vendor's — is used to send convincing requests from inside a real email thread.

Control 1: Out-of-band verification for any payment change

Rule: Any request to change payment details, or any new payee, must be verified by calling the vendor or requester at a phone number already on file — never a number in the email.

Write this down, share it with your assistant and bookkeeper and follow it yourself. It defeats most vendor-impersonation schemes, including those from compromised genuine addresses.

Control 2: Dual approval for payments

Separate preparation from approval:

• The assistant or bookkeeper prepares payments.
• An authorized person approves and releases them.
• For larger amounts, require two approvers.

ExecWing bookkeepers and AP/AR specialists prepare payment runs for approval; release stays with your authorized approvers.

Control 3: A "no secret urgency" rule

Tell your assistant explicitly: "I will never ask you to make a payment urgently and secretly. If you get a request like that from me, it's fake — call me." Fraud relies on urgency and secrecy; removing them removes the leverage.

Control 4: No gift cards, ever

Make a standing rule: no gift card purchases based on email or text requests. If you genuinely want gift cards for clients, you'll arrange it in person or through an approved process.

Control 5: Vendor master controls

Maintain a vendor master — the list of approved vendors and their payment details — with:

• A W-9 or equivalent on file.
• Verified bank details, with the date and method of verification.
• Changes logged, with who verified and how.

Pay only vendors in the master. New vendors go through an approval step.

Control 6: Invoice matching

Before paying, match the invoice to a purchase order, contract or known recurring charge. Invoices that don't match anything are held and questioned. See accounts payable controls for small businesses.

Control 7: Email security basics

• Multi-factor authentication on every email account, including the assistant's.
• Email authentication (SPF, DKIM and DMARC) on your domain to make spoofing harder — your IT provider can configure these.
• External email warnings, so messages from outside the organization are labeled.
• Lookalike domain awareness: train everyone to check sender domains carefully.

Control 8: Train with real examples

Spend 15 minutes walking your assistant through examples of each scheme. Ask: "What would you do if you got this?" Repeat periodically. The FBI's IC3 and the FTC publish consumer and business guidance with examples that can be useful for training.

Control 9: A clear reporting path

If something seems wrong — or if a payment was made that shouldn't have been — speed matters. Agree:

• Who the assistant contacts immediately.
• That you'll contact your bank right away to try to recall or freeze funds.
• That the incident gets reported (the FBI accepts reports at ic3.gov).

Make it clear the assistant won't be blamed for reporting a mistake quickly. Fast reporting is what you want.

Control 10: Limit card exposure

• Use spend-management tools that issue individual cards with limits and merchant controls.
• Never share full card numbers by email or chat.
• Review card transactions weekly.

What the assistant should do when a request looks suspicious

A simple script:

1. Don't reply to the message or click any links.
2. Don't make any payment or change.
3. Verify using a known phone number or a separate, trusted channel.
4. Report to the designated person.
5. Log what happened.

For executive assistants specifically

EAs often have delegate access to an executive's mailbox, which makes them both a target and a defender. Ask your EA to:

• Flag any email asking for payments, gift cards, credentials or confidential data.
• Watch for unexpected forwarding rules or login alerts on your account.
• Verify unusual requests that appear to come from you.

Policy template

Payments & vendor changes policy 1. New payees and payment-detail changes are verified by phone using a number on file. Never use contact details in the request. 2. All payments are prepared by [role] and approved by [role]. Payments above [amount] need two approvers. 3. No urgent or secret payment requests will ever be made by leadership. Treat them as fraud. 4. No gift card purchases based on email or text requests. 5. Invoices are paid only if they match a PO, contract or known recurring charge. 6. Report anything suspicious immediately to [name/channel]. Fast reporting is always welcome.

Rehearse it once

Run a short tabletop exercise: send your assistant a fictional payment-change request and walk through what they would do. It takes ten minutes and confirms the policy is understood before a real attempt arrives.

Quick answers

What if the request really is from me? Then a quick verification call costs you a minute. That's the point of the rule.

The bottom line

Fraudsters target the payment workflow. Defeat them with out-of-band verification for payment changes, separation of preparation and approval, a no-secret-urgency rule, no gift cards, vendor master controls, invoice matching, email security and a clear, blame-free reporting path. See our security page and bookkeeping.