Supplier payment · Email compromise
The bank details changed
An urgent supplier email lands just before a payment run. Practice how your team checks, pauses and communicates when the story starts changing.
20 minutes suggested · Four incident updates · One shared screen
Start this rehearsal →Watch the quick field guide
24-second visual guide · captions and transcript · no autoplay
Read the guidance transcript
Name what is affected. Read the fictional alert. Identify the business impact and what is still unknown; avoid jumping to a diagnosis.
Pick the next move. Compare recovery and communication options. Each choice changes the exercise narrative, not a real system.
Keep the room aligned. Use the timeline and decision log to agree one coordinator, one update and the next checkpoint.
Close the loop. Capture recovery assumptions and assign follow-up actions. Export the report so the learning outlives the meeting.
Who should be in the room?
Facilitator, Finance, Team lead, IT or support. These are discussion roles, not account invitations. One person records while the team talks.
What the team will practice
A familiar name. A new bank account.
The invoice amount looks familiar. The email asks you to use a new bank account today. No payment has been made in this exercise.
Discussion: What would you do before anyone changes the supplier record or releases payment?
The pressure turns up
A colleague is worried about a real business deadline. The person who normally approves supplier changes is away.
Discussion: Who can decide on an exception, and what information would they need?
Two different stories
Your known supplier contact contradicts the email. You still do not know whether anyone else in your team received or acted on it.
Discussion: How will you find out what happened internally without spreading the suspicious message further?
Someone needs an answer
The immediate payment is paused in this fictional scenario. You need to communicate uncertainty and agree how supplier changes will be handled next time.
Discussion: What would your team say now, and what should change after today's rehearsal?
What you’ll leave with
Your own recorded decisions, uncertainties and improvement actions with owners, dates and status. Print a readable report or export a browser-local session to revisit.
Original fictional content, not a technical response procedure. No real systems are changed. This exercise does not certify security readiness or compliance.
Read the facilitator guide →