How supplier bank-detail fraud reaches a small business
Explain compromised mailboxes, lookalike domains, independent call-back checks and dual approval. This guide sets out the scope, evidence, safe rollout and review routine for a UK small business.
Key practical checks for owners
- ✓Confirm the scope of supplier payment fraud prevention UK across all business laptops, mobile phones and cloud accounts.
- ✓Check settings in the administrator console rather than assuming feature licences mean protection is active.
- ✓Keep dated evidence of configurations, backups and quarterly reviews for cyber insurance and Cyber Essentials.
Set the scope before changing anything
Explain compromised mailboxes, lookalike domains, independent call-back checks and dual approval. Write down the people, devices, accounts and services covered by the check.
Record the current setting and the person responsible for it. This gives the business evidence that can be checked again.
- 1Export user and device lists from Microsoft 365 or Google Workspace.
- 2Identify personal devices accessing company email or document storage.
- Inventory of all in-scope devices and accounts
- Named business owner for the control
Check the live setting
Open the service administrator console and inspect a normal staff account as well as an administrator account. Do not rely on a licence page that only says a feature is available.
Save a dated export or screenshot that names the account, device or policy. Remove personal details before sharing the evidence outside the business.
- 1Sign in to the administrative portal with a dedicated admin account.
- 2Inspect active policies applied to standard staff accounts.
- Screenshots or audit logs confirming live enforcement
Fix gaps in a controlled order
Test the change with one account or device, confirm that staff can still work, then apply it to the remaining scope. Keep a separate recovery route under company control.
Write down any exception, who approved it and the date it will end. An undocumented exception becomes a permanent gap.
- 1Enable the configuration on a pilot group of two to three staff.
- 2Document any operational exceptions with a defined expiry date.
Keep the control working
Review the setting each quarter and after a staff departure, supplier change or security incident. Check alerts and failed jobs rather than assuming silence means success.
Keep the latest evidence with the business continuity and Cyber Essentials records. Assign a named owner for the next review.
- 1Schedule a recurring quarterly calendar review for administrator access.
- 2Inspect audit logs and failed backup notifications.
- Quarterly review signed off by a business director
- Updated leaver checklist confirming revoked access.
Common questions
- Who should own supplier payment fraud prevention UK?
- A named manager should own the decision and evidence. An IT provider may carry out the setting change, but the business should approve the scope and review the result.
- What evidence should a small business keep?
- Keep a dated export or screenshot, the list of accounts or devices covered, any approved exceptions and the date of the next review.
- How often should the control be checked?
- Check it at least each quarter and after a staff departure, major supplier change or security incident. Review high-risk alerts more often.
Official UK sources checked
Related UK cybersecurity guides
Small business ransomware response checklist: what to do in the first hour
This guide sets out what a UK manager should do in the first 60 minutes after ransomware is suspected. It covers safe containment without powering machines off, preserving evidence, contacting your insurer and cyber incident helpline, and notifying Action Fraud, the NCSC and the ICO where required.
How Often Should a Small Business Test Its Backups? A Monthly and Quarterly Routine
A backup that has never been restored is an assumption, not a control. This guide sets out a monthly spot check and a quarterly full restore for a business of 5 to 50 staff, with the named evidence to keep so a manager, assessor or insurer can see the routine is real.
Is OneDrive a backup? Why sync and recycle bins fall short
OneDrive and Google Drive keep files available across devices, but sync, recycle bins and version history do not amount to an independent backup. This guide explains how deletions spread, where retention runs out, what a compromised administrator account can destroy, and how to build a protected copy you have actually tested.