Chapter 3 — Email, fraud and people

Chapter 3 — Email, fraud and people

Lesson map

Lesson 03 published. Map, example, EX055.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Phishing signs"]
  N2["3.2 Invoice fraud"]
  N3["3.3 The rule in action"]
  N4["3.4 Short training"]
  N5["3.5 Reporting without blame"]
  N6["Concepts — sign, channel, and report"]
  N7["Data — one attempted payment and the training rhythm"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX055"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Phishing signs"]
  N2["3.2 Invoice fraud"]
  N3["3.3 The rule in action"]
  N4["3.4 Short training"]
  N5["3.5 Reporting without blame"]
  N6["Concepts — sign, channel, and report"]
  N7["Data — one attempted payment and the training rhythm"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX055"]

[Learning outcomes]
    |
    v
[3.1 Phishing signs]
    |
    v
[3.2 Invoice fraud]
    |
    v
[3.3 The rule in action]
    |
    v
[3.4 Short training]
    |
    v
[3.5 Reporting without blame]
    |
    v
[Concepts — sign, channel, and report]
    |
    v
[Data — one attempted payment and the training rhythm]
    |
    v
[Worked example] --> [Exercise EX055]

Learning outcomes

You will (1) recognise phishing and invoice fraud; (2) set a payment verification rule; (3) build a short, blame-free reporting habit.

3.1 Phishing signs

Mr. Nowak shows the group common signs of phishing: a sender address that does not match the name shown, unexpected urgency, a link whose real destination differs from its text, and requests for passwords or payments. Sofia picks three recent emails from the clinic's inbox that staff had asked about and checks them with the reception team. One claimed to be from a parcel company and linked to a lookalike address. Mr. Nowak stresses that no list catches everything, so the habit of pausing and checking matters more than memorising signs.

3.2 Invoice fraud

Small businesses are often targeted with messages that claim a supplier has changed bank details. Hollybank pays a drug wholesaler, a laboratory and several equipment suppliers. Sofia agrees a rule with Dr. Moss: any request to change bank details is checked by phoning the supplier on a number already held, never one in the message, and a second person approves the change. Mr. Nowak explains that this one rule stops most invoice fraud, whatever the email looks like, because the criminal cannot answer the phone at the real supplier's office.

3.3 The rule in action

Two weeks later, the office receives an email apparently from the equipment supplier, with a correct invoice number and a request to pay into a new account before the end of the day. The office assistant follows the rule and phones the supplier on the number in the clinic's records. The supplier has sent no such message and says its own mailbox may have been compromised. The clinic pays nothing to the new account. Sofia records the attempt, forwards the email to the supplier and thanks the assistant in front of the team.

3.4 Short training

Sofia runs a ten-minute session at the weekly staff meeting, using two synthetic examples that look like clinic emails, one about a parcel and one about a pet insurance claim. Staff find the signs together and agree what to do. Mr. Nowak advises against long annual training for a clinic this size; short, regular, relevant sessions are remembered better. Sofia plans one short topic a month, chosen from questions staff have asked, and keeps a list of the topics covered so new staff can catch up during their first week.

3.5 Reporting without blame

Sofia sets up one way to report anything suspicious: forward it to her or tell her at the desk. Dr. Moss tells staff that nobody will be criticised for clicking a link or making a mistake, as long as they report it quickly, because early reports make problems smaller. Within a week, a receptionist reports that she typed her password into a page that looked odd. Sofia resets the password the same morning and checks the account, finding no misuse. Mr. Nowak notes that the second factor would also have blocked a sign-in with that password.

Worked example

Sofia teaches phishing signs, sets a phone-back rule that stops a synthetic invoice fraud attempt, runs ten-minute monthly sessions and gets a quick blame-free report of a typed password.

Synthetic case. Emails and suppliers are synthetic.

Errors and limits

Calling the number in a suspicious message reaches the criminal, not the supplier.

Concepts — sign, channel, and report

A suspicious email is not one trick. Hollybank separates what the message looks like, which channel is allowed to change money, and how a person reports a mistake.

The phone-back rule does not depend on how convincing the writing is. The criminal can copy an invoice number. The criminal cannot answer the telephone at the real supplier. Calling the number printed in the message defeats the rule, because that telephone belongs to the sender of the fraud.

Data — one attempted payment and the training rhythm

Decision flow — a message asks for money or a secret

flowchart TD
  A["A message asks for money, a new account, or a password"] --> B{"Is the request a change of bank details?"}
  B -->|Yes| C["Do not use any number written in the message"]
  C --> D["Phone the supplier on the number already stored"]
  D --> E{"The supplier confirms the change?"}
  E -->|No| F["Pay nothing. Record the attempt. Tell the supplier. Thank the person who called"]
  E -->|Yes| G["A second person approves. Then write the change in the log"]
  B -->|No| H{"Did someone already type a password or open the link?"}
  H -->|Yes| I["Reset the password the same morning and check the account"]
  H -->|No| J["Forward the message to Sofia or say so at the desk"]
  I --> K["No criticism. The fast report is the success"]
  J --> K

Worked example — the laboratory changes its account on a Tuesday

On Tuesday an email quotes a real laboratory invoice and says the laboratory's bank account changes today. The office assistant almost calls the mobile number in the signature. Sofia stops that call. The stored number is the laboratory's accounts desk from last month's statement. The desk says it sent no change. The clinic pays the original account and nothing to the new one. A second person had been ready to approve, and does not approve. Sofia writes the attempt in the change log and thanks the assistant at the next ten-minute session, using the episode as the month's topic.

Synthetic case. The Tuesday message and the laboratory desk are invented. The rule is the same rule as the equipment-supplier episode.

Apply

• EX055 — Tuesday call. Which number may be used, what the second person may approve, and how much is paid before the stored-number call? Rubric: 3 = only the number already stored; the second person approves nothing until that call confirms the change; nothing is paid before the call;; 2 = the stored number and the zero payment;; 1 = one of those;; 0 = none.
• EX056 — Typed password, same morning. List the three actions that follow a quick report of a typed password, and what Dr. Moss has promised. Rubric: 3 = reset that morning, check the account, remember the second factor would block a later sign-in; no criticism because the report was quick;; 2 = reset and check, without the promise;; 1 = one action;; 0 = none.

Exercises

• EX027 — Four signs. Name two phishing signs. Rubric: 3 = mismatched sender, urgency, odd link, password or payment request;; 2 = two;; 1 = one;; 0 = none.
• EX028 — Parcel email. What did the parcel email link to? Rubric: 3 = a lookalike address;; 2 = partly correct;; 1 = other;; 0 = none.
• EX029 — Key habit. What matters more than memorising signs? Rubric: 3 = pausing and checking;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX030 — Bank rule. What is the bank detail change rule? Rubric: 3 = phone a known number, second approval;; 2 = both;; 1 = one;; 0 = none.
• EX031 — Why it works. Why does the phone-back rule stop fraud? Rubric: 3 = the criminal cannot answer the real supplier's phone;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX032 — Fake invoice. Which supplier did the fake email impersonate? Rubric: 3 = the equipment supplier;; 2 = partly correct;; 1 = other;; 0 = none.
• EX033 — Outcome. How much did the clinic pay to the new account? Rubric: 3 = nothing; the request was refused after the call;; 2 = nothing, without saying why;; 1 = wrong;; 0 = no answer.
• EX034 — Training length. How long is each staff session? Rubric: 3 = ten minutes;; 2 = partly correct;; 1 = wrong;; 0 = none.
• EX035 — Topic source. How are monthly topics chosen? Rubric: 3 = from staff questions;; 2 = partly correct;; 1 = other;; 0 = none.
• EX036 — Report route. How do staff report something suspicious? Rubric: 3 = forward to Sofia or tell her;; 2 = partly correct;; 1 = partial;; 0 = none.
• EX037 — Owner's promise. What did Dr. Moss promise staff? Rubric: 3 = no criticism for quick reports;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX038 — Typed password. What did Sofia do about the typed password? Rubric: 3 = reset it and checked the account;; 2 = both;; 1 = one;; 0 = none.

Continue studying — lesson 03 (chapter 03 of 20)

← Chapter 02 · Course chapter index · Chapter 04 →

Continue to the next authored lesson.