Illustrative cyber incident scenarios

Learning edition: 5 October 2026. Introductory learning material.

These are hypothetical training scenarios, not verified incidents or Colabmo client case studies. Use invented names and systems when practicing.

Worked example: changed bank details

A familiar supplier emails an invoice with a new bank account and asks for payment today. The finance assistant pauses the payment and calls the supplier using the number already in the approved supplier record. The supplier says it did not request a change. The assistant reports the message through the company process and preserves it using the approved reporting tool. The payment stays on hold while the responsible team investigates.

Why this works: Familiar names and accurate invoice details are insufficient evidence. Independent verification tests the request without relying on contact details supplied by the possible attacker.

Practice discussing a response

• Unavailable records: a clinic cannot access its files after a suspected ransomware event. Who coordinates response, and when was restoration last tested?
• Compromised account: a retailer discovers an unfamiliar sign-in to its payment account. How would it contact its provider through a trusted channel?
• Exposed documents: a professional-services team finds an overly broad sharing link. Who contains access and assesses the information involved?
• Changed payment instructions: a supplier email requests new bank details. How will the team verify the change independently before paying?

Record the escalation owner, first action and evidence to preserve for each scenario. Do not use real customer information in a training exercise.

Reference: CISA small-business resources. Check the source and your system provider’s current instructions before implementation.

Worked example: a convincing voice is not approval

Fictional scenario: A bookkeeper receives a voice message sounding like the owner, followed by a video invitation demanding an urgent confidential payment. The bookkeeper pauses, contacts the owner through the established internal route, and follows the normal payment approval process. No exception is made because the voice sounds familiar.

The lesson is independent verification, not trying to spot visual glitches. Preserve the request using approved reporting procedures. If money has already been sent, contact the bank or payment provider promptly through a trusted channel and escalate internally.

Discuss: What happens if the owner cannot be reached? Record who may approve an exception; the requester cannot invent that authority.

Further reading: FBI: Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud (3 December 2024).