The email that looks exactly like your supplier
A supplier you have paid every month for two years sends an invoice. The logo is right, the bank details look familiar, and the amount matches your usual order. The only difference is that the account number has changed — and the email came from a domain one letter off from the real one.
This is the most common business email compromise pattern hitting Hong Kong SMEs right now. The attacker does not need to hack your supplier. They only need to watch your email thread, or guess your supplier's name, and send a convincing payment request at the right moment.
No single person can reliably catch this every time. That is why the control that actually works is not a better spam filter — it is a second pair of eyes before money leaves the company. In finance terms, that is dual approval.
What dual approval actually means in a small business
Dual approval means two people must independently sign off before a payment is released. It is not the same as CC-ing your business partner on an email. It is a defined step in your process where a second person checks the payment against the original request, and both approvals are recorded.
For a Hong Kong SME with five to fifty staff, this usually means:
- The person who requests or prepares a payment cannot be the same person who releases it.
- Both approvals are logged with a name and a timestamp, whether in your bank portal, accounting software or a shared sheet.
- Any change to supplier bank details triggers a separate verification step before the next payment.
If you are a two-person company, this still works. The owner approves, the bookkeeper prepares, and neither can complete a transfer alone. If you use a bank with a maker-checker function, switch it on today.
Where the fake supplier email enters your process
Most SMEs get caught at one of three points:
- Invoice arrival. A fake invoice lands in the inbox of the person who handles payments, and they process it like any other.
- Bank detail change. A supplier email says "we have switched banks, please update your records" and the new account is the attacker's.
- Urgency. A message from a "director" asks for an urgent transfer while they are travelling and unreachable.
Dual approval interrupts all three because the second approver is not reading the same email thread. They are checking the payment against a separate record — the purchase order, the contract, or a phone call to a known number.
How to set it up this week
Step 1: List every payment that leaves your business
Write down the types: supplier invoices, staff reimbursements, rent, subscriptions, one-off project fees. Mark which ones are routine and which involve a change of payee. The change-of-payee payments are where dual approval matters most.
Step 2: Define who approves what
Set a threshold. For example, payments above HK$10,000 need two approvers; below that, one approver plus a monthly review. Write it down in one page and share it with your team. The point is that everyone knows the rule before a suspicious email arrives.
Step 3: Separate the request from the release
The person who prepares the payment should not be the person who clicks send at the bank. In most Hong Kong business banking portals this is a setting, not a new system. Turn on maker-checker and assign roles.
Step 4: Add a callback rule for bank detail changes
Any request to change supplier bank details must be verified by phone using a number you already have on file — never a number in the email. The second approver makes that call. Document the call date and who spoke to whom.
Step 5: Log both approvals
Keep a simple record: date, payee, amount, approver one, approver two, and whether a callback was made. This log is your evidence if a payment is later disputed, and it makes the process real rather than theoretical.
What to do when someone bypasses the process
It will happen. A director will ask for a favour, or a long-standing supplier will pressure your team to skip the second signature. Treat any bypass as an incident, not a minor exception. Review what happened, confirm the payment was legitimate, and reinforce the rule. If the payment turns out to be fraudulent, contact your bank immediately — the sooner a transfer is flagged, the better the chance of recall.
For SMEs building out their website and back-office systems, the same principle applies to any tool that touches money or customer data: no single login should be able to move funds or export records. If you are reviewing who has access to what, our team can walk through your current setup and help you map the gaps.
Summary
Fake supplier emails succeed because they arrive in a process with only one pair of eyes. Dual approval — two independent sign-offs before payment, a callback for any bank detail change, and a written log — is a low-cost control that any Hong Kong SME can switch on this week. Start with your highest-value payments and your bank portal settings, then extend the rule to every change of payee. The goal is not to slow down your finance process; it is to make sure a single convincing email cannot empty your account.