Row rect Shape Decorative svg added to bottom

Toxic access combinations: Reduce the risk of unauthorised payments

What are Toxic access combinations

A toxic access combination occurs when one user has permission to perform multiple high-risk activities without the appropriate checks and balances. This may include capturing and approving payments, adding or changing beneficiary details, and adding or removing users on online channels without a second level of approval.

Without the appropriate segregation of duties (SoD), errors, unauthorised changes and fraudulent payments may occur and remain undetected.

Understand the risk

Allowing one user to perform conflicting activities may enable them to:

  • Capture and approve their own payments
  • Add unauthorised beneficiaries
  • Change legitimate beneficiary banking details
  • Bypass approval workflows
  • Process fraudulent or unauthorised payments.

Protect your business

  • Ensure SoD: Separate payment capture, beneficiary maintenance and approval activities among different users.
  • Step up authentication: Apply additional authentication for high-risk transactions and account changes.
  • Implement approval hierarchies: Have independent approval in place for high-value or sensitive activities.
  • Monitor audit trails/logs: Record and monitor all critical user and payment activities.
  • Conduct regular reconciliations: Reconcile accounts regularly to detect anomalies early.
  • Follow the principle of least privilege: Grant only the access necessary for each user’s role.
  • Conduct role and access reviews: Review permissions regularly to eliminate toxic access combinations.
  • Increase fraud awareness: Educate users on fraud risks and the importance of strong controls.

Important reminders

  • Never allow one user to control an entire payment process.
  • Check your delegated user profiles and approval workflows regularly.
  • Ensure that no user can capture and approve their own transactions or independently create and approve beneficiary changes.

For assistance with reviewing your digital banking access and approval structure, please contact your Banker.

Telephone