The whole category in one page.
THE CONTROL THAT PREVENTS THE MOST DAMAGE
No change to payment details without a phone call to a number you already had.
Not the number in the message. No exceptions for urgency, seniority or familiarity.
WHAT NO LONGER IDENTIFIES FRAUD
Spelling and grammar errors. Those are gone.
Teaching staff to look for them gives false confidence.
WHAT TO TEACH INSTEAD
Do not judge authenticity by appearance. Verify through a separate channel.
URGENCY IS THE TACTIC
The more urgent the request, the more verification it warrants.
Tell staff explicitly that they may verify a request appearing to come from you, and will never be criticised for delaying to check.
NEVER DISPATCH ON A PAYMENT SCREENSHOT
Confirm funds in your own account. Initiated is not received.
FOR CASH ON DELIVERY
Confirm every order by phone before dispatch. An order nobody answers for is one that would have been refused.
FOR YOUR CUSTOMERS
Tell them your bank details never change, and to call you if a message says otherwise.
IF FRAUD SUCCEEDS
Contact your bank within hours. Recovery is sometimes possible if reported very quickly.
WHAT TO CHECK ON YOUR EMAIL
Mail rules you did not create. That is a strong indicator of compromise.
