The bank validates the account. Nobody was validating the request.

A finance team gets an email from a known vendor: “We've changed banks — here's the new account.” Or a call that sounds exactly like the CFO, asking for an urgent wire. It looks right. It sounds right. The money leaves. And it's gone.

This is now the fastest-growing high-value fraud there is. Deepfake voice and vendor-impersonation email have made the old “does this feel legit?” gut check useless. And bank account validation doesn't save you — most fraudulent accounts pass it, because the account is real; it just belongs to the attacker.

The only control that actually works is an old one, done properly: verify the requestthrough a channel the attacker can't reach — the vendor's real number on file, not the one in the message — and keep a record that proves you did. It's exactly what cyber-insurers now require before they'll cover a social-engineering loss. Most teams do it inconsistently, by hand, if at all.

Vouchly makes that the default: detect the risky moment, verify out-of-band, get a second human approval, and produce a tamper-evident evidence pack for your renewal — without needing a security team to run it.