Your finance assistant spots the suspicious email.
They do not click anything. They do not send money. They forward it to their manager and ask, “Can you check this?”
The manager is away.
The message sits unanswered. Meanwhile, another colleague receives a follow-up and starts preparing the payment.
Did your team pass the fraud test?
This illustrative scenario shows why a useful drill needs to test more than whether someone recognises a suspicious message. It should reveal what happens after they notice something wrong.
Who receives the report? Who can pause the payment? What happens when the usual decision-maker is unavailable?
A fraud drill gives your team a chance to practise those decisions before real money is involved.
Begin with one question
For your first exercise, choose a specific business process.
For example:
“Would we independently verify a supplier’s changed bank details before updating their record or making a payment?”
That question is more useful than “Can our staff spot scams?” It gives you a clear sequence to observe and a concrete outcome to review.
A drill does not need a complicated fake website or a surprise email campaign. Start with a tabletop exercise: gather the relevant people, show them a fictional scenario and ask them to walk through their response.
The NCSC’s Exercise in a Box provides resources for organisations to practise their response to cyber incidents, including phishing scenarios.
Step 1: Choose a situation your team recognises
Imagine a small catering company preparing for a weekend event.
Its regular equipment supplier appears to send an email about an outstanding invoice. The message says the supplier has changed bank accounts and asks the company to use the new details.
The invoice amount matches what the team expected. The delivery date is correct.
There is no strange attachment to open and no password to enter. The requested action is simply to change where the money goes.
This is a fictional exercise. Its purpose is to test whether familiar details could lead someone to skip independent verification.
Use a situation that fits your business: a venue deposit, a software renewal, a contractor invoice or a delivery payment.
Step 2: Set the boundaries
Agree who will run the exercise and which process it will cover.
For a first tabletop drill, include someone who prepares payments, someone who approves them and whoever handles suspicious-email reports. In a small business, those responsibilities may overlap.
Keep the exercise separate from live banking. Use fictional supplier records and non-functional account placeholders. Do not move money, collect passwords or contact real suppliers as part of the simulation.
Tell participants they are practising the process. You can still learn a great deal by asking them to demonstrate where they would find information and whom they would contact.
Step 3: Show the request and ask for the next action
Present a short exercise message:
“Please use our updated bank details for the outstanding equipment invoice. We need payment confirmed today to keep Friday’s delivery.”
Ask each participant:
“What would you do next?”
Let them answer before explaining the warning signs.
Would they compare the amount with the purchase order? Update the supplier record? Ask a manager? Call the supplier?
Then ask a more revealing question:
“Where would you get the supplier’s phone number?”
A number taken from the same unverified message does not provide an independent check. The exercise should establish whether the team can find a previously verified contact in its existing records.
Step 4: Introduce one realistic complication
Once the team explains its normal approach, add a complication:
“The person who usually approves supplier changes is unavailable.”
Ask what happens now.
Can someone else authorise a pause? Is there a named backup? Does the team know that a delivery deadline does not remove the verification requirement?
Avoid piling on endless twists. One realistic complication is enough to reveal whether the process depends on a single person or an unwritten assumption.
For the catering company, the useful discovery might be that everyone knows they should call the supplier, but only one employee knows where the verified contact details are stored.
That is a process problem you can fix.
Step 5: Follow the report to its destination
Do not stop when someone says, “I would report it.”
Ask them to show how.
Which inbox, button or phone number would they use? Who receives that report? Who covers absences? How would the payment team learn that the request is under review?
A report needs an owner and a next action.
You may discover that staff can identify suspicious messages, but the reporting route leads to an inbox nobody checks regularly. Or that finance assumes IT will stop the payment while IT assumes finance has already done so.
Write down those gaps without attaching blame.
The NCSC advises organisations to avoid a punishment-oriented culture around phishing and to make staff comfortable reporting concerns.
Step 6: Measure the actions that matter
For this drill, record whether the team:
- Paused the bank-detail change and related payment.
- Found a previously verified supplier contact.
- Explained how it would confirm and document the change.
- Reached the correct internal reporting contact.
- Identified who could act when the usual approver was away.
- Kept the normal payment approval requirements in place.
If you measure response time, use it to find delays in the process. Do not turn the exercise into a race that rewards rushed checks.
Someone opening an email tells you little about whether your payment controls would hold. Follow the decision through to the point where money would leave the business.
Step 7: Debrief and fix one concrete gap
Ask three questions immediately after the exercise:
“What made the request believable?”
“What made the safe response difficult?”
“What should we change before the next drill?”
Choose a specific improvement, assign an owner and agree a completion date.
For example:
“Move verified supplier contacts into the shared supplier register and give both payment approvers access.”
Or:
“Name a backup for suspicious-payment reports when the finance lead is unavailable.”
“Be more careful” is not a useful action. A clearer contact list, an accessible reporting route or an explicit approval responsibility gives people something they can use.
Repeat the drill after the change
Run a similar scenario once the fix is in place.
Change the supplier or invoice context, but test the same control. Can the team now find the verified contact? Does someone acknowledge the report? Is the payment paused while the request is checked?
That comparison tells you whether the improvement helped.
Passing one exercise does not prove that every future scam will be stopped. It does give you evidence about how your team handled the process you tested.
Before your next payment run, ask:
“If someone spotted a suspicious request today, could they get the payment paused without waiting for one particular person?”
That is a useful place to start.
Explore SO Mail at soemailsecurity.com.
Available on iOS and Google Play.