Simulateur de fraude au président et de cyberattaques
Decision drills on urgent CEO requests, supplier bank changes, deepfake calls, ransomware, MFA fatigue and vendor breaches, with feedback and the right protocol.
The CEO asks for an urgent transfer
Friday, 5:40 pm. A message arrives from a new number with the CEO's photo.
Never pay on a request from a new number. Confirm through a known channel and require dual approval, even if it seems to come from the CEO.
The vendor changed banks
An email from a regular vendor, with the usual signature, gives a new account for a US$80k payment due tomorrow.
A bank-detail change only counts after a call to a number on file and sign-off by a second person.
The video call with the CFO
You get an invite to a "confidential" video call with the global CFO and other executives. In 2024 the engineering firm Arup lost about US$25 million in a scam like this, with AI-generated fake participants.
Seeing and hearing is no longer proof. Payment requests on calls need confirmation through a known channel and normal approval.
Monday morning, encrypted screens
At 8 am, staff report files with a strange extension and a ransom note demanding crypto.
Isolate, trigger the plan, involve legal and insurer before any ransom decision, and meet notification deadlines.
Login prompts at midnight
Midnight. Your phone gets dozens of login approval prompts for your work email.
An approval prompt you didn't start means your password leaked. Deny, change it, alert security and never share codes by phone.
The vendor was breached
Your payroll vendor says it was attacked and client employee data may have been exposed.
A vendor's incident is also yours. Get details in writing, assess risk and meet notification deadlines.