Guide
Spotting rushed payment requests before finance clicks
Practical checks for administration and accounts teams when a message asks for an urgent supplier change.
Many Cape Town offices see payment change requests arrive late on Fridays, when staff want to clear the inbox before weekend plans.
Teach a pause rule: any change to bank details needs a second channel. A known phone number on file beats replying inside the same email thread.
Look for mismatched greetings, odd urgency, and attachments that ask staff to 'enable editing' before numbers appear. Those cues belong in a phishing clinic, not a technical lecture.
Finance leads should keep a one-page escalation list near the desk: who to call in IT, who approves supplier changes, and what to do if someone already clicked.
Our phishing recognition clinic uses printed samples so teams can discuss without opening anything risky on a live machine.