Fund Transfer Fraud Prevention Checklist

Corporate board — protecting funds from phishing-based transfer scams

1. 1. How to use this checklist

   Work the sections in order, then use the two tables at the end to record where the organization stands today. The point is not to score well; it is to find the one or two controls that are missing before an attacker finds them. Bring the completed sheet to the finance or audit committee and agree owners and dates.

2. 2. Authorization and dual approval

   Every movement of funds — wire, ACH, check, or card — requires two named approvers, and no officer, director, or employee may override the rule by email or text. Set dollar bands so the second approver is clear before anyone is under pressure, and confirm that treasury, payroll, and vendor payments all follow the same rule.

   • Current rule for dual approval (state it in one sentence):
   • Bands and approvers that need board action:

3. 3. Communication rules

   Financial instructions — payment requests, bank-detail changes, account updates — are not accepted from personal email accounts or text messages, and staff are told in writing to treat them as unverified. Official payment requests come from organizational addresses, and role-based addresses such as treasurer@ or finance@ are used instead of a single person's inbox.

   • Addresses authorized to request payment:
   • Message to staff and volunteers about personal-email requests:

4. 4. Verification of unusual or urgent requests

   Any request that is new, urgent, or out of pattern is verified by phone or in person using a number or contact already on file — never a number or link inside the message itself. Verification is a routine step, not an accusation, and no deadline justifies skipping it.

   • Who verifies, and with what contact list:
   • Requests that trigger verification (list the patterns):

5. 5. Vendor and invoice controls

   New vendors and changed bank details are confirmed before the first payment, invoice bank details are compared to the signed contract or purchase order, and one person cannot both enter a vendor and release payment.

   • Who confirms new vendor details:
   • Where vendor changes are logged:

6. 6. Documentation and audit trail

   Every approval is recorded with the amount, payee, both approvers, and the verification performed, so the file answers the question later without anyone's memory. Keep the record in the accounting system or a shared folder that survives staff turnover, and review the log of flagged and refused requests at least quarterly.

   • Where approvals are recorded:
   • Who reviews the exception log, and how often:

7. 7. Training and culture

   Directors and volunteers get short annual training on what these scams look like, and leaders say out loud that being questioned about a payment is expected. If saying “I need to confirm this before I pay” feels awkward or risky, the policy will quietly stop being followed.

   • Date of the next training for directors and volunteers:
   • How leaders signal that verification is welcome:

8. 8. What the board should see each year

   The board receives the policy itself, the exception log, any attempted or completed fraud, and confirmation that training happened. Near misses belong in the report — they are the cheapest lessons an organization will get.

   • Next board review date for this policy:
   • Items the committee will report: