The Voice on the Phone Was Not the MD: Rehearsing an Urgent Payment Scam

It is 3:40 on a Friday. Priya handles finance, admin and supplier calls for a 14-person firm. Her mobile rings. The voice sounds like Mark, the managing director: rushed, a bit crackly, saying he is on a train and cannot get a signal for long. A supplier needs an urgent payment before 5pm. The bank details have changed. There is an email in the shared inbox with the new account information. Can she sort it?

Nothing about that call is unusual in a small team. That is exactly why it works.

This is a tabletop exercise, not a real payment. But run it in a room with the people who answer the phone, approve invoices and ring suppliers, and the gaps show up fast.

Why this scenario belongs in a small-team tabletop

Invoice fraud and voice cloning are not just problems for large finance departments. They are arguably worse for small organisations where one person does several jobs and everyone trusts a familiar voice. A criminal does not need to break into your bank. They need to persuade one person that a payment is normal, urgent and already approved.

A tabletop is a cheap way to rehearse the awkward bit: what do you actually do when the MD sounds like the MD, the email looks like the supplier, and the deadline is real?

Set the scene

You need four or five people and about 30 minutes. One person facilitates. Do not use real bank details or real supplier names. Give the finance person a simple brief: you have a payment run at 4:30pm, the supplier is real, and the request is plausible.

Then add the injects, one at a time.

• Inject 1: A phone call from 'Mark' asking for an urgent payment to a supplier. He says he is on a train and cannot access the finance system.
• Inject 2: An email in the shared inbox from what looks like the supplier's domain, but the domain is one letter off. It attaches a new bank-details letter with a signature that looks right.
• Inject 3: A follow-up call from someone claiming to be the supplier's accounts team, confirming the new details and asking why the payment has not gone out.
• Inject 4: The bank's payment screen shows the account name does not quite match the supplier name. The payment is due in 20 minutes.

Ask the team to talk through what they would do, not what they think the policy says. The difference is the point.

The debrief questions that matter

Start with the human bit. What made the call believable? Was it the voice, the urgency, the fact it was Friday, or the fear of annoying the MD? Then move to process.

• Who is allowed to approve a new payee or a change of bank details?
• What independent number would you use to call the supplier back?
• Would you use the number in the email, the number on the invoice, or the number in your own supplier records?
• Who else needs to know before the payment goes out?
• If the payment had already gone, what would you do in the first hour?

If the answer to the callback question is 'the number on the email', that is a finding. If the answer is 'I would just ring Mark', ask which number, and whether that number came from the caller.

Controls that survive a rushed Friday

Voice cloning makes 'I recognised their voice' a weak control. So does caller ID. The controls that help are boring and procedural, which is why they work.

Dual approval for bank-detail changes

Any change to a supplier's bank details should need two people, one of whom is not the person who received the request. A single finance administrator should not be able to add a new payee and release the payment in the same session.

Out-of-band call-back verification

Call the supplier back using a number you already hold: the contract, a previous statement, or your finance system. Do not use the number in the suspicious email or the number the caller gives you. If you cannot verify, the payment waits. A real supplier will understand. A fraudster will push harder.

A documented bank-detail change process

Use a short form or checklist: who requested the change, how it was verified, who approved it, and when. This is not bureaucracy for its own sake. It gives the person on the phone a reason to say 'I need to run this through our process' instead of feeling awkward.

Payment limits and a cooling-off period

Set a threshold above which payments need a second authorisation. For new payees, consider a short hold. If your bank supports dual authorisation, turn it on. If it does not, use your own two-person rule.

Check the account name against the supplier name

Banks sometimes show a name mismatch warning. Do not click past it. A mismatch is a prompt to stop and verify, not a technical hiccup.

The first hour after a suspicious transfer

The tabletop should not stop at prevention. Walk through the first hour if money has gone out or is about to.

1. Call your bank's fraud team immediately. Use the number on your bank's website or app, not a number from an email. In the UK, 159 connects you to your bank's fraud line if you are unsure.
2. Ask about a payment recall or recall request. Be honest about what happened. Speed matters more than dignity.
3. Preserve evidence: emails, call logs, bank details, timestamps and screenshots. Do not tidy up the inbox.
4. Report it to Action Fraud. If personal data may have been compromised, check your breach-reporting obligations separately.
5. Contact the real supplier through a known number and tell them their name or domain is being used.
6. Check for email compromise. Look for new mailbox rules, forwarding, unusual sign-ins and changed contact details. Reset passwords and turn on multi-factor authentication if it is missing.
7. Notify your cyber insurer according to your policy. Check the notification window and keep a simple timeline. Insurers increasingly ask for evidence of controls, and a tabletop record is useful evidence that you rehearse them.

Make it a habit, not a one-off

Run this once, write down the three gaps you found, and fix one of them before the next quarter. Maybe it is a callback rule. Maybe it is dual approval. Maybe it is simply putting the bank's fraud number on the wall by the phone.

The underdog lesson is not that small teams are naive. It is that small teams are busy, familiar and human. A good tabletop gives people permission to slow down when a voice on the phone says there is no time.