In this article
Every professional who routes large payments for a living has felt the specific anxiety that arrives in the ninety seconds between hitting send on a wire and receiving the confirmation call. The amount is real, the destination is irreversible, and the only thing standing between a clean close and a catastrophic misdirection is the quality of the process that ran before that moment.
That process — the sequence of checks, confirmations, and authorizations that precede the final release of funds — is where most payment fraud is either stopped or enabled. The technical name for its centrepiece is dual authorization, or the four-eyes principle: the requirement that no single person can both initiate and approve a large payment on their own authority. It sounds simple. Practising it consistently, under the time pressure of a real estate closing or a large OTC settlement, is significantly harder.
This article is a practical guide for settlement agents, closing attorneys, escrow officers, title companies, brokers, and treasury teams who want to build that consistency. It covers why the habit degrades, how to design controls that hold under pressure, what thresholds should trigger the rule, and how routing infrastructure like shaka.deal gives the underlying payment mechanics properties that support rather than undermine the controls teams work hard to build.
The fraud environment that makes this non-negotiable
The scale of the problem is worth stating plainly before moving into mechanics. The FBI's 2025 IC3 report logged 24,768 BEC complaints and $3.05 billion in reported losses, up from 21,442 complaints and $2.77 billion in 2024. Business email compromise — the attack category most likely to hit professionals managing real property closings, OTC trades, and large deal settlements — is not a niche threat. It is the dominant financial crime vector in high-value commercial transactions.
Wire transfers and automated clearing house payments carried 86% of BEC losses in 2025, the FBI reported, which helps explain why the scam remains so damaging. These are precisely the payment methods that settlement professionals and treasury teams use every day.
The fraud mechanics are specific. Criminals compromise the email accounts of attorneys, settlement companies, title agencies, or real estate companies. From there, they monitor communications and when settlements are imminent, they will send updated wiring instructions, with everything about the transaction being accurate, except the payment instructions now direct the funds to an account controlled by the criminal or one of their accomplices.
Real estate closings, in particular, remain a frequent entry point, since a single closing can involve a large wire and multiple parties who are unfamiliar with each other's normal communication habits. That unfamiliarity — the fact that a buyer may never have spoken to the settlement agent before, that a new escrow officer handles a deal once and is gone — is exactly what attackers exploit.
Generative AI is making BEC lures more convincing and easier to create. By mid-2024, an estimated 40% of BEC phishing emails were AI-generated. By 2025, BEC emails had become nearly indistinguishable from genuine business correspondence in language and formatting, making them harder for busy employees to spot.
The reality around recovery is sobering. Once money leaves through a wire, it often reaches a fraudulent account and moves again within hours, well before a bookkeeper or bank notices anything wrong. Every hour of delay reduces recovery probability.
Against that background, dual-approval controls are not administrative overhead. They are the most direct lever available to the professionals most exposed to this category of loss.
What dual approval actually means — and what it does not
The concept is older than payments technology. In treasury management, it is often called the four-eyes principle, named for the requirement that at least two pairs of eyes must review and authorize a transaction before it moves. Many large companies choose to implement the four-eyes principle. Each step of the payment process is separated and must be approved by at least two people, hence "four eyes."
The specific mechanism is segregation of duties applied to payment flows. Dual controls split the duties of initiating and approving transactions like ACH and wire payments into two steps: people who can initiate payments, and those who can approve them. This blocks a single person — whether it's a fraudster who has gained access to your accounts or an employee with bad intentions — from having full control of both payment initiation and approval.
What dual approval is not: it is not a bureaucratic slow-down for its own sake, and it is not a replacement for the professional judgment of the settlement agent, the closing attorney, or the OTC desk. It is a structural check on the payment itself — a moment engineered into the workflow where a second qualified professional must independently confirm the destination, the amount, and the timing before funds move.
The person who creates an international payment shouldn't be able to approve and release it alone as well. That's the foundation. The payment approval process needs to separate three moments that often get blurred in busy teams: creation, approval, and release. When those three moments belong to different people, any attempt to compromise one person still leaves two checkpoints intact.
Dual approval systems increase the chances that a mistake in amount, date, payee, or payment method will be spotted before having to resort to a costly and time-consuming fix. Beyond fraud, this catches operational errors — wrong account numbers, transposed digits, incorrect disbursement splits — that are common even when no malicious intent is present.
Why the habit degrades: the specific failure modes
Understanding why well-designed dual-approval policies collapse in practice is necessary before building a replacement. There are four reliable failure modes.
The urgency override. Messages that create urgency or pressure immediate action are a recognized red flag for fraud. But urgency is also a structural feature of real closings. Settlements have hard deadlines. Funding windows close. Attorneys are in rooms with clients. Under genuine time pressure, the second approver is telephoned and says "yes, go ahead" without independently verifying account details — turning the dual approval into a formality that provides no actual control. Make sure all team members know how to handle unusual requests and give explicit permission to slow down and request additional verification, even when someone is pushing hard for speed.
Approval in email. When approvals live in email or chat, you lose three things auditors care about: who approved, what exactly they approved (amount, counterparty, settlement instructions), and whether the approver was eligible to approve. An email saying "looks good" in a thread that contains the payment details is not a dual-approval record. It is a convenience that feels like a control but provides almost none of the protection.
Policy without enforcement. Policy without process is theory. Process without platform enforcement is manual compliance. A written policy that says "all payments above $50,000 USD (approximately $77,500 AUD) require two signatories" does nothing if the payment system allows a single user to initiate and release without a technical block. It's common for banks to offer tools that can strengthen payment controls, however, it's on the businesses to make sure the tools are properly activated and consistently used.
Same-channel verification. The two-person, two-channel rule means two people approve and verification happens via phone callback to a known number. This stops most BEC attempts. The critical word is "known" — the callback must go to a number recorded in your system before the transaction, not to a number provided in the email requesting the change. When verification travels through the same channel as the original instruction, a compromised inbox defeats both steps.
Setting the threshold: where dual approval must begin
Not every payment requires two-person authorization. A firm-wide policy that routes every routine disbursement through a second approver creates fatigue that eventually erodes the control's effectiveness. The goal is threshold design: identifying the dollar amount above which the second approval becomes mandatory, and then holding that line without exceptions.
Require two levels of approval for large or sensitive transactions to minimize the chance of unauthorized payments. The definition of "large" varies by organization, but best practice in treasury and settlement work suggests three common threshold tiers:
| Tier | Applies to payments above | What it requires |
|---|---|---|
| Tier 1 — Operational threshold | A lower limit, often $10,000 USD (approximately $15,500 AUD) for smaller firms, $25,000 USD (approximately $39,000 AUD) for larger operations | A second reviewer confirms payee details match the file. The initiator cannot also be the confirmer. |
| Tier 2 — Senior authorization threshold | $100,000 USD (approximately $155,000 AUD) | A named senior approver — a principal, managing partner, chief financial officer, or operations director — whose sign-off is captured in a documented audit log |
| Tier 3 — Out-of-band verification threshold | $500,000 USD (approximately $775,000 AUD) for any single payment | Mandatory out-of-band verification: a voice call to a number from your existing records, confirming account details independently before release |
Require two approvals for payments above a defined threshold. Best practices include threshold-based approval where larger payments require C-suite or finance leader sign-off, vendor verification checks to confirm banking details before approving payment, and a payment review log that maintains a digital audit trail capturing who approved and executed each transaction.
In real estate settlement, commercial lending, and OTC trading contexts, the out-of-band verification tier should be treated as absolute.
Limiting the size of transactions individual employees can authorize is a core antifraud control. For example, you might require employees to obtain manager approval for transactions over a defined amount. Even if a worker attempts to commit fraud or someone's account credentials become compromised, financial losses may be capped at a relatively low amount.
Designing the habit: mechanics that actually hold
A habit is a process that runs without requiring active re-decision each time. The goal is to take the dual-approval requirement from a policy (which requires a conscious choice to follow) to a habit (which requires a conscious choice to bypass). The mechanics below are designed to produce that shift.
Write the rule as a pre-condition, not a reminder. The second approver's sign-off must be a pre-condition for payment release, not a box checked after the fact. In system terms: the payment cannot be submitted to the network until the second approver has authenticated and confirmed. In manual terms: the wire instructions sheet is not given to the bank until it carries two signatures with date and time stamps. The structure of the process must make the un-approved payment literally impossible to submit through normal means.
Assign roles, not individuals. The core of an effective workflow is a role-based authorization model. The "second approver" role should not be a named person who may be out of office, but a role that can be held by multiple qualified staff members — each of whom has the same obligation and authority. This prevents the bypass that happens when "the only person who can approve" is unavailable and the transaction is released anyway under pressure.
Separate the verification channel. The second approver's review must include independent confirmation of the account details — not just a read of the instruction document that the initiator has already prepared. For high-value transactions, this means the second approver pulls the payee bank details from the original contract, the engagement letter, or the title commitment, and compares them to the wire instruction independently. If they match without discrepancy, the approval is granted. If there is any difference, the payment stops until the discrepancy is resolved through a verified call.
Standardize the approval record. Document the transaction — record all details of the transaction for compliance and audit purposes. The approval record should capture: initiator name, approver name, date and time of approval, specific account details confirmed (last four digits of receiving account, routing number), and the source document used for verification. This is not just an audit exercise. The act of recording the confirmation is itself a control — it forces the approver to consciously perform each step rather than provide a general assent.
Conduct pre-closing verification early. A good practice is to start with pre-closing verification three to five days before the big day. When bank details are confirmed days before the settlement date, changes that arrive in the final hours are automatically suspicious, and the team has time to verify them properly rather than under closing-day pressure.
Train every new role-holder explicitly. Give extra attention to new hires and team members changing roles. Criminals love to target treasury employees who are new to the process and eager to please. Ensure fraud awareness is a part of every onboarding and is revisited each time someone takes on new payment responsibilities.
Scenario walkthroughs: what the habit looks like in practice
Abstract principles become habits through repeated exposure to concrete scenarios. The three below represent common situations where the control is most likely to be tested.
Scenario 1: Commercial real estate closing, multiple disbursement parties. A title company is settling a $2.4 million USD (approximately $3.7 million AUD) commercial property purchase. Disbursements must reach the seller, the seller's lender, the buyer's broker, the seller's broker, municipal lien holders, and the title company's own fees — six separate destinations within a tight funding window.
In this scenario, the initiator prepares the disbursement instruction sheet from the settlement statement and the individual payee confirmations already on file. Before any wire is released, the designated second approver — a senior escrow officer or the managing attorney — independently pulls the payee bank details from the file and checks each one against the instruction sheet. The approval record is signed and timestamped. Then, and only then, does the batch go to the bank. The multi-party complexity of the disbursement is exactly why the second review matters most here: a single transposed digit in any one of six destinations can redirect a wire with no automatic correction.
When shaka.deal is used to route the payment onchain, the disbursement logic — the preset shares going to each party simultaneously — is encoded before the transaction is submitted. The initiator and approver review the encoded routing before broadcast. Once confirmed and the transaction executes, every party receives their portion in a single onchain event. There is no sequential queue of individual wires, each carrying individual fraud risk. One confirmed transaction, one audit record, simultaneous settlement.
Scenario 2: OTC desk, large block trade settlement. An OTC desk is settling a $5 million USD (approximately $7.75 million AUD) block trade. Counterparty confirmation arrived by email. The settlement team has worked with this counterparty before, but the account details in today's email are slightly different from the ones on file — the routing number has changed.
This is the scenario where the two-person, two-channel rule saves the trade. The initiator notices the discrepancy and does not proceed. The second approver independently contacts the counterparty at the number on file — not the number in today's email — and verbally confirms the account change. The counterparty confirms the change is legitimate and explains the reason. Both the initiator and the approver sign off on the verified update, adding a note to the file explaining the account change and the verification method used. The payment proceeds with the updated details. The entire verification adds under twenty minutes to the process.
If the contact at the known number had said "we haven't changed our account details," the desk would have prevented a significant loss. The two-person, two-channel structure created the precise moment that made the check possible.
Scenario 3: Brokerage firm, routine but above-threshold vendor payment. A brokerage operation makes a $180,000 USD (approximately $279,000 AUD) payment to a software vendor for annual licensing. This is a recurring payment, but it exceeds the firm's $100,000 USD senior authorization threshold. The accounts payable coordinator initiates the payment. The CFO receives a notification and logs into the approval queue.
Here is where policy without process fails. If the CFO can simply approve the amount without verifying the payee account details — because "we've paid this vendor before" — the control does not protect against a vendor email compromise, where the attacker has sent updated banking instructions from what appears to be the vendor's domain. A growing number of BEC attacks now involve compromising trusted third-party vendor email addresses to insert fraudulent payment instructions. The CFO's approval must include a step of independently confirming the bank details match the record on file from the original vendor contract — not from the most recent email thread.
Onchain routing and the structural advantage of finality
The dual-approval habit described above is fundamentally about creating certainty before the payment moves. Once it does move, the professional must live with the outcome.
This is where the underlying payment infrastructure matters. Settlement finality — the legal moment when a transfer becomes unconditional and irrevocable — lies at the heart of financial stability. Traditional wire infrastructure provides finality, but with varying speeds, with potential for recall windows, and with reconciliation processes that can introduce uncertainty about which parties have received what, and when.
Blockchains introduce a fundamentally different settlement model. Atomic settlement enforces simultaneous, conditional exchange: either both sides of a transaction execute, or neither does. Combined with rapid, economically enforced finality and 24/7 availability, this architecture eliminates a wide range of risks that regulators and market operators have long been forced to manage.
For settlement professionals, the relevance is this: when a multi-party disbursement is routed through shaka.deal, the encoding of each party's share happens before execution, not after. The initiator and approver are reviewing not a stack of sequential instructions, but a single structured routing transaction: one incoming amount, preset shares, simultaneous payout to every party, fully visible on the public ledger the moment it settles. The approval process is approving a complete picture, not a sequence of individual steps that could individually drift from the agreed terms.
Depending on the context, a smart contract's owner or manager can pre-define a group of addresses that can authorise a transaction and set the minimal number of authorisations required to approve a payment. Each authorised address can submit a signed transaction to the multisignature smart contract that keeps track of the number of transactions with valid signatures. Once the number of valid transactions reaches the pre-specified threshold, the smart contract can perform the token payment.
This means the dual-approval habit, when combined with onchain routing through shaka.deal, can be structurally enforced at the payment layer itself — not just in a policy document or an internal workflow tool. The second approval is not a notification that can be bypassed; it is a cryptographic precondition for the transaction to broadcast.
And once it does broadcast: where traditional settlement relies on institutional rules and operational procedures to establish finality, blockchains achieve it through cryptography and economic deterrence. The settlement is not pending subject to batch cycles or correspondent bank chains. It is confirmed, recorded permanently on the ledger, and instantly auditable by every party. The anxiety of the ninety-second wait is replaced by a timestamped, immutable record that every party can verify independently.
Shaka.deal never holds funds. It routes. The professional initiating the payment retains control of the transaction until it broadcasts. The approval process takes place before that moment. After that moment, every pre-agreed party receives exactly their preset share — simultaneously, with finality, in a single onchain event.
Building the approval culture in your firm
Process mechanics are necessary but not sufficient. Habits are social as much as mechanical. The approval process works because the people involved treat it as real, every time, under pressure.
Fraud thrives where internal controls are weak or inconsistent. Inconsistency is often a cultural issue, not a design issue. The firm where the principal occasionally waves through a large wire without the formal second approval — because they trust the initiator, or because the closing is running late — is telling the rest of the team that the rule is optional under pressure. That is precisely when the rule is most important.
A few specific cultural practices that reinforce the habit:
Name the exceptions. Every time the dual-approval process is bypassed — even for a legitimate reason, even in good faith — that bypass should be recorded as an exception, with a note explaining why and who authorized the deviation. Making exceptions visible makes them rare. A "break-glass" path for urgent execution requires a reason code, an expiry time, and a second approver from a separate group. It automatically creates an exception record for later review.
Review approvals in post-close audits. After each large closing or settlement event, the payment approvals should be reviewed as part of the file close-out: were all payments above threshold approved by two people? Were account details verified against the source document, not just the email? Were any changes to payee details made after initial filing, and if so, were they re-verified? Conduct frequent reviews of treasury operations to detect and address any irregularities before they escalate.
Rotate the approver role deliberately. No single individual should have control over all aspects of a financial transaction. For example, the person who approves payments should not be the same person who records them. Rotating who holds the approver role in a given transaction prevents the comfortable familiarity that allows approvals to become rubber stamps.
Surface the near-misses. When a team member catches a discrepancy through the dual-approval process — a changed account number, a slightly different payee name, a routing number that doesn't match the file — that catch should be discussed in the team, not quietly resolved and forgotten. Near-miss visibility reinforces the value of the control far more effectively than training documents.
The compounding return on the habit
A well-run dual-approval discipline does more than prevent fraud. It creates an environment where the professionals who close large deals with your firm trust the process as much as they trust the individuals involved. Treasuries deal with large sums of money on a daily basis and the key operational risks are fraud or error. Errors can usually be corrected, although the cost may be high, but fraudulent losses can be irretrievable.
The settlement agent whose process is documented, auditable, and systematically dual-approved is doing something that matters to the clients and counterparties who rely on them. In an environment where real estate wire fraud losses alone exceed $145 million USD annually in reported cases — with victims of real estate wire fraud suffering a median financial loss exceeding $70,000 — the professional who can demonstrate that their disbursement process is structurally sound is offering a material service quality advantage, not just a compliance checkbox.
The habit, once built, is self-reinforcing. Every large payment that goes through without incident is evidence that the process works. Every discrepancy that gets caught before release is evidence that the second review adds real value. Over time, the question stops being "do we really need to do this on every transaction?" and becomes "why would we ever skip this?"
That is the point at which the dual-approval process has become a genuine habit — embedded in the culture of the firm, supported by the structure of the workflow, and backed by payment infrastructure, like shaka.deal's onchain routing, that enforces the split between initiation and execution at the protocol level.
One incoming payment. Preset shares. Simultaneous payout. Final settlement. The professionals who route large payments deserve infrastructure that matches the precision of the controls they build around it.
