A payment problem needs a clear route to help
The NCSC describes business payment fraud in which criminals impersonate familiar contacts and can ask for money to be sent to a different bank account. Its immediate advice after a suspected fraudulent payment includes telling IT promptly and contacting the bank directly using its official website or phone number.
That gives a UK business a useful question for its next team meeting: would the person who noticed the problem know how to start both conversations? Our proposed exercise below is a rehearsal of your response arrangements, not a promise that a payment can be recovered.
Use a fictional message
Write a short invented scenario: a finance colleague has paid an invoice and now suspects the request to change bank details was false. Use fictional names, amounts and account details. Do not send a simulated malicious email to staff without agreeing the exercise first.
Ask the participants to describe the first call they would make and where they would find the contact details. Include the finance lead and the person responsible for IT support. Let them use the materials they would actually have available, then record what was unclear.
Make the first handover usable
As practical preparation, agree a short incident note covering when the payment was made, which internal record identifies it and who is coordinating the response. Keep sensitive details in the restricted location your organisation uses for incidents. Avoid turning a general team chat into the case file.
Check the route to the bank against its official contact information. Agree who is authorised to speak for the business, and who covers for that person when absent. The exercise should establish those responsibilities rather than assume the IT team can make financial decisions on someone else’s behalf.
End with one repair to the process
If the team spends the exercise searching for a contact or deciding who owns the problem, assign that gap to a named person. Give it a completion date and repeat the relevant step once it is fixed. For example, a fictional retailer might discover that its only documented banking contact is held by someone on leave.
If this is happening for real, follow the NCSC’s immediate reporting advice and your bank’s instructions instead of waiting to finish an exercise. Use the NCSC page for its current incident-reporting route. The practical outcome of the rehearsal is a response path your team has checked, with an owner for anything still missing.
Sources
Practical suggestions in this article are editorial recommendations. The source supports the guidance attributed to it.
- NCSC · Business payment fraud ↗
Checked 26 September 2026
Something needs correcting?
Get in touch to explain which claim needs attention and share the supporting source.