Preventing cyber fraud through independent verification

Map decisions before selecting tools

A useful control begins with a simple question: which decision could cause financial loss, disclose information or grant unwanted access? Map each point where a request is accepted.

Alain Stevens’s experience in digital research since 1999 suggests examining the full context of a claim instead of trusting a familiar logo or sender name.

Separate request and confirmation

Use an established telephone number or an independently obtained contact to confirm exceptional instructions. A phone number included in a suspicious email is not an independent source.

For payments, maintain documented authorisation limits and a defined response when beneficiary details change unexpectedly.

Test whether safeguards really work

Rehearse a realistic scenario without embarrassing staff or collecting unnecessary personal data. Observe whether people know how to stop, escalate and document a doubtful request.

Refresh the process after organisational changes, new software deployments and incidents. A rarely used rule is unlikely to protect the next payment.

Explore relevant guidance