ICDL Computer & Online Essentials (ICDL): Fifteen Minutes After the Link Was Clicked

Order by what can cause irreversible loss soonest.

1. Secure the online banking account first. The credential has been exposed for fifteen minutes and money can move instantly. From a different device, change the banking password, enable two-factor authentication if it is not already on, and review recent transactions and payee lists. Ring the bank's fraud line if anything is unfamiliar. The banking password is the only credential in this story that can be converted directly into money.
2. Change the work email password and enable two-factor authentication. It is the same password, and email is the reset channel for everything else. Then check mailbox rules and forwarding settings, and review Sent Items for messages sent as Ravi that he did not write. Attackers commonly leave a hidden forwarding rule rather than acting immediately.
3. Tell IT security now, by phone as well as email. Do not wait for the 11:00 meeting. Security may need to block the sender domain and check whether other staff received the same message; a delay of ninety minutes on a Monday morning is a delay of ninety minutes of exposure.
4. Reach the finance director through a delegate or mobile. The instruction to withhold payment until the supplier is verified must reach whoever can actually release it. A message to a delegate is better than silence.
5. Verify with the supplier using a number from a previous invoice or the contract, never a number in this email. Only this converts the suspicion into a fact.
6. Preserve and report the email as phishing. Do not delete it: it is the evidence for the security team, the bank and possibly the police.

Not warning signs on their own:

• The display name matching exactly. Display names are free text and trivial to forge; a match proves nothing.
• The professional layout and correct-looking branding. These are copied from a real supplier's previous emails in seconds.

Genuine warning signs:

• The domain is northwind-supplies.co, while the real supplier uses northwindsupplies.com. A hyphenated lookalike on a different country suffix is a classic impersonation pattern.
• A password-protected attachment with the password in the body. This is designed to defeat the mail filter's scanning of the file contents; legitimate invoices rarely need it.
• A link to a 'secure portal' that Ravi does not already use. Credential harvesting pages are the point of the exercise.
• Urgency plus a financial penalty for not complying today.
• New bank details arriving by email.

Crucially, none of these is proof. Real suppliers do change banks and do sometimes send protected PDFs. The control that catches this is independent verification by telephone using a number from the contract - and that control should apply to every bank-detail change, however convincing the message looks.

The response would be downgraded but not cancelled. Severity should follow what was actually exposed.

• No credentials entered means no immediate account takeover. Steps 1 and 2, the urgent password changes, would not be justified on this evidence; changing a strong banking password under time pressure is itself a risk if done hastily at the wrong site.
• The PDF still needs reporting. A file opened from an untrusted sender can carry exploits or trick the user into enabling macros. IT should check the machine, and Ravi should confirm whether any prompt appeared or any file was saved.
• The fraud attempt still needs stopping. Steps 3 to 6 stand unchanged: IT blocks the domain, the finance director is told not to pay, the supplier is rung on a known number, and the email is preserved.
• The password reuse is a finding in its own right. Even with no exposure today, Ravi using one password for email and banking should be fixed deliberately, by moving both accounts to unique credentials in a password manager - not in a panic, but not left alone either.