The Second Signature: A Payment Control Reset for Owner-Led UK Businesses

Payment fraud is often described as a technology problem. In practice, many near-misses at UK SMEs begin with a routine operational gap: an invoice arrives with new bank details, a member of staff is busy, and a single approval releases funds. The loss is financial, but the failure is procedural. That distinction matters for owner-managers, because it puts the remedy within reach without hiring a full finance function. As many businesses plan for the end of 2026, a focused reset of payment approvals is a sensible use of an afternoon.

Begin With the Payment Path, Not the Software

Before changing systems, map the actual route a payment takes. Who creates a new supplier? Who receives the invoice? Who can amend bank details? Who approves the payment? Who releases it? In smaller organisations, one person often performs several of these steps, sometimes because it is efficient and sometimes because no one has defined otherwise.

The objective is not to recreate a bank-grade control environment. It is to ensure that no single person can both initiate and release a payment without an independent check. In a business with a small team, that second check may sit with a director, an operations manager or an external bookkeeper. The key is that the role is named, understood and recorded.

Dual Authorisation That Actually Bites

A two-key rule sounds simple: no payment leaves the business without two independent approvals. In practice, it fails when the second approval is automatic, shared or poorly informed. A second signature is only useful if the approver sees the beneficiary name, account details and purpose of payment, not merely the amount.

Set clear thresholds. New suppliers and any change of bank details should require dual authorisation regardless of value. Existing supplier payments above an agreed limit should follow the same route. Below that limit, a single approval may be acceptable, but only where the supplier record has been verified and the payment is routine.

Emergency arrangements deserve attention. If a director can bypass controls when travelling or when a payment is urgent, that exception should be documented, time-limited and reviewed. Shared email inboxes and shared credentials undermine the model; approvals should be traceable to an individual.

The Call-Back That Verifies More Than a Voice

Call-back verification is a familiar idea, but it is often performed badly. The common mistake is to call the number on the invoice or in the email requesting the change. That number may belong to the fraudster. Use a known contact number already held in the supplier master file, or verify through an independent channel.

The call should confirm the request, the account name, sort code and account number, and the person authorising the change. Record the date, time, caller and outcome. For higher-risk payments, consider a second contact at the supplier. Confirmation of Payee is a useful check that the account name matches the details held, but it does not prove that the request itself is genuine. It supports the process; it does not replace it.

The Supplier Master File Is a Quiet Target

Fraudsters understand that changing a supplier record can be more valuable than intercepting a single invoice. Restrict who can edit bank details, and alert the owner-manager or finance lead whenever a change is made. A change should trigger a hold, independent verification and dual approval before any payment is released.

Review the supplier list periodically for duplicates, dormant records and near-identical names. A monthly extract of changes is usually enough for a smaller business. The aim is not bureaucracy but visibility: if a supplier's bank details change, someone outside the payment process should know before money moves.

Define Escalation Triggers

Clear triggers remove ambiguity when staff are under pressure. A payment should stop and escalate when bank details change by email, when a supplier requests urgency or secrecy, when a new payee is created, when the amount is unusual for that supplier, or when anyone asks to bypass the normal process.

If a payment has already been made, speed matters. Contact the bank immediately, report the incident to Action Fraud, preserve emails and records, and notify insurers where appropriate. The review should ask how the process failed and who needs to act, not simply who clicked approve.

A Thirty-Day Reset Calendar

Week one: map the payment path and list every person who can create suppliers, amend bank details, approve invoices or release payments. Week two: agree approval thresholds, name the second approvers and document the exception route. Week three: introduce call-back verification and master-file change alerts. Week four: test the process with a sample payment, brief the team and record the revised procedure.

The reset does not require new software. It requires a written procedure, two people willing to challenge a payment, and a owner-manager who treats the control as part of operations rather than an IT project.

Make the Rule Stick

Review the process quarterly and after any change of staff, bank mandate or finance provider. Track a few simple measures: the number of supplier bank-detail changes, call-backs completed, exceptions used and payments stopped before release. A near-miss is useful evidence. It shows where the process is thin while the cost of learning remains low.