Setting Up Bank Alerts and Dual Approval for Outgoing Money

Why this matters

Almost every payment fraud that empties a small shop's account needs one of two things: a payment that one person can send alone, or a debit or check that nobody looks at until the statement arrives. Banks sell tools that close both gaps, and most shops have never switched them on, usually because nobody asked the bank what was available. This article sets them up in order: alerts first, then blocks on money pulled out of the account, then checks, then a second person on anything large or new. Expect two sessions of an hour or so with your banker, and a few minutes a month afterwards.

There is a legal reason to do this beyond the fraud itself. For a business account, the consumer protections people assume they have mostly do not apply, and under UCC Article 4A as your state has enacted it, a bank that offered you a security procedure you turned down can be in a much stronger position after a loss. See related: Reg E + UCC 4A: ACH and Wire Fraud Protections for Trade Businesses.

Step 1: Ask the bank for its full menu, in writing

Call or meet the banker who handles your business account and ask for a written list of every fraud and payment-control service available on your account type, and the cost of each. The names vary by bank, but you are asking about six things: account alerts, ACH debit block, ACH debit filter, positive pay for checks, payee positive pay, and dual control (also called dual approval) for ACH payments and wires.

Why first: some of these are only available on a business-banking tier above the one many small shops open with, and you need to know that before you design around a tool you do not have. What breaks if you skip it: you set up the free alerts, believe you are covered, and never learn that the bank offered dual control you did not take, which is the exact fact a UCC 4A dispute turns on. Keep the written list. If you decline a service, write down why and when.

Step 2: Set the alerts, to two people

In online banking, turn on alerts for these events and send each one to two people, the owner and whoever does the books:

• every outgoing wire, any amount
• every new payee or changed payee bank details
• every user added, removed, or given new permissions
• any change to the account's contact email, phone or mailing address
• any sign-in from a new device
• any outgoing ACH payment or check above a threshold (set it below)
• balance below a floor you choose, as a crude catch-all

The threshold to start with: the largest single routine payment you make in an ordinary month. Everything below that is normal traffic you would ignore anyway; everything above it is either a known big bill or something to look at. Tune it after a month if the alerts are too noisy or too quiet.

Why two recipients: the first thing an attacker who gets into the owner's email does is hide the bank's alerts, often with an inbox rule. A copy to a second inbox they do not control is what turns an alert from a formality into a tripwire. See related: Payouts Stopped Arriving in the Bank.

Step 3: Block or filter money pulled out by others

An ACH debit is a payment someone else initiates out of your account: the payroll provider pulling taxes, the processor pulling fees, a lender pulling a loan payment. Anyone who has your account and routing number, which are printed on every check you write, can attempt one. An ACH debit block refuses all of them. An ACH debit filter refuses all except originators you approve, identified by each company's ACH company ID.

Most shops need a filter, not a block, because payroll and loans legitimately debit the account. Build the approved list from your last three months of statements: every ACH debit, the company name and the company ID the bank shows. Give that list to the bank.

Why this beats watching for it: under the Nacha Operating Rules as of 2026, a business account generally has only two banking days to have an unauthorised ACH debit returned, against roughly sixty days for a consumer account. Few owners read the account daily. A filter returns an unknown debit automatically, inside the window, without anyone needing to notice it. Re-check the current return windows with your bank, since Nacha revises its rules regularly.

What breaks if you skip the three-month review: you approve only the originators you remember, and the first legitimate quarterly insurance debit or annual software renewal bounces. That is annoying but recoverable; the review mostly prevents it.

Step 4: Positive pay for checks

Positive pay means you send the bank a list of every check you write, with check number, date and amount. When a check is presented for payment, the bank compares it to the list. Anything that does not match, a number not on the list, a different amount, becomes an exception, and the bank asks you to decide before a daily cutoff whether to pay or return it. Payee positive pay adds the payee name to the comparison, which catches a check whose payee line was washed and rewritten. See related: Mail Theft, Check Washing and Mailed Payments.

Two settings matter more than the rest. Set the default decision to return, so an exception nobody reviews is refused rather than paid. And name who reviews exceptions and who covers for them, since the cutoff is usually early afternoon and a missed one applies the default.

Why it matters for losses as well as fraud: many business account agreements now say that if positive pay was offered and you declined it, check fraud losses that it would have caught are yours. Read your agreement's check-fraud section, and if it says that, the decision is mostly made for you.

Step 5: Dual approval above a threshold, and on every new payee

Dual approval means one person sets up an outgoing ACH payment or wire and a second, different person approves it in the bank's system before it is released. Set two rules:

1. Any payment above the dual-approval threshold. A sensible starting point is the same figure as the alert threshold in Step 2, the largest routine payment in an ordinary month.
2. Any payment, of any size, to a new payee or to a payee whose bank details have changed. This is the rule that stops most invoice-redirection fraud, because the fraudster's whole move is a change of bank details. The approver confirms the change by calling the supplier on a number already on file, never one from the request. See related: The Vendor Bank Detail Change SOP.

Separate logins, separate devices. Each person signs in with their own credentials and their own second factor, and the bank's setting that lets an administrator approve their own payment is switched off. Dual approval by one person holding two logins is no approval at all.

If you are the only person in the office. A part-time or outside bookkeeper can be the approver; most banks let an approver use a phone app. If there truly is nobody, ask the bank whether it offers a callback confirmation on large or new-payee payments, and use it.

Step 6: Write down the settings and who holds each role

One page: which alerts are on and who gets them, the alert and approval threshold, the ACH filter list with the date it was last reviewed, who reviews positive pay exceptions and who covers, and who creates and who approves payments. Put the date on it. When someone leaves or changes role, this page tells you exactly which bank settings to change.

Worked example: a twenty-two person electrical contractor

The starting point. One operating account. The owner made every payment from one login with no second factor. Alerts were off apart from a low-balance email. Checks went to subcontractors and some suppliers; most supplier bills were paid by ACH from online banking.

Step 1. The banker's written list showed that alerts and an ACH debit filter came with the current account tier; positive pay and dual control needed the next business tier up, a modest monthly fee. The owner moved up a tier.

Step 3 in detail. The office manager went through three months of statements and found 61 ACH debits under 9 company IDs: two for the payroll provider (net pay and taxes), the card processor's fees, a truck loan, an equipment loan, the insurance carrier, the fuel card, the electric utility and the phone carrier. She also found a tenth company ID, a monthly charge from a software service the shop had cancelled the previous year, still pulling. It was left off the list, the filter returned it the next month, and the owner disputed the earlier charges with the service.

Step 5 thresholds, worked through. Over a normal month the shop sent about 40 outgoing ACH payments. The largest routine one was the main supply house's monthly statement. The owner set both the alert and the dual-approval threshold just above it. That put 6 of the 40 payments a month, 15 percent, into dual approval, mostly subcontractor progress payments, plus every new payee. The approver was the outside bookkeeper, who approved from her phone. Each approval took her a couple of minutes and rarely delayed a payment by more than a few hours.

What it caught. Four months later the office received an emailed request, apparently from a regular lighting supplier, saying its bank had changed. The office manager updated the payee details and queued the month's payment. Because the payee's details had changed, the payment went to the bookkeeper for approval regardless of size. She called the supplier on the number in the vendor file. The supplier had sent no such email. The payment was deleted before release. See related: The Office Paid a Fake Supplier Invoice, which is what this looks like when the second check is missing.

What would have changed the setup. A shop paying mostly by check would put its weight on payee positive pay and treat dual approval as secondary. A shop whose bank offered no dual control at any tier should weigh moving banks, since that is the one control here that stops a single compromised login sending money.

How to verify each control works

Settings screens lie by omission. Test each control once after setup and again each year.

• Alerts: add and then remove a test payee. Both recipients should receive the payee alert within minutes. If one does not, the routing is wrong.
• Dual approval: set up a payment just above the threshold to the shop's own second account. It should sit waiting for approval and not release on its own. Then try to approve it from the login that created it; the bank should refuse.
• ACH filter: ask the bank to confirm in writing the originator list it holds, and compare it to yours line by line.
• Positive pay: write one small check to the shop's own second account and leave it off the upload. When it is presented it should appear as an exception, and if you do nothing it should be returned at the cutoff.

Record the date and result of each test on the Step 6 page.

References

• UCC Article 4A, section 4A-202 (security procedures), as enacted by your state; this is not legal advice, and your account agreement and your attorney settle how it applies to you
• Nacha Operating Rules, for current ACH return timeframes on business and consumer accounts
• See related: Reg E + UCC 4A: ACH and Wire Fraud Protections for Trade Businesses
• See related: The Vendor Bank Detail Change SOP
• See related: The Office Paid a Fake Supplier Invoice