A simple call-back rule stops most invoice fraud. Verify any change of bank details by calling a known number, not the one in the email.
The short version
Start with what already exists. Most organisations have routines, documents or tools that cover part of the need, and connecting them is faster than building something new.
A quick check
- Require call-back on new or changed bank details
- Use dual approval for large payments
- Train finance staff on BEC scenarios
Making it stick
Process controls work even when the email looks perfect. Review the result after three months and adjust. What works in practice is worth more than what looks complete on paper.