Chapter 76: Double Verification and Documentation: The Rules That Save Money

Throughout many years of legal practice, cases involving business owners at their most difficult moments have arisen. It has been possible to see tech company CEOs facing a situation where significant funds vanished due to a single click, and small business owners who felt their life's work was in jeopardy because of one email that arrived at the wrong time. If there is one lesson that recurs like a golden thread in many cases, it is that in the fast-paced digital world we live in, "efficiency" has sometimes become the enemy of financial security.

Many employees are instructed to be fast, to answer emails within minutes, to tie up loose ends, and to pay suppliers so that work does not stop. But it is precisely in this race, in the sanctification of "fast and now," that the loophole often lies, which scammers are looking for. They are not always looking for a breach in the antivirus software; they are looking for the moment when the accounting department prefers a shortcut over a standard procedure. This chapter deals with the brakes of this train—with double verification and documentation—the simple rules that are the line separating the business from severe financial damage.

The following scenario is an educational example based on common fraud patterns. The characters and events are for illustrative purposes only.

The Case of "Techno-Glob": When Silence Is the Biggest Warning Sign

It was a routine Tuesday morning at the offices of "Techno-Glob," a family-owned company for importing electronic components. Michal, the company's long-time accountant, was considered the pillar of the organization. She knew many suppliers, payment terms, and bank account details. The CEO, Rami, used to say that Michal was the company's organizational memory.

At 10:30 AM, while Michal was working on routine tasks, an email landed in her inbox from the company's central supplier, "Evergreen Components." The email looked completely normal: the familiar logo, the subject line with the latest order number, and even the polite writing style of Chang, their regular contact person.

"Dear Michal," the email read, "further to the last order supplied this week, I would like to update you that due to an annual accounting audit, we have changed the bank account designated for receiving payments in dollars. Please update your system with the new details (official signed document attached) for the upcoming payment of $380,000. Thank you for your cooperation, Chang."

Michal glanced at the attached document. It looked official, with a bank stamp and a photo of an account management confirmation. She entered the company's ERP system, updated the beneficiary details, and sent the transfer for Rami's approval. Rami saw the alert on his phone. "Is this for Evergreen?" he asked himself. "Yes, the amount matches the order we received yesterday." He approved the transfer in the banking app.

Ten days passed quietly. On the 11th day, the phone on Michal's desk rang. It was the real Chang. "Michal, is everything okay? We haven't received the payment for the large order, and we need to release the next shipment."

The blood drained from Michal's face. "But I sent the money last week, to the new account in Singapore, as you requested in the email."

"What new account in Singapore?" Chang asked in a trembling voice. "I never sent such an email. We have been working with the same bank for years."

At that moment, the magnitude of the mistake became clear. A quick check revealed that the email Michal received was sent from an address almost identical to the original, except for one small letter that was swapped: instead of chang@evergreen-comp.com, the email came from chang@evergreen-conp.com. The 'm' became an 'n'. A millimeter gap on the screen that cost the company a huge sum.

In this scenario, the atmosphere in the company was difficult. Michal felt a severe breach of trust, and Rami realized the company was in danger because of the affected cash flow. Regarding the professional question "how did this happen?", the answer is usually simple: technology was exploited, and the human factor skipped the stage where one verifies that the digital data reality matches the human reality.

The Impenetrable Wall: What Is Out-of-Band Verification?

In the world of information security, the term "Double Verification" or "Out-of-Band" (OOB) is considered a critical tool. The idea at its core is simple: do not rely on only one communication channel for performing actions that carry significant financial or operational risk.

If an instruction to change bank details is received via email—the email is the first communication channel. To verify this instruction, one can consider using a different communication channel, one that was not compromised by the same potential hack that brought the fake email. This channel could be a phone call to the contact person's known number, or a face-to-face meeting.

Why is this critical? Because in BEC (Business Email Compromise) scams, scammers may gain access to the supplier's or employee's email account. In such a case, a dialogue within the same channel (the email) may be conducted with the hostile party. Only communication outside the contaminated digital space—to the physical world of voice calls—can help expose the fraud.

The Three Possible Pillars of Double Verification:

1. Separation of Channels: If the information arrived via email, it is recommended that the verification be done by phone. If the information arrived on WhatsApp, the verification should be via voice or video call.
2. Verification of the Authorizer's Identity: During the phone call, it is recommended not to call the number appearing in the email signature received at that moment. You can use the number appearing in your regular contacts, on the company's official website, or in the original contract.
3. Documentation of the Verification Process: It is recommended to document who performed the verification, with whom, at what time, and what was said in the conversation. This documentation may serve as significant evidence in the event of a future inquiry.

The Legal Aspect: Duty of Care and Business Liability

In legal cases dealing with this issue, the central question may be who acted negligently, allowing the damage to occur. Here, the relationship between the business, the bank, and the third party is examined.

In the State of Israel, the Payment Services Law, 2019, regulates some of the liability in the case of unauthorized payment transactions. However, when it comes to a business that authorized the transfer itself (even if based on a misrepresentation), the legal situation requires in-depth examination. A general legal analysis shows that courts tend to examine the "duty of care" of the payer.

When a business receives a notification about a change in a supplier's bank account, a duty to examine the information may arise. If the business changes the beneficiary details and transfers a significant amount without performing a verification action, a claim of "contributory negligence" may be argued against it.

Conversely, one can also examine the duty of care imposed on the bank. There is a legal possibility to argue that banks are not just a "conduit" for fund transfers. If it is a very unusual transaction, an expectation may arise for the bank to perform an additional inquiry. However, the chances of this argument depend on the circumstances and the agreements with the bank, which sometimes include liability exemption clauses when the action was performed according to the client's instruction.

The documentation mentioned earlier is of great importance. In an analysis of legal options, a business that proved it performed a reasonable verification procedure may improve its position in arguing that it was not negligent, and that the liability should be divided among other parties.

Building a "Double Verification" Protocol in the Organization: The Practical Guide

During my professional years, the need arose to implement a "Beneficiary Change Procedure" as part of the organizational culture. This is a management tool that defines the actions required for any change in payment details.

Step 1: Initial Check

As soon as an email arrives requesting a change of bank details, an unusual payment request, or an update of contact details, it is recommended to pause the action until complete verification is completed.

Step 2: Establishing Physical Contact

You can instruct the accountant to contact the known contact person at the supplier by phone and perform an explicit verification of the new details and the exact beneficiary name.

Step 3: Cross-Verification

During the conversation, you can ask questions that only the other side should know, to ensure there is no impersonation on the phone line.

Step 4: Monitoring and Control

You can determine that updating account details in the system will be performed by one person and the confirmation of the update will be performed by another party, noting that a documented phone verification was performed.

Step 5: Trial Transfer

In cases of transactions with high amounts, you can consider performing a transfer of a small amount and receiving confirmation from the supplier that the money reached its destination, and only then transferring the balance.

The Importance of Documentation: Evidentiary Significance

Professionally, an action that was not documented may be difficult to prove in the future. Organized documentation may serve as a defense tool against insurance companies or claims of negligence.

Possible components for documentation:

• Documentation of the original inquiry: Saving the email requesting the change.
• Call Log: Documentation of the call to the supplier's official number.
• Internal Memo: A short summary of the verification call content and the identity of the verifier on behalf of the supplier.
• Double verification in the system: Proof of internal control regarding the beneficiary change.

This documentation may assist in proving that the business acted as a "reasonable and prudent business owner" and thereby reduce legal exposure.

Red Flags Requiring Double Verification

There are cases where the risk of fraud may be higher. In these situations, it is recommended to exercise extra caution:

1. Sudden change in bank account details.
2. Time pressure and unusually urgent requests.
3. Request to maintain confidentiality of the action.
4. Minor changes in the email address or the website address from which the message was sent.
5. Request to transfer funds to a country different from the supplier's place of business.

Action Options in Case of Suspected Fraudulent Transfer

If there is a suspicion that funds were sent to the wrong account, there are actions that can be considered urgently:

1. Contacting the sending bank: Examining the possibility of cancelling or stopping the transfer.
2. Contacting the receiving bank: Reporting a suspicion of fraud for the purpose of attempting to freeze the funds.
3. Reporting to authorities: Filing a complaint and receiving appropriate confirmation for the purpose of further proceedings.
4. Legal consultation: Examining options for obtaining legal orders to attach or freeze funds.
5. Checking insurance coverage: Examining relevant policies for cyber or financial fraud.

Summary: Security Is a Human Responsibility

Technological defense systems are important, but in many cases, the most significant defense of a business is its organizational culture and work procedures.

In a possible scenario, the conclusion of a fraud case may be complex. It is not always possible to recover all the funds, but through legal analysis, it is possible to examine options for partial recovery or settlement agreements in cases where the liability of other parties was proven. The important lesson is that simple tools like phone verification and regular documentation can prevent heavy damage.

The chance of protecting business funds depends on the circumstances and strict adherence to safety procedures. Double verification and documentation are significant tools in protecting the economic stability of the business.

Legal Aspect – Additional Highlights:

It is important to remember that in a legal examination, the degree of implementation of internal controls in the business may be scrutinized. In a general analysis of legal options, "closing one's eyes" to warning signs may affect the ability to receive compensation from third parties. The responsibility to act with reasonable caution lies with the business. Therefore, maintaining documentation of verification actions can be seen as a legal necessity that establishes the business's claims in the event of damage.