How the gate works

Out-of-Band Payment Verification Readiness Gate

This tool grades one money-movement process against wire fraud and business-email compromise. Each signal is scored 0–2; the verdict is the weakest one — then a gate that can only make it worse.

The 6 signals

01Out-of-band callback to a known-good numbertop trigger

02Second-approver threshold on high-risk requeststop trigger

03Full sender / domain verification before action

04Documented escalation & stop path

05Verbal code-word protocol for voice / video

06Vendor bank-detail-change re-verification

DEFENSIBLE

every control present (2)

TIGHTEN

weakest control = 1

NOT DEFENSIBLE

any control 0 - or both top triggers below full

Single-approver gate · worsen-only

If neither the out-of-band callback nor the second approver is fully in place, one person can still push an urgent request through - NOT DEFENSIBLE regardless of the score. Bring either to Present and it releases.

NOT DEFENSIBLE

Why: The callback and second-approver controls are only partial - so one person can still move money on an unverified request, and the process reads NOT DEFENSIBLE despite a 79 context score. weakest signal 1/2 · 4 of 6 controls present, context 79/100.

Fix firstOut-of-band callback - verify every payment change by calling a number you already trust, never one from the request.

A clean sheet didn’t save it. The verdict is the weakest signal — and a top trigger is dispositive on its own — so it names the one thing to fix first. Grades the process, never people. Not fraud detection or a guarantee. Runs offline in the workbook and engine.

RedHub AIthe AI that tells you when to doubt it redhub.ai/systems/out-of-band-payment-verification-readiness-gate