Two-person rule
How Ilia Zavialov builds a two-person rule for payments that survives holidays
A small team usually pays out money the way it does everything else, which means whoever is nearest to the keyboard presses the button. That works until an instruction arrives that looks routine and turns out to be someone else's. The two-person rule for payments turns one person's momentary judgement into a procedure other people can inspect. What follows is the practical shape of it: the threshold, the approvers, and the week both of them are away.
English version for the United Kingdom.
01
One signature is one point of failure
A single approver looks efficient until you describe what it guarantees. It guarantees that money moves whenever one person, on one particular afternoon, believes a request is genuine. That belief depends on how tired they are and how well the message imitates someone they already trust. An attacker studying a small company needs one plausible minute from one distracted person.
The FBI Internet Crime Complaint Center recorded 3.046 billion dollars of losses to business email compromise in its 2025 annual report, the second largest category after investment fraud. Those cases run on ordinary payment requests arriving in ordinary mailboxes. Almost every one of them ends at a person with standing authority to release funds alone.
A two-person rule for payments changes the shape of the problem. The attacker now has to convince two people who sit in different heads, work on different devices and check different things. That costs far more than a single well written email, which is the attack that actually arrives.
02
Where the threshold sits
The first decision is the amount above which a second confirmation becomes mandatory. Set it too low and the second approver signs twenty routine payments a day, which trains them to click without reading. Set it too high and the losses that genuinely hurt a small team pass underneath it. The threshold has to be rare enough to keep attention and low enough to catch the payment that would ruin a quarter.
A workable starting point is the sum your team could lose in one week without changing any plans, which for many teams lands near a single month of one salary. Take the last three months of outgoing payments and count how many would have crossed that line. If the answer is more than a handful each week, attention will erode within a month.
A separate rule belongs on the first payment to any new recipient, whatever the size. A modest first transfer to a fresh account is the standard test probe, and it is also how a redirected invoice begins. Applying the two-person rule for payments to every new payee costs a few minutes a month and closes the category of loss that starts quietly.
03
Who confirms, and why it cannot be the same hands
Separation of duties is the part small teams skip, and it is the part that carries the rule. The person who creates or edits a supplier record should never be the person who releases money to it. If one account can add a payee and then approve the transfer, the two-person rule for payments exists only on paper. Verify this inside the payment tool, because permissions drift as people change roles.
Confirmation is a role rather than a rank. A founder who approves everything becomes the busiest and least attentive approver in the company, and the easiest one to imitate. Business impersonation accounted for around 1 billion dollars of reported losses in Federal Trade Commission data for 2025, with the heaviest damage done by messages claiming to come from bank staff.
Write down two named approvers for each band and state that the initiator can never be one of them. Give the second approver something concrete to check: the payee account, the source document, and whether the request arrived by the normal route. A confirmation with no checklist turns into a reflex within a fortnight, and a reflex approves whatever is put in front of it.
04
The confirmation has to travel on a different channel
A second approval inside the same email thread confirms nothing. If the mailbox is the thing under an attacker's control, every reply in that thread belongs to them as well. The confirming step has to move to a channel the request did not arrive on, using a contact detail stored before the request existed. A phone number written inside the message is another part of the message.
Voice used to be that separate channel. Cloning tools now build a convincing copy from a recording of about three seconds and reach roughly 85 per cent accuracy, and in testing people told a real voice from a synthetic one in only 37.5 per cent of attempts. A call still helps, provided you place it yourself to a number held in your own records.
The cheapest workable design is a stored contact list, a short agreed phrase for urgent cases, and a written line saying that urgency never removes a step. Attackers manufacture deadlines because deadlines dissolve procedure in a busy week. If a request cannot survive a ten minute delay and one call back, the problem belongs to the request.
05
Holidays, sickness and the deputy nobody named
Most two-signature rules die in August. The named approver is away, the payment is real, the supplier is waiting, and somebody decides that just this once is acceptable. That decision is rarely written down, so the exception quietly becomes the practice. By autumn nobody remembers the rule was suspended, and the control has gone without an alarm.
The repair is to name deputies in advance and to name at least two of them. Each band gets a primary approver and a standing deputy who holds the same permissions all year, including the weeks they are not needed. Rights granted in a hurry during an absence tend to stay granted afterwards, which is a quiet risk of its own.
There also has to be an honest answer for the case where no second approver is reachable. Two answers work: the payment waits until morning, or a defined emergency path releases it with a written record and a review at the next weekly meeting. Keeping a two-person rule for payments alive through absence is mostly a matter of deciding in advance which of the two you use.
06
Changed bank details are the event the rule exists for
One instruction deserves separate treatment: a message announcing that the account has changed. UK Finance recorded 248,070 cases of authorised push payment fraud during 2025 with 576.4 million pounds lost, and in each of them the money left with the payer's own approval. That is what a second pair of eyes is built for, because the banking system sees a properly authorised transfer and has no reason to stop it.
Sixty-six per cent of those cases begin online and a further 17 per cent start through telephone networks, so first contact arrives where genuine suppliers write to you every day. The defence is procedural. Any change of banking details triggers a call to the number you already held for that supplier, placed by the second approver, and the first payment after a change runs at a reduced amount.
Record the verification next to the payee record: who called, which number, on what date, and the name of the person who answered. Small teams lose this detail because it lives in somebody's memory or in a private chat. A single line in the accounting system survives staff changes and settles the argument months later, when an invoice is disputed.
07
Putting the rule where the work already happens
A rule living in a document nobody opens is a rule in name only. Most business banking platforms include dual authorisation, and switching it on moves the control out of goodwill and into software that never gets tired. Where a tool cannot enforce it, the next best thing is one short page: thresholds, named approvers and deputies, the confirmation channel, and the emergency path.
Test it the way you would test a backup. Once a quarter, send a payment request that looks ordinary and watch whether the second approver checks the account details or simply approves the screen. Nobody needs to be disciplined for failing that exercise, because the result is information about the procedure. A control that has never been tested is an assumption.
Keep a log of every override, with the reason and the name of the person who authorised it. Three overrides in a quarter means the threshold is set wrong, and the honest response is to move it rather than to keep breaking the rule quietly. A two-person rule for payments works because it is boring, predictable, and applied to the dull payment as strictly as to the suspicious one.
| Situation | Who confirms | What the second person checks |
|---|---|---|
| Routine payment below the threshold | Initiator alone | Nothing beyond the usual invoice match |
| Payment above the threshold | Primary approver or standing deputy | Amount, payee account, source document |
| First payment to a new supplier | Second approver, at any amount | Account details against a contact held earlier |
| Change of bank details | Second approver, by call to a stored number | Old number used, name of the person who answered |
| Payroll and tax runs | Second approver on the total and the file | Recipient count and any account changed this month |
| Urgent request from a senior person | Second approver, with no exception for rank | Channel the request arrived on |
| Both approvers unreachable | Payment waits, or the emergency path | Written record and review at the next meeting |
Questions and answers
What is the two-person rule for payments in a small team?
It means any payment above an agreed amount needs a second named person to confirm it before the money leaves. The confirming person checks the account details and the source document, and they are never the person who created the payment.
What amount should trigger a second signature?
A practical starting point is the sum your team could lose in one week without changing any plans, which for many small teams is close to one monthly salary. Review the last three months of payments, and if more than a handful each week would cross the line, raise it.
Who should be the second approver in a team of five?
Anyone with the standing permissions and no involvement in creating that payment, which usually means the bookkeeper approves what the manager raised and the reverse. Avoid making the founder the only approver, since instructions imitating the founder are a common route in.
What do we do when the second approver is on holiday?
Name a standing deputy who holds the same permissions throughout the year, so nothing has to be granted in a hurry. If neither approver is reachable, either the payment waits or a defined emergency path releases it with a written record reviewed at the next weekly meeting.
Is a phone call enough to confirm a change of bank details?
Only if you place the call yourself to a number stored before the request arrived, since a number inside the message is part of the message. Voice alone is weak evidence now, because convincing clones are built from a few seconds of audio and listeners rarely tell them apart.
Does a second signature slow the business down?
It adds minutes to a small number of payments a week and nothing at all to the rest, because the rule applies above a threshold. If it feels slow, the threshold is set too low and the fix is to move it rather than to skip the step.