When the message appears to come from a colleague.
WHAT HAPPENS
A message appears to come from a colleague, a manager, a supplier or a client.
It requests a payment, a change, or information.
WHY IT WORKS
It may genuinely come from their address, if their account is compromised It may follow a real conversation It arrives when such a request is plausible
WHAT MAKES IT CONVINCING NOW
Well-written messages Convincing voice on a call Details drawn from real correspondence
WHAT THAT MEANS
You cannot reliably judge authenticity from the message itself.
WHAT DEFEATS IT
Verification through a separate channel you established previously.
Call the number you already had. Not the one in the message.
WHAT TO ESTABLISH AS A PROCEDURE
Any request involving money or access is verified by voice, on a known number.
No exceptions for seniority or urgency.
WHAT TO TELL STAFF
That they may and should verify a request appearing to come from you.
Say it repeatedly.
