--- title: "Are wire transfers over $25K dual-control authorized? Is callback verification required for new vendor / banking change?" url: https://insuranceposture.com/questions/governance-and-workforce/wire-transfers-over-25k-dual-control-authorized-callback-verification category: "Governance and workforce" canonical_key: q_gov_005 evidence_state: attested updated: 2026-08-24 --- # Are wire transfers over $25K dual-control authorized? Is callback verification required for new vendor / banking change? URL: https://insuranceposture.com/questions/governance-and-workforce/wire-transfers-over-25k-dual-control-authorized-callback-verification Section: Governance and workforce Evidence state: Attested, not tenant-verifiable This is the highest-value procedural control on the entire application, because it stops the most frequent claim in the market outright. ## What the carrier is actually asking The carrier is asking two things: whether transfers above a threshold require two authorised people, and whether changes to vendor banking details trigger a callback to a previously known number. Both are procedural controls in the finance function. ## Why it is underwritten Business email compromise leading to a diverted payment is the highest-frequency loss in cyber insurance. The attack always ends the same way: a plausible request to send money somewhere new. Dual authorisation and out-of-band callback break it regardless of how convincing the request was, which is why some carriers condition funds transfer fraud cover on them. ## Where the answer lives in Microsoft 365, Entra ID, and Azure These are finance procedures, so they are attested. Some technical controls support them and are measurable. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | Finance procedure | Dual authorisation threshold and how it is enforced | Enforced in the banking or payment platform rather than by policy alone. Attested | | Finance procedure | Callback verification for new or changed bank details | Callback to a number already on file, never a number supplied in the request | | Vendor master | Change control on banking details | A separate approval to change a vendor bank record, since that is where the fraud lands | | Microsoft 365 | External sender tagging and impersonation protection | Technical support for the procedure, making impersonation visible at the point of reading | | Microsoft 365 | Mailbox forwarding rules on finance accounts | External auto-forwarding blocked, since attackers set forwarding rules to monitor and time the request | **Urgency is the attack, not a reason to skip the step** Every one of these frauds arrives with a reason the normal process cannot be followed: a deadline, an executive travelling, a supplier threatening to stop work. The procedure has to be unconditional, because the exception is the entire mechanism. ## What a defensible yes requires - Dual authorisation is enforced by the payment system above a defined threshold. - Bank detail changes require callback to a number already on file. - The procedure has no urgency exception. - Vendor master changes are controlled separately from payment approval. - Finance mailboxes are protected against forwarding rules and impersonation. ## How this answer goes wrong The procedure exists and is bypassed under executive pressure, which is precisely the scenario it was written for. Or the callback is made to the number in the email signature, which the attacker controls. The second is a procedure that feels like verification and verifies nothing. ## If this answer turns out to be wrong The attestation clause you sign lives in this block, and its wording decides whether your answers are treated as representations or as something stricter. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [whether an answer is a warranty or a representation](https://insuranceposture.com/glossary/warranty). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### What threshold should trigger dual authorisation? Low enough that a material loss cannot pass under it. Many organisations set it too high and lose amounts that would have been caught by a lower one. ### Does this affect our funds transfer cover? It can. Some policies condition that cover on verification procedures being followed, which makes this both a control and a coverage term. ### What about recurring payments to known suppliers? They are the target. The fraud changes the bank details on a supplier you pay every month, which is why the control belongs on the detail change rather than on the payment. ### Can this be automated? Partly, through payment platform controls and vendor master workflow. The callback itself is human and deliberately so, because a phone call to a known number cannot be spoofed by mail. ## Related questions - [Are employees with financial/accounting responsibility given social engineering and phishing training?](https://insuranceposture.com/questions/email-security/employees-financial-accounting-responsibility-given-social-engineering-phishing-training) - [Does the organization send and/or receive wire transfers?](https://insuranceposture.com/questions/business-profile/organization-send-receive-wire-transfers) - [Are external emails tagged as originating from an external source?](https://insuranceposture.com/questions/email-security/external-emails-tagged-as-originating-from-external-source) - [In last 3 years, any cyber event, claim, loss, security breach, or extortion demand?](https://insuranceposture.com/questions/incident-response/last-3-years-cyber-event-claim-loss-security-breach) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.