Invoice Fraud BEC Lab
A supplier's "new bank details" email, a payment made, and a phone call 30 hours later: "We never received it." Make the calls — bank first or investigate first, how to warn the supplier, the AP clerk, the insurer — and watch the chance of recovery move with each one.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice.Customise it with your own details for free; exporting the generated document is part of Pro.
Three weeks ago an email from Kestrel Packaging Co. asked Harbourline Freight Ltd to update its bank details. On Tuesday at 08:15 accounts payable paid $148,900 to the new account. On Wednesday at 14:20 — 30 hours later — Kestrel Packaging Co.'s finance manager phones to ask where the money is. You are the incident lead. Every hour now matters.
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
What this template gives you
- Based on the most common BEC pattern: a supplier's mailbox is compromised, a "new bank details" email joins a real invoice thread, and a hidden inbox rule delays discovery.
- Branches change the story: investigating before calling the bank means the money has moved on; replying into the compromised thread nearly causes a second payment.
- Each decision is scored 0–10 with feedback on recovery odds, evidence and insurance.
- Rename the organisation, supplier and amount so the debrief is about you. Free to play; exporting the debrief is part of any PlayCISO plan.
Frequently asked questions
How quickly must a fraudulent payment be reported to the bank?
As fast as possible. Recall chances are best within hours and fall quickly after 24 to 72 hours, because fraudsters move money on from the receiving account. Phone the bank's fraud line first and investigate afterwards.
Should we tell the supplier by email that their mailbox is compromised?
No. If their mailbox is compromised, the attacker reads your email first and may reply pretending everything is fine. Phone the supplier on a number from your own records, such as the contract or an old invoice.
Does cyber insurance cover invoice fraud?
Sometimes, often under a social engineering or funds-transfer fraud extension with a sub-limit and conditions such as call-back verification. Notify promptly and accurately and let the broker advise on the wording. The BEC Insurance Coverage Checker helps you check your policy before it happens.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
Anyone. Using it and customising it with your own details is free, and your work is saved in your own browser. Exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.