OpenCyber AcademyVendor invoice fraud
A finance mailbox receives a plausible request to replace the bank account for a critical supplier hours before payment.
Fictional training scenario; no real system or person is described.
Safety and authority boundary
Do not change payment details from the email; verify with a known independent supplier contact and preserve financial records.
Preparation
GV · ID · PRA finance mailbox receives a plausible request to replace the bank account for a critical supplier hours before payment.
Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.
Reveal the worked team response
| Team | What | How | Why |
|---|---|---|---|
| Delta Evidence team | Prepared an evidence route | Named read-only sources and custodians for: The sender address resembles the supplier's domain, but the reply-to differs; an employee already opened the attachment. | The first alert needs a verifiable provenance and time. |
| Elm Service team | Rehearsed safe continuity | Tested an isolated version of: Release payment only after dual approval and callback to the pre-existing supplier contact; reset compromised access if confirmed. | A rushed recovery can worsen the service impact. |
| Faro Decision team | Set authority and escalation | Assigned owners and approval conditions around: Do not change payment details from the email; verify with a known independent supplier contact and preserve financial records. | Safety, privacy and communications need accountable decisions. |
Detection and analysis
DEThe sender address resembles the supplier's domain, but the reply-to differs; an employee already opened the attachment.
Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.
Reveal the worked team response
| Team | What | How | Why |
|---|---|---|---|
| Delta Evidence team | Triaged the signal | Preserved source, UTC time and a second independent check for: The sender address resembles the supplier's domain, but the reply-to differs; an employee already opened the attachment. | One alert is a lead, not proof of cause or scope. |
| Elm Service team | Measured user impact | Compared the actual service with the scenario baseline: A finance mailbox receives a plausible request to replace the bank account for a critical supplier hours before payment. | Technical alerts alone do not establish operational impact. |
| Faro Decision team | Declared a bounded case | Recorded confirmed facts, unknowns, owner and next review time. | The teams can coordinate without overstating the evidence. |
Response and containment
RSDo not change payment details from the email; verify with a known independent supplier contact and preserve financial records.
Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.
Reveal the worked team response
| Team | What | How | Why |
|---|---|---|---|
| Delta Evidence team | Preserved and scoped evidence | Saved the original records and defined a bounded path for: Freeze the proposed bank-detail change, preserve headers and attachment safely, and review access to the affected mailbox. | Containment must not destroy the basis for later review. |
| Elm Service team | Applied the approved control | Implemented: Freeze the proposed bank-detail change, preserve headers and attachment safely, and review access to the affected mailbox. | A reversible, owner-approved change reduces harm without expanding scope. |
| Faro Decision team | Authorized and communicated | Logged the approver, affected users and constraint: Do not change payment details from the email; verify with a known independent supplier contact and preserve financial records. | Response actions need clear authority and proportional notice. |
Recovery
RCRelease payment only after dual approval and callback to the pre-existing supplier contact; reset compromised access if confirmed.
Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.
Reveal the worked team response
| Team | What | How | Why |
|---|---|---|---|
| Delta Evidence team | Checked for persistence | Compared new telemetry against: The supplier confirms the account through the independent channel and the payment register shows the approved destination. | An apparently healthy service can still be compromised. |
| Elm Service team | Restored in stages | Executed: Release payment only after dual approval and callback to the pre-existing supplier contact; reset compromised access if confirmed. | A staged return tests dependencies before widening access. |
| Faro Decision team | Accepted the business outcome | Requested owner sign-off only after: The supplier confirms the account through the independent channel and the payment register shows the approved destination. | Recovery is a service decision, not merely a green dashboard. |
Improvement
ID.IMAdd callback and dual-control drills to the payment-change procedure.
Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.
Reveal the worked team response
| Team | What | How | Why |
|---|---|---|---|
| Delta Evidence team | Turned uncertainty into a test | Documented the evidence gap and proposed: Add callback and dual-control drills to the payment-change procedure. | A lesson needs a measurable future check. |
| Elm Service team | Rehearsed the changed control | Assigned an owner and date to test: Add callback and dual-control drills to the payment-change procedure. | An untested action item is not a verified improvement. |
| Faro Decision team | Closed the decision record | Approved resources, tracked the owner and checked the new control later. | Learning must feed Govern, Identify and Protect. |
Recovery acceptance test
The supplier confirms the account through the independent channel and the payment register shows the approved destination.
Improvement to verify
Add callback and dual-control drills to the payment-change procedure.