The procedures that protect a small business
CEO fraud, bank details change, fake invoice: the encyclopedia's articles and our “business” simulations answer them first with procedures. Here they are, word for word, with a link to the article each comes from. To print and post near the people who make payments.
Transfers and bank details
Write down a dual-approval procedure for any unusual transfer, known to everyone authorized to pay.
Article: Fake wire transfer order (CEO fraud)
Agree that no confidentiality instruction exempts anyone from verification.
Article: Fake wire transfer order (CEO fraud)
Set a written rule: any IBAN change is confirmed by phone, on the number already known.
Article: Fake bank details change
Have changes to bank details approved by a second person.
Article: Fake bank details change
Keep dual approval for transfers, even after a video call.
Article: Deepfake video call
Never treat an image as sufficient proof of identity for a payment.
Article: Deepfake video call
Invoices and suppliers
Pay no invoice without a purchase order or contract bearing a name.
Article: Fake invoice
Keep an up-to-date list of real suppliers and their bank details.
Article: Fake invoice
Have the fine print read before any first payment to a new sender.
Article: Fake invoice
Turn on two-factor authentication for the email accounts that receive invoices.
Article: Fake bank details change
The team
Treat names, roles, procedures and calendars as data, not small talk.
Article: Pretexting (fabricated scenario)
Call back on a known internal number before answering someone new.
Article: Pretexting (fabricated scenario)
Tell newcomers: following the procedure never needs justifying.
Article: Pretexting (fabricated scenario)
When an attempt is detected, warn the other people authorized to pay: they often receive the same one.
Article: Fake wire transfer order (CEO fraud)
Computers, software and backups
Back up regularly to a device you then unplug.
Article: Ransomware
Keep the system and software up to date.
Article: Ransomware
Never plug in a storage device whose owner you don't know.
Article: Baiting
Save a bookmark for every service where you log in or pay.
Article: Fake website
Don't use sponsored results to reach a sensitive service.
Article: Fake website
The scams this checklist defeats
Practice on these scams
Fictional messages, to decide without risk.
- Simulation: BaitingA USB drive is sitting in the lobby, labeled "2026 Payroll."
- Simulation: Fake invoiceAn €89 invoice for renewing a domain name that nobody really recognizes.
- Simulation: RansomwareEvery file on the computer has become unreadable. A message demands a ransom in cryptocurrency.
- Simulation: Fake websiteA search to find your accounting software. The first result isn't the right site.
- Simulation: Pretexting (fabricated scenario)A third, friendly exchange with an auditor. This time they ask for the staff directory.
- Simulation: Extortion following a data breachAfter a confirmed data breach at a provider, a message threatens to publish the information unless a payment is made.
- Simulation: Fake wire transfer order (CEO fraud)Management asks for an urgent, confidential transfer, outside the usual procedure.
- Simulation: Fake bank details changeYour usual supplier announces a change of bank. The invoice itself is identical.
- Simulation: Deepfake video callA short video call with management asks for an urgent, confidential transfer.
Step-by-step guides
- Verify who you are really talking toHow can I be sure the person contacting me is who they claim to be?
- What to do in the hour after a fraudulent paymentI paid a scammer, what do I do now?
- I entered my password on a fake site: what to doI clicked a link and entered my password on a fake page, what do I do?
If it already happened
- The first steps, in order: the emergency checklistThe first steps, in order, depending on what you gave away: money, bank details, a password, access to a device or an account.
- The “I clicked” assistant: the plan of steps for your situationTwo questions — what you did, how it reached you — and the plan of steps to take, in order of urgency. To print or send to someone close. Nothing is stored.
The other checklists
- The checklist for an older relativeFake bank advisor, fake tech support, fake prize, premium-rate text: the reflexes that protect, on one page to print and give to a relative.
- The checklist for your familyA family password, a new number confirmed on the old one, talking about it right away: the rules that protect a family, on one page to print.