Why large runs need two people and a key

The most expensive payment fraud we see attempted against finance teams is not clever. Someone gets into one person's email, finds a thread about an upcoming payout, and asks — politely, from the real inbox — for one contractor's bank details to be updated before Friday.

Nothing about that attempt breaks a system. Every step is something your team does legitimately every week. That is why the defense cannot be a better password. It has to be a process that one compromised account cannot complete alone.

Two people, by amount

Every Pinnacle account has an approval policy. The simplest version says: a run under a limit you set needs one approver; a run over it needs two different people. Most teams set the limit somewhere between $25,000 and $250,000, depending on how often they pay and how large a normal run is.

A second approver is not a formality. It means the person who prepared the run is never the only person who released it, and it means anyone trying to push a fraudulent change through has to fool two people, at two different times, usually in two different places.

Why a key and not a code

Codes sent by text message or generated by an app are much better than nothing. But they can be phished: a convincing fake sign-in page asks for the code, and the attacker types it into the real one a few seconds later.

A hardware security key cannot be phished that way. It signs a challenge that is bound to the real website's address, so a look-alike page gets a signature that is useless anywhere else. To approve a run over your limit, the second approver taps a key that is physically in their hand.

• Keys are registered per person, and each person can register a backup.
• Losing a key does not lock your team out; an admin can revoke it and the person signs in with their backup.
• The approval log records which key signed each approval.

Changes to bank details wait

The email in the opening example is asking for a bank detail change. So the policy covers that too. When a contractor's account or routing number changes, the next payment to that contractor is held for review and needs an approver who did not make the change. The contractor is also notified at their old email address.

That last step matters more than it sounds. In most attempts we have seen, the real contractor is the first to notice, often within the hour.

The goal is not to make fraud impossible. It is to make sure no single inbox, password or phone is enough.

What it costs your team

In practice, about a minute per large run. The second approver gets a notification, reviews the run's total and any flagged changes, and taps their key. Teams who pay weekly tell us it becomes part of Tuesday morning within a month.

We think that is the right trade. The money in a payout run is your contractors' rent and groceries. A minute of friction to protect it is not friction anyone remembers.