Mutiny Labs

Verify money and access requests · Part 1 of 2 · 6 min read

A callback before money or access moves.

Six rules your finance team can adopt, plus code words and warning signs for urgent requests.

In this series · 2 parts
  1. 1. A callback before money or access moves.
  2. 2. What impersonation cases teach your team.

The verification protocol.

↳ screenshot this bit and send it round

Six low-cost rules. They add modest friction to legitimate requests and materially reduce this class of risk. Write them into your payment process so they are policy rather than instinct: instinct is exactly what gets targeted.

One distinction worth making before the list, because the Spanish scams page covers the family version of the same problem: a family code word is an additional check that a cloned voice does not resolve on its own. A callback to a number you already had is the stronger control, because it does not depend on a secret staying secret. Use both, and lean on the callback.

Money & access · verification protocol

Before anything moves.

Applies to every payment, every change of bank details, every credential reset, every urgent access request, regardless of who appears to be asking.

  1. Call back on a number you already had.Not the number in the email. Not the number the caller reads out. Not the number on the invoice. The one already in your contacts, your HR file, or the signed vendor contract. This single rule is the spine of the protocol. It assumes the contact record itself is trustworthy, so check that assumption periodically: a compromised directory defeats a callback.
  2. Change the channel.If the request arrived by video call, confirm by phone. If it arrived by phone, confirm on your internal chat. A second independently chosen channel is harder to compromise, though account takeovers, SIM swaps and altered contact records can span more than one.
  3. Two people above a threshold.Pick the number tonight, whatever amount would genuinely hurt. Above it, a second named person confirms independently. Not approves in a system; confirms, out loud, having done their own callback.
  4. Bank-detail changes restart the clock.A changed account number is treated as a brand-new vendor relationship: full verification, no exceptions, no matter how long you have worked together or how routine the invoice looks.
  5. Nobody is exempt, and seniority is not a password.The protocol applies hardest to requests that appear to come from the top, because those are the ones worth imitating. Say so publicly, so the junior person who follows the rule is protected rather than embarrassed.
  6. Delay is always allowed.Any employee may pause any transaction to verify and will never be penalized for it, even if it turns out to be genuine, even if it costs a discount. Put that sentence in writing, signed by whoever runs the place.
↳ the only rule that matters: verify on a channel the request did not choose.
why rule six is the one people skip:

Every other rule is procedural and easy to agree to. Rule six is cultural, and it decides whether the protocol survives contact with a real Tuesday. If pausing a payment to check makes someone look slow, distrustful or junior, they will stop pausing, and the protocol is now decorative.

The organizations that get this right make the pause the default and say out loud that following it can never be the wrong call. Say it before you need it, not in the post-mortem.

Two code words worth agreeing on.

↳ one for work, one for the people you love

A shared secret is the cheapest out-of-band channel there is. It costs one conversation, and a secret kept out of searchable systems is far less exposed than anything you have published. It can still be overheard, recorded, phished, or stored somewhere later compromised, so rotate it if that happens.

For the finance team

Agree a phrase that any employee can ask for when a request involves money or access, and that anyone genuine will know. It is not a password to be typed anywhere. It is a question with an answer, used live, on a call.

Rotate it when someone leaves. Keep it out of email, out of shared drives, and out of the document where you keep everything else.

“Before I move this, what’s the phrase this quarter?”

For your family

This is the one people skip and later wish they had not. The FBI’s public warning describes criminals generating short audio clips containing a loved one’s voice to impersonate a close relative in a crisis situation, asking for immediate financial assistance or demanding a ransom.

Agree a word with your parents, your kids, your partner. Something ordinary and memorable that would never appear in a post. Then teach the rule that goes with it: if the word is missing, hang up and call back on the number you have.

“Say the word first.”
↳ teach the shape of it, not just the word:

The crisis-call script is consistent: a familiar voice, an accident or an arrest or a stranded traveler, a demand for money now, and a reason you must not call anyone else. The instruction not to hang up is the mechanism. Urgency should never override independent verification, so agree in advance what your family does in a genuine emergency, and make a callback part of it.

Say that to an older relative once and it stays. It is more durable than any technical control you could install on their phone.

Urgency is the tell.

↳ stop looking at the face; look at the shape of the ask

People try to spot fakes by looking harder: blinking, lip sync, odd lighting. Give that up. Those artifacts get fixed on somebody else’s development schedule, and a bad connection explains all of them anyway. The reliable signals are in the request, and they have not changed in twenty years of fraud.

01

It has to happen now

A deadline that collapses your ability to check is the point of the deadline. Define an escalation path in advance so that genuine urgency has a route that is not “skip the check”.

02

It must stay secret

Confidentiality that stops you consulting a colleague is not confidentiality. A pending acquisition is not a reason to skip your own controls.

03

The channel changed

A vendor who always emailed is suddenly calling. An executive who never texts is texting. The switch is often the whole attack.

04

The destination is new

New account, new bank, new country, new payee. Nearly every successful invoice fraud ends here, whatever it looked like at the start.

the sentence to train into everyone:

“I believe you, and I’m still going to call you back.” It is polite, it is not an accusation, and it is unanswerable. If the response is pressure, treat that as a reason to keep verifying rather than as proof of fraud: genuine people under stress can react badly too.

Sections from the previous guide

Edited September 29, 2026. Research and source dates are retained; this edit is not a fresh review of every statistic or legal development.