Business Email Compromise Prevention Training

How Payment Impersonation Works

Explain the difference between a lookalike sender and misuse of a genuine account. Identify why an existing email thread or familiar signature does not establish authority to change bank details.

Break

Supplier and Employee Payment Changes

Map the approved process for changing account information. Practise callbacks using independently held contact details and recording a verification that another team member can understand.

Executive Urgency and Approval Bypass

Work through confidential or urgent payment requests from apparent leaders. Identify separation of duties, approval limits and the escalation contact when an instruction conflicts with the normal process.

Lunch

Invoices, Supporting Documents and Access

Review a fictional invoice and change request for inconsistencies. Consider who can alter supplier master data, which evidence supports approval and how to protect documents containing payment information.

Break

If a Fraudulent Payment May Have Been Sent

Escalate immediately through the organisation's incident procedure and authorised banking contacts. Preserve messages and transaction details for the responsible team; do not assume a recall or reimbursement will succeed.

Practical Exercise: The Changed Supplier Account

A fictional supplier requests a bank change just before a payment run. Participants verify the request, challenge an urgent override and produce a payment decision record and incident escalation draft.