List the real vendors and people your company pays, and who to send a payment to for review. When a message asks you to pay someone who does not match this list, or to send money to an account you never approved, PRINCE stops and hands it to your boss before anyone pays.
For each one, add the email or website domain they really use, their phone, and the last 4 digits of the bank account you have approved for them. Separate several with commas.
Add your employees' emails, one per line or separated by commas. Anyone who signs in with a listed email is protected by this same list, and their flagged payments come to your reviewer. They never see your vendors or account numbers.
When something does not match, PRINCE emails this person so they can decide before any money moves.
Paste a suspicious email or message, and who it says it is from. PRINCE weighs it against your list.