Sent on request
The transfer cleared. Everything after it is a decision.
A payment fraud tabletop you run yourself, with your own leadership team. Four injects on the clock, one held in reserve, and a clock that belongs to somebody else. This page describes the pack. The file itself goes to a named person.
What it is
Five printed sheets that let somebody inside your company facilitate a 3-hour business email compromise exercise for 6 to 12 people. A supplier's bank details were changed by email months ago, the change passed your real verification step, and three invoices have gone to the wrong account since.
It is not a ransomware exercise with different props. There is no encryption, no outage and no countdown set by an attacker. The money is gone, and the only clock that matters belongs to a bank you do not control. A room that has only rehearsed ransomware reaches for isolate, restore and contain, and none of the three returns a payment. That is the gap this pack is written to find.
It is also the more likely incident. In Coalition's 2025 claims data, 58 percent of incidents were email compromise or funds transfer fraud (Coalition, 2026 Cyber Claims Report, 2026), and 39 percent of funds transfer fraud had no confirmed email compromise behind it at all (Coalition, 2026 Cyber Claims Report, 2026). The control that stops this one sits in finance rather than in the security team.
Every amount, the supplier and the long weekend are fiction and are meant to be swapped for yours. Sheet 2 says which parts of the shape to keep when you do.
What is inside
| Sheet | What it is | What is on it |
|---|---|---|
| 1 | Cover, and before you run it | Why a payment fraud is not a ransomware exercise, what a self-run write-up is worth, who reads which sheet and when, and the one rule. |
| 2 | The brief, and the first four hours | The brief you read aloud at fifteen minutes in, then the facilitator’s scoring table: what has to happen in each of the first four hours of a real recovery attempt, and what stops it happening. Held back, not handed out. |
| 3 | Injects one and two | The control worked exactly as written, then tomorrow’s payment run is forty-one payments. Each card carries what to push for and what you are listening for in the answer. |
| 4 | Injects three and four, and the reserve | The supplier wants paying and the broker wants a date, then the day it stops being a payment problem. Plus one inject held off the clock, with a note on when not to use it. |
| 5 | The capture sheet, and what to ask your bank | Four rows for the scribe, including a column for elapsed time that cannot be reconstructed afterwards. Then three questions to put to your own bank in the week after, which is where the best finding usually comes from. |
| The decision | What it puts in front of the room |
|---|---|
| 1. Who owns recovery | Recovery and investigation want the same person. Two names and two workstreams, or one person doing neither properly. |
| 2. Tomorrow’s payment run | Forty-one payments due at nine in the morning, two of them to suppliers who changed their details this year. Run it, hold it or split it, and who is reachable tonight to say so. |
| 3. The supplier and the date | Whether you pay twice while recovery is unresolved, who answers the broker, and what the word "discovered" means when three different dates would each be defensible. |
| 4. Privacy or finance | The mailbox was read for eleven weeks and it held employee records. Whether a payment fraud has become a privacy matter, and who has to be told again having been told it was a finance issue. |
One thing the pack deliberately does not tell you is how long a recall window is. No sourced Canadian figure exists, so rather than print a number, the pack has the room write down what it believed during the exercise and check that with your own bank afterwards. The gap between the two is usually the most useful finding of the session, and you cannot get it any other way.
When to use it, and when it is the wrong thing to reach for
Use it if your finance team can move money on an email, which is nearly every company of this size. It is the right exercise for a room that has already run a ransomware scenario and thinks it is rehearsed, because most of what that room learned does not transfer.
It is the wrong thing to reach for if you want to test your technical response. Nothing here goes down and nothing gets restored. For that, use the ransomware pack. If the incident is at a supplier and you hold none of the facts, use the third-party breach pack.
It does not produce third-party attestation, and page one of the pack says so. The write-up is worth running and worth keeping. It answers the question on an application without evidencing it, because the only person who can attest to an exercise is one who does not work for you.
Why it is not on this page in full
Because the first-four-hours table on sheet 2 is the facilitator's scoring sheet, and both inject sheets are read by one person and nobody else. The scoring table tells the facilitator what ought to happen in each hour and what will stop it, before the room has had a chance to get any of it wrong. Publishing that would mean the first person in your company to find this page has read the marking scheme.
So the pack goes to one person by email, and the rest of the session is theirs to run. One email address, and the file is on the next page rather than in your inbox.