The Invoice That Wasn't
You are the office administrator for a 60-person engineering firm. At 9:10 am the shared accounts inbox receives an email that appears to come from a regular stationery supplier, using the supplier's logo and a genuine-looking previous thread. The message says the supplier's bank details have changed and asks for the next invoice to be paid to a new account. A colleague has already opened the email, forwarded it to the accounts payable officer with the note 'please update,' and clicked the link to view the 'new invoice.' At 9:20 you receive a multi-factor authentication prompt you did not request. You also learn that a temporary worker was given 'full access' to the shared drive last week, including the HR and payroll folders. The accounts payable officer is about to process a payment run at 11:00.
1. What are your first actions in the next 30 minutes?
Read the worked answer
Treat this as an active security incident, not an email problem. My sequence:
- Stop the payment. Phone the accounts payable officer now - do not email, because the mailbox may be compromised - and ask them to hold the 11:00 run and not to update any bank details. Follow with a written message so there is a record.
- Report to IT/security immediately and mention the unsolicited MFA prompt at 9:20. That prompt suggests someone is trying to use your credentials, so change your password from a known-safe device and check active sessions and mailbox rules.
- Preserve, don't delete. Keep the phishing email, the forward and the link in place for investigation; do not click further or forward the link to colleagues. Ask your colleague what they entered after clicking, and whether they reused a password.
- Verify by a known channel. Call the supplier on a number from the contract or website, not from the email, and ask whether their bank details have changed.
- Warn the finance team briefly and factually, and tell them not to act on bank-change emails without call-back verification.
The reason for speed is the payment run: once money leaves, recovery is slow and uncertain. Password and MFA issues come next because they affect your own account and possibly the shared inbox.
2. How do you deal with the temporary worker's full access to HR and payroll folders?
Read the worked answer
This is a separate access-control incident and should be handled in parallel, not ignored because the phishing email is louder. The temp almost certainly does not need HR and payroll files to do their job, so the access should be reduced to least privilege immediately. Ask IT or the system owner to suspend or narrow the account, then review what was accessed and downloaded during the week. Notify the HR lead and the privacy officer, because payroll and HR data are sensitive and an access review may be required.
Do not confront the temp as though they were a suspect. The likely cause is that someone granted 'full access' because it was quicker than setting up a scoped folder. Ask the temp's supervisor what the role actually requires, and rebuild permissions around that. Check whether the shared drive's permission structure allows broad access by default; if it does, that is the root cause and should be fixed before the next temporary hire.
Document the grant, who approved it, when it was removed and what the access logs show. If there is no logging, say so - that gap matters for the review. The two incidents may be unrelated, but handling both promptly shows that access and email security are being taken seriously.
3. What would you communicate internally and to the supplier, and what would you avoid?
Read the worked answer
Internally, send a short alert to staff: a fraudulent bank-change email is circulating, do not act on it, verify any change by phone using a known number, and report suspicious messages to IT. Do not name or blame the colleague who clicked - blame reduces reporting, and the firm needs people to report mistakes quickly. Tell the finance team the payment run is on hold until verification is complete.
To the supplier, use a known contact number and say that an email claiming to change their bank details has been received and is being treated as fraudulent. Ask them to confirm their account details through a signed document or a call-back to a known contact. Do not reply to the suspicious email, do not use the contact details in it, and do not forward the link.
Avoid three things: forwarding the phishing email with the live link to 'warn' people, deleting it before IT can investigate, and processing any payment to the new account without independent verification. If a payment has already gone out, tell IT, finance and the bank immediately so a recall can be attempted. Keep a timeline of who was told what and when, because the incident review will ask.