Chapter 6 — Email and payment fraud
Lesson map
Lesson 06 published. Map, example, EX026.
flowchart TD
N0["Learning outcomes"]
N1["6.1 How the fraud works"]
N2["6.2 Verification checks"]
N3["6.3 Email protections"]
N4["6.4 Preparing staff"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX026"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["6.1 How the fraud works"]
N2["6.2 Verification checks"]
N3["6.3 Email protections"]
N4["6.4 Preparing staff"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX026"]
[Learning outcomes]
|
v
[6.1 How the fraud works]
|
v
[6.2 Verification checks]
|
v
[6.3 Email protections]
|
v
[6.4 Preparing staff]
|
v
[Worked example] --> [Exercise EX026]
Learning outcomes
You will (1) explain how invoice and payment fraud works; (2) design checks that stop it; (3) prepare staff for it.
6.1 How the fraud works
Daniel's second high risk is payment diversion. Ms. Ashby explains the usual pattern: a criminal gains access to a supplier's or client's mailbox, or registers a lookalike address, and sends a convincing message saying bank details have changed. Staff update the details and the next payment goes to the criminal. For an accountancy firm, the same trick can target client tax refunds. The messages often arrive at busy times and refer to real invoices, which is why careful people are still fooled. Daniel realises that technical controls alone cannot stop this pattern.
6.2 Verification checks
Daniel proposes a simple rule: no change to any bank details, for suppliers or client refunds, is made on the strength of an email alone. The person receiving the request phones the supplier or client on a number already on file, not one in the email, and records the call. A second person approves the change before the next payment. Mrs. Pike accepts the rule but asks for a way to handle urgent requests. Daniel suggests that urgency itself be treated as a warning sign, and that the managing partner be the only person who can approve a same-day change.
6.3 Email protections
Daniel asks the support company to mark emails from outside the firm with a visible banner, and to check that the firm's own domain is set up so that criminals find it harder to send email pretending to be Corbridge. He also asks them to flag messages from newly registered domains that resemble client or supplier names. Ms. Ashby notes these measures reduce the number of fraudulent messages reaching staff but never remove them, so the verification rule remains the main defence. Daniel records each measure in his register against the payment risk.
6.4 Preparing staff
Daniel runs a short session for the finance and payroll teams. He shows two synthetic examples of fraudulent change requests and asks the teams to find the warning signs. He then walks through the phone-back rule step by step. The teams ask what to do if a client is annoyed at being called; Daniel suggests explaining that the call protects the client's money. A month later, a payroll assistant phones a supplier after an email requesting new bank details. The supplier knows nothing about it, and the attempt is stopped and reported.
Worked example
Daniel introduces a phone-back and second-approval rule for bank detail changes, adds email protections, trains finance staff, and the rule stops a synthetic fraud attempt within a month.
Synthetic case. Fraud examples are synthetic.
Errors and limits
Calling a number provided in the suspicious email only reaches the criminal.
Exercises
- EX026 — Fraud pattern. How does payment diversion usually work? Rubric: 3 = message says bank details changed;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX027 — Phone-back number. Which number should staff call? Rubric: 3 = one already on file;; 2 = partly correct;; 1 = other;; 0 = none.
- EX028 — Urgent changes. Who can approve a same-day change? Rubric: 3 = the managing partner only;; 2 = partly correct;; 1 = other;; 0 = none.
- EX029 — Main defence. What remains the main defence against this fraud? Rubric: 3 = the verification rule;; 2 = partly correct;; 1 = other;; 0 = none.
- EX030 — Stopped attempt. Who stopped the fraud attempt? Rubric: 3 = a payroll assistant;; 2 = partly correct;; 1 = other;; 0 = none.
Continue studying — lesson 06 (chapter 06 of 12)
← Chapter 05 · Course chapter index · Chapter 07 →
Continue to the next authored lesson.