SolidBowtie

Payment fraud & business email compromise

CEO fraud, invoice fraud and compromised mailboxes against the payment process — stopped by verification rituals and dual authorisation.

HazardOutgoing payments and supplier master data handled under time pressure
Top eventA fraudulent payment instruction is executed

4 threats 13 barriers 3 consequences safety-critical barriers marked

Use this template free. Copy “Payment fraud & business email compromise” into your own workspace and adapt every barrier — no credit card.

Start free with this template →

Threats & preventive barriers

Each threat is a credible pathway to the top event; its barriers interrupt that pathway before control is lost.

Spoofed executive email demands an urgent transfer

  • Email authentication (DMARC) & spoof banners

    Active hardware · 80% effective · Owner: IT Operations Manager

  • Fraud-awareness training for finance staff

    Behavioural (human) · 65% effective · Owner: CFO

    Urgency and authority pressure override doubt

    📅 Fraud-scenario refresher · semiannual keep-alive task

  • Out-of-band verification of urgent requests ★ critical

    Socio-technical · 85% effective · Owner: Finance Controller

Compromised supplier mailbox sends new bank details

  • Call-back verification of bank-detail changes ★ critical

    Socio-technical · 88% effective · Owner: Accounts Payable Lead

    Call-back uses the number from the fraudulent email

  • Four-eyes change control on supplier master data

    Socio-technical · 80% effective · Owner: Finance Controller

Compromised internal finance account

  • MFA on finance and banking systems ★ critical

    Active hardware · 90% effective · Owner: IAM Lead

  • Anomaly monitoring on payment runs

    Continuous · 70% effective · Owner: Finance Controller

Fictitious invoices for goods never delivered

  • Three-way match (order, receipt, invoice)

    Socio-technical · 85% effective · Owner: Accounts Payable Lead

  • Vendor onboarding due diligence

    Socio-technical · 70% effective · Owner: Procurement Lead

Consequences & recovery barriers

Once the top event happens, recovery barriers limit each consequence.

Funds transferred to mule accounts

  • Dual authorisation on payment runs ★ critical

    Socio-technical · 85% effective · Owner: CFO

  • Rapid bank recall & freeze procedure

    Socio-technical · 60% effective · Owner: Treasury Lead

    📅 Payment-fraud response drill · semiannual keep-alive task

Repeat fraud once the method is proven

  • Post-incident control review & hardening

    Socio-technical · 75% effective · Owner: Internal Audit Lead

Audit findings and insurance disputes

  • Fraud insurance with documented controls

    Socio-technical · 65% effective · Owner: CFO

Copying this template gives you a fully editable bowtie: barrier owners arrive as role suggestions, escalation factors sit on their barriers, and keep-alive activities are scheduled from the moment you copy. New to the notation? Read what the bowtie method is or browse the practical guides.

Use this template free. Copy “Payment fraud & business email compromise” into your own workspace and adapt every barrier — no credit card.

Start free with this template →