the approval that checks the same screen

Every company of any size has a rule for paying money out. Two approvals above a threshold, a check by finance, a sign-off by the director. The rule assumes the danger is a single person acting alone, by mistake or on purpose, and a second pair of eyes catches it.

The thefts that cost the most in recent years got past that rule without breaking it. Everyone approved. They approved what was in front of them, and what was in front of them was the attack.

In its 2025 Internet Crime Report the FBI counts 24,768 complaints of business email compromise and about $3.05 billion in reported losses for the year. That is the category where someone is persuaded, by a message that looks right, to pay the wrong account.

four ways the approval screen lied

An invoice from a real supplier. Between 2013 and 2015 a Lithuanian man sent Facebook and Google invoices in the name of Quanta Computer, a real hardware supplier, from a company with a near-identical name and bank accounts in Latvia and Cyprus. According to SecurityWeek’s account of his sentencing in December 2019, Facebook paid almost $100 million and Google more than $23 million. The invoices matched real business. The bank details were the only thing that changed. The case is in the Facebook and Google incident.

A video call with the bosses. In January 2024 an employee at the Hong Kong office of the engineering firm Arup joined a video call with what looked like the chief financial officer and colleagues. Hong Kong police said every other participant was a deepfake, and the employee made 15 transfers totalling HK$200 million to five accounts, according to The Standard. Arup confirmed it was the victim in May 2024. The case is in the Arup incident.

A request to one employee. On 12 August 2024 Orion, a chemicals company, told the SEC that an employee was the target of a criminal scheme that led to multiple fraudulently induced wire transfers to accounts controlled by unknown third parties. Orion expected a charge of about $60 million. The case is in the Orion incident.

A screen that every signer trusted. In February 2025 Bybit’s signers approved a transfer in the Safe wallet interface that had been altered to show a routine transaction. NCC Group’s analysis found the data actually signed was different from what was intended. About $1.5 billion left, according to the FBI. The case is in the Bybit incident.

where the second check usually looks

same channel

the check the attacker controls

• Reply to the email that asked for the change
• Call the number in the invoice footer
• Ask the people on the same video call
• Read the same approval screen again

another channel

the check the attacker has to break separately

• Call the supplier on a number from your own records
• Ask the executive on a channel they started
• Confirm in the bank's own app or notification
• Hold new bank details for a day before first use

Two people approving the same message add up to one check, if the message is the thing that lies.

what this looks like at your size

Picture a 90-person distribution company. The finance manager pays about forty suppliers a month. A supplier’s accounts address emails new bank details, on its usual letterhead, two days before a large payment is due. The finance manager updates the record, the director approves the batch in the banking portal, and both of them look at a screen that shows the right supplier name and the right amount.

Nothing in that flow is careless. Both checks happened. Both checks looked at data that arrived through the same email.

what narrows it

Verify changes on a channel you already had. Ireland’s National Cyber Security Centre recommends a strict call-back process for any change in bank details, using known contacts. The FBI recommends secondary channels to verify requests to change account information. A known contact means one from your own records, written down before the request arrived.

Treat new bank details as a separate event from the payment. The change is where the attack happens. Log it, verify it, and wait a day before the first payment to new details, so a fake request has time to be noticed by the real supplier.

Make the second approver look somewhere else. A second approval adds most when it uses a different source: the supplier master file, the contract, the bank’s confirmation of payee check where your bank offers one. NCSC Ireland recommends dual approval above a threshold, and the threshold matters less than what the second person reads.

Give urgent requests from executives a standing answer. Agree in advance that payment instructions from leadership are confirmed on a channel the executive started, and that nobody is criticised for asking. The Arup call worked because the people on it looked like the people who could authorise it.

the question to take to your team

For your largest regular payment, which part of the approval would still hold if the email, the invoice and the screen were all fake?