A Lincoln or Omaha bookkeeper can do everything right on the message in front of them and still pay the wrong account.
The message they never saw was copied to a mailbox outside the company by a rule sitting in Microsoft 365 or Google Workspace.
This note is about that rule.
It is a companion to the business email compromise guide, not a second copy of it.
What a forwarding rule looks like in Microsoft 365
In Microsoft 365, a user or an admin can tell the mailbox to send a copy of certain messages somewhere else.
The usual shape is a rule that looks for words such as invoice, ACH, or payment, then forwards those messages to an address the company does not own.
The person who releases payments still sees a normal inbox.
They do not see the copy.
What it looks like in Google Workspace
In Google Workspace the same job is a filter.
The filter can forward matching mail, skip the inbox, or mark it read.
Finance still works from the thread they have.
The outside mailbox has the vendor invoice too.
Who should be allowed to create rules
One named admin should be allowed to create rules that send mail outside the company.
Everyone else should need that person.
A finance lead in Lincoln and a finance lead in Omaha should both know the name.
If the company has an internal IT person, that person owns the rule list.
If SAINT runs the tenant, we own the list with them, in writing.
That tenant work sits inside Microsoft 365 management in Lincoln.
The Friday check
Once a week, before anyone leaves for the weekend, look at three things.
Look at Sent mail for payment messages nobody remembers sending.
Look at the rule list for a forward to an outside address.
Look at any vendor who asked to change a bank account outside the thread you already had with them.
Confirm that change on a phone number from the last invoice you already trusted.
If a rule is already there
Do not delete it to tidy the mailbox.
Write down the time you found it, the address it forwards to, and whether a payment left.
If money may have moved, call the incident line at (531) 625-2113.
If money has not moved, call the desk at (531) 625-2111.
The order of the first hour is already written in what to do after a bad click.
Use that page.
This one stays on the rule.
Nebraska shops outside the two metros can run the same Friday check.
For Lincoln firms that want the broader control stack around this habit, see cybersecurity services in Lincoln.
If you want a person to sit with the bookkeeper for a quarter hour on that habit, start at contact.