What it means
A business can check balances and initiate transfers without visiting a branch, though available functions vary by bank, account and country. A screen that shows a payment as submitted is not always proof that it has settled or reached the intended recipient.
Business banking may permit separate roles for preparing and approving a payment, so set permissions based on actual duties and review them when staff change jobs. A single administrator with every right can become a point of failure even if the bank's technical security is strong.
Bank feeds can bring transactions into accounting software, reducing manual entry, but they still need reconciliation against bank records and an appropriate review of unmatched items. A feed is a data connection, not an independent audit of supplier invoices.
Security begins with individual credentials, multifactor authentication and updated devices. Staff should use the bank's known site or app rather than a link in an unexpected message, and should never share a login or security token to save time on approvals.
Fraudsters may compromise or imitate a supplier's email and ask to change payment details, so confirm changes through a previously known telephone number or another independently established channel, because a reply within the same suspicious thread does not reliably verify the new account. Payment limits and dual review reduce some risks, but two people can still approve a bad instruction if both rely on the same false source.
Give the reviewer the underlying invoice, supplier identity and verified change record, and document unusual overrides and who approved them. If a payment looks unauthorised, contact the bank promptly through its established support route and follow local reporting requirements.
Speed can matter for a recall, but recovery is not guaranteed, so preserve the transaction and communication records for investigation. For an owner, map the full path from supplier invoice to bank release and reconciliation.
Make sure the bank's permissions reflect that process, test a new payee carefully and review access and exceptions on a schedule.
In practice
Real-world examples.
Example
A retailer pays 40 suppliers in one bulk payment file through its bank's online platform. One employee prepares the file from approved invoices, and a second person reviews the totals and releases it. Finance then reconciles the bank statement against the file the next morning.
Example
A company sets up dual approval so any payment above $20,000 needs sign-off from two managers. The second manager sees the underlying invoice and the verified supplier record, not only the payment screen. Unusual overrides are logged with the name of the approver.
Example
An accountant downloads daily statements directly into accounting software through a bank feed. Matched items are cleared automatically, while unmatched items go to a review queue. The accountant still reconciles the month-end balance to the bank's own statement.
Formula
Calculation
Illustrative processing time saved = (old average staff minutes per comparable payment - new average staff minutes) x number of payments. Include approval and reconciliation time in both methods if they changed.
Worked fictional example. A business processes 200 payments a month. The old process takes 10 staff minutes per payment and the new process takes 2, measured on the same scope. The simple saving is 8 x 200 = 1,600 minutes, or about 26.7 hours. Training, controls and exception handling may reduce the net saving.Case study
Seen in the real world.
This illustrative and entirely fictional example follows Harbor Supplies. A clerk receives an email that appears to be from a long-standing supplier and asks for new bank details. The message alone does not establish its sender or make the requested change legitimate. Harbor's procedure requires the clerk to call the supplier using a contact number already verified in its records.
In this fictional case the supplier denies the change, so no payment is sent. The attempted redirection is documented, and the team reviews access to its email and banking accounts. Management also checks that one person prepares a payment and another independently reviews the payee and source evidence. The controls do not guarantee fraud will never occur, but they prevent this particular unsupported instruction from becoming a transfer.
Harbor runs a fictional drill with a changed bank account and an urgent approval request. The team checks the contact record, pauses the payment and logs the result. The drill finds an outdated number, which management corrects before a real exception occurs.
Watch out
Common mistakes.
- Using an email reply in the same suspicious thread to verify changed supplier bank details.
- Giving one user full payee-change and release rights without a meaningful independent review.
- Assuming a bank feed or submitted-payment screen means accounts are reconciled and the payee received funds.
Questions
People also ask.
Is online banking safe for businesses?
It can be secure with the bank's controls and careful business practices, but fraud and device compromise remain risks. Review permissions and payees.
What is dual authorisation?
One person prepares a payment and another authorised person checks and releases it. The second person needs independent source evidence, not just a second click.
Can online banking connect to accounting software?
Many banks offer feeds or exports. Check supported formats, permissions and reconciliation rather than assuming the connection verifies transactions.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%