Why 'be careful' is not a control
Every business that has been hit was being careful. Attention is not a control because it degrades exactly when pressure is highest — end of month, end of job, staff away, big pay run.
A control is something that happens whether or not anyone remembers. That is the entire difference between a business that gets caught and one that does not.
The five controls worth putting in first
- Out-of-band verification: no new payee is paid until someone has confirmed the BSB and account number by phone on a previously known number.
- Dual approval on bank changes: one person cannot both change payee details and release the payment.
- History comparison: every invoice is checked against what you paid that supplier last time, and a change stops the run.
- An urgency rule: any request to pay faster than normal is automatically slowed down, not sped up. Say it out loud as company policy so staff feel safe pushing back.
- A payment hold: the ability to freeze a pay run instantly when something looks wrong, before the file reaches the bank.
Where most businesses have a gap
The gap is almost never the first invoice from a brand-new supplier — people are alert then. It is the routine payment to a long-standing supplier where the bank details quietly changed, and the ABA file going to the bank that nobody re-checks after it is generated.
- Nobody compares payee details against the last payment.
- The person approving payments is the same person entering them.
- The batch file sent to the bank is never verified after export.
- Alerts go to an inbox nobody watches during a busy week.
Automate it end to end
RILLA Shield runs these controls automatically: it scans invoices and payees, checks ABN and BSB details, flags supplier bank changes, verifies the payment file before it reaches the bank, texts you when something critical is found, and can hold or freeze a pay run on its own while you check.
The point is that protection keeps working on the week you are too busy to think about it.