Agreeing a code word or second check

A code word or a second approver can help, as long as you treat them as extra layers and not as a lock. Neither one replaces a call-back. Each one covers a gap the other leaves.

The code word idea

The FBI suggests creating a secret word or phrase with your family to verify their identity.¹ The FBI gives that advice for families, not for businesses. A small team can borrow the idea, but you're adapting it, and that's worth knowing.

Why might it help? A cloned voice can copy how someone sounds. It can't know a word the real person agreed privately, unless that word has leaked.

The same notice says AI-made content can be hard to identify, so a check that doesn't rely on your ear has a clear appeal.¹

Where a code word can fail

Be honest about the weak points.

• It can leak. If the word is in an email, a shared chat or a sticky note, someone else may see it.
• People forget it. A word used rarely is easy to blank on, in which case a stressed person may skip the check.
• It can be guessed. Avoid names, pets, birthdays and anything on social media. The UK's NCSC warns that what you post online, social media included, can make phishing messages more convincing.²
• It only proves one thing. It shows the caller knows a word, which isn't the same as the payment being right.

If you use one, keep it out of writing, agree it face to face, and change it if you think it's been shared.

The second check

A second approver means a different person must agree before a payment goes out or bank details change. The idea fits the NCSC's advice not to leave responsibility for cyber security with a single person.³ It also says every member of the team should realise cyber security is everyone's business.³

Neither NCSC line talks about payment approvals directly, so treat this as a sensible way of applying the principle, not an official rule.

Here's why it can help. A scammer who has fooled one person now needs to fool a second, and the second person may not have been on the call. The second person should also check separately, through a known number, not rely on the first person's account of the call.

Making it work in a tiny business

Maybe you have only two staff. You can still agree a routine.

• Pick the requests that need two people. New payee, changed bank details, gift cards or large transfers are common choices.
• If the owner is the only person who approves, name a trusted outside person, such as your bookkeeper or accountant, who can act as the second voice.
• Make the second check a habit rather than a suspicion. Say "everyone's payments get a second look" so nobody feels accused.
• Write the routine on one page and keep it somewhere staff can find it.

Putting the pieces together

No single step is perfect. A call-back, a code word and a second approver together cover more ground than any one alone. Start with the call-back, which has its own page, then add the others as your team is ready.

And if something does slip through, the official agencies take reports.