A convincing message becomes a losswhen the workflow trusts it.A convincing message becomes a loss when the workflow trusts it.

The issue to examine

A message can request a bank-detail change, a document transfer or an urgent approval. The relevant question is how the business verifies the instruction before acting. Email controls are only one part of that decision.

Who should consider it

This scenario is relevant wherever staff handle payments or confidential documents. It may be particularly useful to discuss in firms that coordinate instructions between clients, suppliers and professional advisers.

The public guidance context

The NCSC small organisations guide covers email, account protection and recognising scams. We use those foundations as a starting point for a wider discussion of how a business authorises sensitive changes.

A proportionate check

Walk through a fictional change request with the people who process it. Identify the independently known contact details, required approval and escalation route. Agree what happens when urgency or seniority is used to discourage a check.

Confidence and limits

This is an illustrative threat scenario informed by public guidance. It is not a claim about a current campaign, the prevalence of a particular fraud type or the effectiveness of a company’s safeguards. Validate the actual process before making recommendations.

Questions to take to your team

• Which instructions could move money or disclose client information?
• How do staff verify an unexpected change?
• Can someone pause the process without being pressured to proceed?