Free scenario
The transfer cleared. Everything after it is a decision.
A payment fraud tabletop you run yourself, with your own leadership team. The brief and all four injects are on this page. The printable pack adds the notes for whoever runs it, and your email is optional.
What it is
A 3-hour business email compromise exercise for 6 to 12 people, run by somebody inside your company. It is a discussion exercise. No money moves and no live system is touched.
It is not a ransomware exercise with different props. There is no encryption, no outage and no countdown set by an attacker. The money is gone, and the only clock that matters belongs to a bank you do not control. A room that has only rehearsed ransomware reaches for isolate, restore and contain, and none of the three returns a payment.
It is also the more likely incident. In Coalition's 2025 claims data, 58 percent of incidents were email compromise or funds transfer fraud (Coalition, 2026 Cyber Claims Report, 2026), and 39 percent of funds transfer fraud had no confirmed email compromise behind it at all (Coalition, 2026 Cyber Claims Report, 2026). The control that stops this one sits in finance.
Every detail is fiction. Swap the amounts, the supplier and the long weekend for yours.
The short version
Read the brief aloud about fifteen minutes in. Nobody sees it beforehand. Then give the room one inject at a time, at the elapsed times shown. One rule: no solving. The room will want to work out how it happened. Keep asking who decides and by when. Leave the last half hour for a debrief.
The brief read aloud at 0:15
It is 16:40 on the Thursday before a long weekend. Your financial controller takes a call from a supplier asking why last month’s invoice is unpaid. It was paid. She has the confirmation.
She pulls the record. The payment went out on Tuesday, $148,000, to an account that does not match the one on file. The details were changed in June by email, from the supplier’s own domain, with a scanned letter on their letterhead. Your accounts payable clerk verified it by replying to that email and getting a confirmation back.
The thread is still there. The supplier says they never sent it. Two further invoices have gone to the same account since June. The total is $412,000.
Your bank’s commercial line closes at 17:00. Nobody has the relationship manager’s mobile. The person who approved the first payment is on the 17:20 train.
Stop there. Questions only, no solutions. Then start the clock.
-
Inject 1 at 0:25
The control worked exactly as written.
17:05. The clerk has found the thread. The change request came from the supplier’s real domain and her verification reply went to the same address, which is what the procedure told her to do. Her confirmation came back nine minutes later. She mentions, quietly, that two other suppliers changed details this year and she handled both the same way.
The decision it forces. Who owns getting the money back, who owns finding out how, and whether that is the same person.
-
Inject 2 at 0:55
Tomorrow’s payment run is forty-one payments.
17:35. Your bank has the references and will come back Tuesday. The controller asks what to do about the 09:00 run: forty-one payments, $1.9 million, and two of those suppliers changed their details this year. Verifying every one by phone takes a day nobody has before a long weekend.
The decision it forces. Run it, hold it, or split it. Who authorizes that, and what you tell the suppliers who do not get paid.
-
Inject 3 at 1:40
The supplier wants paying. The broker wants a date.
Tuesday, 10:15. The supplier’s finance director calls your chief executive directly, wants the $412,000 and points at the contract. Separately your broker asks two questions: the date you discovered it, and whether it has been reported to the police.
The decision it forces. Whether you pay twice while recovery is unresolved, who answers the broker, and what “discovered” means. Paying again has a number on it, and so does refusing.
-
Inject 4 at 2:10
It stopped being a payment problem on Thursday.
Thursday. The bank recovers $96,000 and the rest is gone. Mailbox forensics show the attacker had read the controller’s email for eleven weeks, including a folder of employee records payroll had sent her. Your finance lead asks whether that changes anything.
The decision it forces. Whether a payment fraud has become a privacy matter, who decides, and who has to be told again having been told it was a finance issue.
What the printable pack adds
Five pages, set for print, free to copy and adapt inside your own organization. Everything on this page, plus the parts written for whoever runs the session:
- Notes on every inject: what to push the room on, and what a good answer sounds like.
- An hour-by-hour guide to the first four hours, held back from the room.
- A reserve inject for a room that moves fast, and when not to use it.
- A capture sheet for the scribe, so decisions and times are written down as they happen.
- Three questions to put to your own bank in the week after.
Keep those pages with whoever runs it. They tell the facilitator what the room is meant to find out for itself.
When to use it, and when it is the wrong thing to reach for
Use it if your finance team can move money on an email, which is nearly every company of this size. It is the right exercise for a room that has already run a ransomware scenario and thinks it is rehearsed, because most of what that room learned does not transfer.
It is the wrong thing to reach for if you want to test your technical response. Nothing here goes down and nothing gets restored. For that, use the ransomware pack. If the incident is at a supplier and you hold none of the facts, use the third-party breach pack.
It does not produce third-party attestation, and page one of the pack says so. The write-up is worth running and worth keeping. It answers the question on an application without evidencing it, because the only person who can attest to an exercise is one who does not work for you.