Two Signatures, One Phone Call: Running a Supplier Fraud Drill in Under an Hour

Why rehearse something so obvious

Everyone in a small finance team can recite the rule: verify bank changes by calling a known number. Almost nobody has tested whether the rule survives contact with a Friday afternoon, a director on a train, and an invoice that was already late.

Invoice fraud is not a technology failure. It is a process failure that occurs in the gap between what the policy says and what the person at the desk actually does when the pressure arrives. The cheapest way to find that gap is a tabletop exercise: no systems, no real money, no blame — just a facilitator, four people and 45 minutes.

Set the room up

You need four roles and one facilitator. In a team of eight people, some will double up.

• Finance Manager — owns the payment run and the approval matrix.
• Purchase Ledger Clerk — receives and processes the invoice.
• Approver — a director or senior manager with bank authorisation rights.
• Incident Lead — whoever would handle the banking call and the insurer.

The facilitator reads each inject aloud and then stops talking. The single most useful discipline in a drill is silence: let the team talk themselves into the problem. Keep a flip chart for two columns — what we did and what we could not do.

Inject one: the bank-detail change (minutes 5 to 20)

Read this out.

An email arrives at 09:40 from [email protected], a supplier you have used for two years. It says the company has moved to a new bank following its acquisition by a group, and provides a PDF letter on supplier letterhead confirming new sort code and account number. It references invoice HF-4471, £14,860, due this Friday. The email signature matches previous correspondence. Nobody on the team recognises the sender's name.

The team will now walk through their real process. Push them on specifics with three questions.

1. Which number are you calling, and where did you get it? If the answer is the number in the email signature, the control has failed before it started. The callback must use a number from the purchase ledger record or the supplier's own website — never from the message.
2. What does your bank's Confirmation of Payee check return? A name mismatch or a "partial match" is a stop signal, not a note in the file. Ask who has authority to override a mismatch, and whether that override is written down.
3. Who can change the bank details in the accounting system, and who approves the change? If the same person can amend the supplier record and release the payment, you have found the gap this exercise exists to find.

Note the elapsed time. If the team cannot describe a verified callback path in under ten minutes, the invoice would have been paid.

Inject two: the urgent director (minutes 22 to 35)

Read this out.

At 15:10, the clerk receives a message on a mobile number that appears to belong to the Managing Director. It reads: "I'm with the bank in Leeds until 6, can't get to email. Hardy's payment needs to go today or we lose the discount. Push it through, I'll sign it off tonight." The number is not one stored in the clerk's contacts, but the tone is familiar.

The pressure here is authority, not technology. Let the team respond, then probe.

• Does the approver's authority survive being requested out-of-band? Policy should say that approval given by personal messaging, verbally, or from an unknown number does not constitute approval for a payment — regardless of who appears to be asking.
• Is there a second-person rule on the payment run? Two separate individuals, two separate credentials, and no ability for either to complete both steps alone. Test it verbally: ask the clerk who the second person would be today, at 15:10, on a Friday.
• What does the clerk say in the moment? Rehearsing a single sentence — "I'll need to call you back on your office line before I release anything" — is worth more than a page of policy.

Debrief and the evidence question (minutes 35 to 45)

Before closing, cover the aftermath, because this is where small firms lose money twice.

• Evidence. Preserve the fraudulent email with full headers, the PDF, the messaging thread and the system audit log of any supplier-record change. Do not delete the mailbox. Screenshots are not a substitute for the original.
• Banking. Same-day recall requests are worth attempting immediately: Faster Payments and CHAPS recalls both exist, with no guarantee. Report to Action Fraud and obtain the reference.
• Insurance. Read the notification clause before you need it. Cyber and crime policies typically impose a notification window — often 24 to 72 hours from discovery — and many require consent before you appoint your own IT or legal response. Several crime policies cover social engineering only where the extension is explicitly purchased.
• Reimbursement expectations. The Payment Systems Regulator's mandatory reimbursement rules protect consumers and micro-enterprises, not the generality of SMEs. For most companies reading this, recovery depends on the bank's own processes and the firm's insurance position. Assume the money is gone and plan accordingly.

Turn the gaps into five testable rules

The output of the drill is not a report. It is a short runbook with owners and test dates. Five rules cover most of what a first exercise will surface.

1. Any change to supplier bank details requires a callback to a number held in the master record, documented with the name of the person spoken to and the time.
2. A Confirmation of Payee mismatch stops the payment. Override requires the Finance Manager and one director, recorded in writing.
3. No payment is released without two authorised individuals using separate credentials.
4. Approval requests by personal message, unknown number or voice call are declined and logged. The phrase to use is agreed in advance.
5. On discovery, preserve evidence, attempt recall, notify the insurer within the policy window, and report to Action Fraud.

Give each rule an owner and a next test date. Then diarise the next drill for six months' time and change the supplier name, the amount and the pretext. The second run is where you learn whether the fix was real.

The 45-minute version

Five minutes to brief, fifteen on the bank change, thirteen on the director, ten on aftermath and evidence, two to agree the rules. It fits inside a lunch break, costs nothing, and will tell you more about your payment controls than any policy document you could write this quarter.