Table of contents
  1. Research finding
  2. Methodology
  3. Key takeaways
  4. Research question and decision use
  5. Population and eligibility
  6. Control definitions
  7. Evidence and missing states
  8. Analysis plan
  9. Exception review
  10. Privacy and boundaries
  11. Limitations and replication
  12. Sources
  13. FAQs
  14. Related research

Research brief · Published:

Bank Change Verification Control Study

A protocol for reviewing direct deposit change requests against callback, validation, approval, and first-payment evidence.

Research finding

Treat callback, validation, approval, and first-payment check as separate controls.

4Headline measureSee numbered sources below.

Methodology

This brief triangulates the headline measure against official Philippine government, regulatory, development, and labor sources. It translates evidence into an operating control and separates context from recommendations.

Key stats and interpretation
MeasureInterpretation
4 controlsContext signal for planning, not a promise about an individual worker or provider.
3 source recordsPrimary source links are listed and numbered below for review.

Key takeaways

  • Treat callback, validation, approval, and first-payment check as separate controls.
  • Classify evidence as present, partial, absent, or not applicable.
  • Report the missing-control combination, not just an overall pass rate.
  • Keep fraud and reversal decisions outside the study.

Research question and decision use

The question is how often a completed bank change has each of the four control records, and where the evidence chain breaks.

Payroll and finance leaders can use the result to improve intake forms, callback logs, and release rules.

It should not be used to label an employee or a team as fraudulent.

Population and eligibility

Select changes that became active during the window, including changes later reversed.

Record the source system, the change date, the effective pay period, and the request channel.

Exclude duplicate records created by a single change and disclose the deduplication rule.

Control definitions

Define callback as an attempt to a number already on file with a recorded outcome.

Define validation as a provider prenote or account check, not a screenshot.

Define approval as a named owner's decision before activation.

Define first-payment check as a comparison of the posted account ending and amount after the change.

Evidence and missing states

For each change, record present, partial, absent, or not applicable for each control.

A callback note without a number is partial; a validation without a result is absent.

Keep the source reference and the reviewer who classified it.

Do not infer a callback from a comment that says verified.

Analysis plan

Report the share of changes with all four controls, each control separately, and the most common missing combination.

Show counts by channel and by whether the change was later reversed.

Use exact counts and disclose the denominator; do not present a percentage without the number of records reviewed.

Exception review

List cases with conflicting signals, such as a change followed by a termination or a request from a new phone number.

Review the narrative to understand whether the control failed or the case followed an approved exception.

A high exception rate may reflect stricter detection rather than weaker processing.

Privacy and boundaries

Store only the last four account digits in the review dataset and restrict access to payroll and finance reviewers.

The study does not determine whether a change was fraudulent or whether a payment should be reversed.

Those decisions remain with the authorized owner and the bank.

Limitations and replication

The review observes records for a defined period and cannot prove that a missing note means no call occurred.

System changes, staffing, and provider validation rules may affect the evidence.

Retain the change export, control codebook, classification sheet, and calculation so the result can be rebuilt.

Sources

  1. NIST SP 800-63B: Digital identity guidelines
  2. CISA: Turn on multifactor authentication
  3. Consumer Financial Protection Bureau: bank accounts

FAQs

Is a provider validation the same as a callback?

No. Validation checks the account format or reachability. A callback verifies that the person requesting the change can be reached at a known number.

How should reversed changes be counted?

Include them in the population and report reversals separately. A reversal may indicate a control worked, a control failed, or an employee changed their mind.

What if the payroll system does not keep a callback log?

Record the absence as a control gap and use the available evidence. Do not reconstruct a callback from memory to complete the dataset.

For adjacent operating context, see Payroll Preparation and the payroll operations guide library.

Related research