General
Keeping your access secure
Protect your login, manage who can do what, and recognise the fraud that targets payment teams.
Protecting your own access
- Use multi-factor authentication and never share it — the second factor is what stops a stolen password becoming a stolen payment.
- Each person has their own login; never work under a colleague's, or four-eyes stops protecting you.
- Lock your screen when you step away, and log out on shared devices.
Managing your team
Give each colleague only the permissions their job needs. Keep makers and checkers distinct so no one can both draft and approve. When someone leaves, revoke their access the same day.
The fraud to know
Important
The most common attack on payment teams is invoice redirection: a genuine-looking email asks you to update a supplier's bank details. Always verify a change of bank details by calling a known number for the supplier — never a number in the email. Confirmation of Payee and beneficiary validation are your backstops, but the phone call is the control that works.
Was this helpful?
Your answer tunes what we surface first — and shows us where a guide falls short.
Thanks for the feedback.
Still need help? Raise an enquiry and our service desk picks it up — you get a tracked ticket reference and a response-time target. Raise an enquiry
About this guide
- Topic
- Getting started
- Reading time
- 3 min
- Views
- 2,461
- Found helpful
- 98% (119/122)
- Updated
- 09 Jun 2026
securityaccessmfafraudphishingpermissionssegregation of duties