In 2025, Australians reported $2.18 billion in scam losses, and payment redirection scams alone accounted for $166.8 million, according to the National Anti-Scam Centre Targeting Scams Report 2025. For finance teams, that is not an abstract cyber problem. It is an accounts payable problem.
Dual approval payments give Australian SMBs a practical way to slow down risky payment decisions before money leaves the bank. For Xero users, the control is simple in principle: one person prepares or verifies the payment, and a different person approves it after checking the evidence.
In this article:
- What dual approval payments mean for Xero teams
- Why single-person approval creates fraud risk
- Where Xero approvals, bank authorisation and dual approval differ
- When dual approval payments should be mandatory
- How to implement dual approval payments in a small finance team
- Related Reading
- Conclusion
What dual approval payments mean for Xero teams
Dual approval payments mean two separate people are involved before a supplier payment is released. One person prepares, verifies or recommends the payment. Another person reviews the supporting evidence and approves the payment.
This is sometimes called two-person payment approval, dual authorisation, dual control, maker-checker approval or segregation of duties. The wording changes across banks, accounting systems and payment platforms, but the control objective is the same.
No single person should be able to create a supplier, change bank details, approve the invoice, release the payment and reconcile the transaction without another person seeing the risk.
For Australian SMBs using Xero, dual approval payments usually sit across three layers:
-
Xero workflow. Bills, contacts, supplier records, user permissions and audit history.
-
Banking workflow. Payment files, bank authorisers, transaction limits and release authority.
-
Finance control workflow. Supplier verification, callback checks, exception review and evidence capture.
The mistake many teams make is treating one layer as if it covers all three. Bank two-to-sign does not prove the invoice was real. Xero bill approval does not prove the bank account belongs to the supplier. A manager forwarding an email that says “approved” does not prove the request was legitimate.
Good dual approval closes those gaps by forcing a second person to review the actual risk, not just click the next button in the workflow.
Why single-person approval creates fraud risk
Single-person approval is fast, convenient and dangerous. It creates a single point of failure in the exact place criminals target: the moment a business decides where money should go.
The Scamwatch business email compromise guide warns that criminals may impersonate suppliers, executives or staff to redirect payments. These scams often look like ordinary finance requests because they are built around real invoices, real supplier relationships and urgent payment language.
A typical payment redirection scenario looks like this:
-
A supplier email account is compromised, or a lookalike domain is created.
-
The finance team receives an invoice or bank detail change request.
-
The request appears normal because it references a real job, project or relationship.
-
One person updates Xero or prepares the payment batch.
-
The payment is released to the criminal's account.
By the time the error appears in reconciliation, the money may already be gone. Real-time payments, faster settlement and electronic supplier workflows mean finance teams have less time to recover from mistakes.
Dual approval payments do not make fraud impossible. They make fraud harder to execute under pressure.
The second approver should ask uncomfortable but useful questions:
Is the supplier already known and active? A dormant supplier suddenly receiving a large payment should not pass without review.
Have bank details changed recently? A legitimate invoice paired with changed bank details is one of the clearest payment redirection warning signs.
Was the change verified through a trusted channel? Replying to the same email thread is not enough if that thread has been compromised.
Does the payment match the purchase order, contract or prior pattern? Amount, timing and bank details should make sense together.
Is the approver independent? The reviewer should not be the same person who entered the supplier change or prepared the payment.
These checks sound basic. That is the point. Fraud prevention often fails because basic checks are skipped when the team is busy, understaffed or trying to hit a payment run deadline.
Where Xero approvals, bank authorisation and dual approval differ
Xero is a core part of the workflow for many Australian SMBs. Xero's bill payment features help teams manage bills, approvals and payment preparation, and its product information explains how businesses can use Xero to manage and pay bills.
But Xero approval is not the same thing as a complete payment fraud control.
A bill can be approved because the expense is legitimate, while the bank details are wrong. A supplier can be real, while the change request is fraudulent. A payment can be authorised in the bank, while the underlying evidence was never independently checked.
That is why finance teams should distinguish between three ideas.
Bill approval
Bill approval confirms that an invoice should be paid according to the organisation's normal accounts payable process. The approver checks whether the cost is expected, coded correctly and supported by evidence.
This matters, but it does not automatically verify supplier identity or bank account ownership.
Payment authorisation
Payment authorisation is the permission to release money from the bank account. Many banks allow multiple authorisers, transaction limits and role-based controls.
The Australian Banking Association's Scam-Safe Accord shows how seriously banks are investing in scam prevention and payment verification. Even so, bank controls usually see the payment instruction after the business has already accepted the supplier and invoice details.
Dual approval payments
Dual approval payments focus on the control decision before release. They ask whether the payment should be released to that supplier, for that amount, to that account, at that time.
This is where Xero data, supplier verification, internal approvals and bank release controls need to meet.
For more background on separating roles in a small team, read our guide to segregation of duties when you only have three people in finance. The same principle applies here: if perfect separation is impossible, use compensating controls around the highest-risk steps.
When dual approval payments should be mandatory
Not every $42 software subscription needs a CFO review. A control that treats every payment as high risk will slow the team down until people find ways around it.
The better approach is risk-based dual approval. Make the second approval mandatory when the risk justifies the friction.
New suppliers
A first payment to a new supplier should never be treated as routine. The finance team has no payment history to compare against, and criminals often exploit onboarding gaps.
Before approval, verify the supplier's ABN or ACN, confirm contact details from a trusted source, and check bank details using an independent callback process. Our step-by-step guide on how to verify supplier bank details in Australia explains how to do that without relying on email alone.
Changed bank details
Changed bank details should trigger automatic scrutiny. A genuine supplier may change accounts, but this is also one of the most common paths for payment redirection fraud.
The second approver should see who requested the change, how it was verified, who updated Xero and whether any payment is waiting to be released.
The AusPayNet BSB lookup tool can help confirm the bank and branch connected to a BSB. It does not prove the account belongs to the supplier, so it should support verification rather than replace it.
High-value payments
Set a dollar threshold that matches the size of the business. For one SMB, that might be $5,000. For another, it might be $50,000.
The threshold is less important than consistency. If a payment exceeds the agreed limit, a second approver should review the invoice, supplier record, bank details and payment history before release.
Unusual timing or urgency
Fraudsters use urgency because urgency reduces scepticism. Requests that arrive late on a Friday, just before a public holiday, or immediately before a payment run deserve extra attention.
Dual approval is especially useful when the request includes language such as “must be paid today”, “new account effective immediately” or “do not call, I am in meetings”.
Exceptions and overrides
Every override should leave an audit trail. If someone bypasses the normal approval matrix, the reason should be documented and reviewed later.
Exceptions are not always wrong. Undocumented exceptions are the problem.
How to implement dual approval payments in a small finance team
Small finance teams often know they need dual approval but assume they do not have enough people. In practice, dual approval does not require a large department. It requires clear roles and a disciplined trigger list.
Start with the highest-risk payment events, then build the process around those events.
1. Map the current payment path
Write down each step from supplier onboarding to reconciliation.
Include who can create suppliers, edit contacts, enter bills, approve bills, prepare payment files, authorise bank payments and reconcile the bank feed.
The goal is to find where one person currently controls too much of the process.
2. Define approval triggers
Create a short list of events that always require dual approval.
For most Xero-based SMBs, that list should include:
- New supplier payments.
- Supplier bank detail changes.
- Payments above the agreed threshold.
- Payments to dormant suppliers.
- Refunds or urgent off-cycle payments.
- Any payment where the invoice, supplier record or email request looks unusual.
Keep the list short enough that staff can remember it.
3. Separate preparer and approver
The person who enters or changes the supplier record should not be the only person approving the payment. The person who prepares the bank file should not be the only person releasing it.
If you only have a bookkeeper and an owner, the owner can act as the second approver for high-risk payments. If you use an external accountant or BAS agent, they may review exceptions on a schedule.
This is not about mistrusting staff. It is about removing unnecessary pressure from one person.
4. Document the evidence
A good approval record should answer four questions:
- What was approved?
- Who prepared it?
- Who reviewed it?
- What evidence was checked?
Evidence might include a verified supplier callback, a purchase order, a contract, an approval email from a known channel, a screenshot of the supplier record or a note explaining why an exception was accepted.
For broader control design, see our accounts payable internal controls guide. Dual approval works best when it is part of a broader AP control set, not a lonely checkbox.
5. Review the audit trail
Xero's audit history and contact records help teams understand what changed and when. Xero Central also documents how users can edit a contact, which is useful context for understanding where supplier data changes occur.
The audit trail should be reviewed when a payment looks unusual, but it should not be the only control. An audit trail tells you what happened. Dual approval helps stop the wrong thing from happening in the first place.
Common mistakes to avoid
Dual approval payments can fail if the process is vague, performative or easy to bypass.
Approving the email, not the evidence. A forwarded email saying “approved” is not enough for a high-risk supplier payment. The approver needs to see the invoice, supplier record and verification notes.
Letting the same person prepare and approve. If the same person controls the supplier change and the approval, the business still has a single point of failure.
Using thresholds only. A $900 payment to a changed bank account can be riskier than a $9,000 payment to a long-term supplier with stable details.
Ignoring supplier master data. Dormant suppliers, duplicate contacts and missing ABNs make payment approval harder. A clean supplier list makes dual approval faster.
Treating bank authorisation as complete protection. Bank controls matter, but they do not replace supplier verification and AP review.
Failing to record exceptions. If someone overrides the process, record why. Patterns in exceptions often reveal training gaps, workload pressure or control weaknesses.
Dual approval payments checklist for Australian SMBs
Use this checklist as a starting point for your next finance control review.
- Document who can create, edit and approve supplier records in Xero.
- Require second approval for all new suppliers.
- Require independent verification for bank detail changes.
- Set payment thresholds by amount and supplier risk.
- Separate bill approval from bank payment release.
- Record evidence for every high-risk approval.
- Review dormant suppliers and duplicate contacts monthly.
- Use trusted phone numbers for callback verification, not numbers supplied in the change request.
- Review approval overrides at month end.
- Train staff to pause when a request is urgent, unusual or confidential.
The control should be simple enough to use on a busy payment day. If the process only works when everyone has spare time, it will not work when fraud pressure is highest.
Related Reading
- Accounts Payable Internal Controls: A Small Business Guide
- How to Verify Supplier Bank Details in Australia
- Xero User Permissions: A Security Guide for Finance Teams
- Payment Fraud Statistics Australia 2026: The Numbers Every CFO Should Know
Conclusion
Dual approval payments are one of the most practical fraud controls an Australian SMB can put in place. They are not complex, but they require discipline: clear triggers, independent review, documented evidence and a willingness to pause before funds leave the account.
For Xero teams, the biggest gains come from applying dual approval to the moments that matter most: new suppliers, changed bank details, high-value payments and urgent exceptions.
OutflowGuard helps Xero-using finance teams monitor supplier bank detail changes, trigger two-person verification and keep an audit trail for high-risk payment decisions. The goal is not to add red tape. It is to make the safe path the normal path before payment fraud becomes a recovery problem.