Would your team release this payment?

A free discussion sample for finance and IT. Allow about ten minutes. No signup is required to read it. All names, messages and amounts below are fictional.

09:17. A genuine invoice. Different bank details.

Accounts payable has a USD 48,000 invoice from Alder Supply. It is due at 11:00. The payment is still pending, and the usual release window is 09:30.

“Please use the revised beneficiary details on the attached instruction for today’s invoice. The invoice total is unchanged. Please reply here if anything is needed.”

The message appears in an existing supplier email thread. The established supplier contact, whose number is already on file, is unavailable until 10:05. The primary approver cannot be reached until 10:30. Nobody has yet established who may approve an exception. Operations says late payment could delay a delivery, but has no confirmation of a stop.

This is a discussion exercise. Describe decisions only. Do not change real payments, contact a real supplier or enter banking details here.

Make a decision before opening the example.

Discuss these five questions with a finance and IT colleague. Write your answers in your own notes, using role names.

1. What happens to this payment at 09:30?
2. Who owns that decision, and which authority permits it?
3. How will independent verification happen, and who owns it?
4. What remains unknown or disputed?
5. What time or new evidence will trigger another decision?

“We would verify” leaves several questions unanswered. Ask the group to name the owner, the established contact route, the temporary payment position and the next review point.

Open a fictional decision record

Temporary position: the team proposes holding the USD 48,000 payment while it establishes authority and independent verification. The exercise does not establish that participants can actually apply a hold.

Owner: the Financial Controller coordinates the hold decision and escalation. Accounts payable owns the callback to the contact already on file at 10:05.

Basis: the invoice is genuine; the changed beneficiary instruction is unverified. The existing email thread is not treated as independent confirmation.

Unresolved: the procedure brought to the discussion does not identify deputy release authority. Operations has not confirmed a delivery stop.

Review: reassess at the callback, on new evidence or at 10:30 with the primary approver. Do not infer release approval merely because a contact returns.

This is one fictional response, not a universal answer key. Your organisation’s authority, procedures and facts determine its decisions.

Turn the discussion into a useful finding.

Observation: participants named a hold owner but could not identify documented deputy release authority.

Evidence reference: the opening decision and the delegation procedure discussed in the session.

Possible consequence: a legitimate payment could be delayed, or someone could act outside understood authority. Neither happened on a live system in this exercise.

Action: clarify hold, release and exception authority, including deputy cover. Assign a real owner, deadline and reviewer.

Closure requirement: an approved delegation entry and a repeat rehearsal in which the deputy identifies the permitted decision and verification record. The action stays open until actual evidence is supplied and reviewed.

Continue with the full rehearsal.

The T-ZERO Email Fraud Exercise continues through four decision gates: payment authority, finance–IT coordination, wider payment exposure and conditional resumption.

One local workspace carries your entries from preparation through the decision log, management report and action follow-up. It includes a separate participant display, a loadable fictional example and optional Word, PowerPoint, Excel and PDF materials.

Explore the full Email Fraud Exercise →

Your own facilitator leads the discussion. Allow roughly one hour for the full session and debrief, plus preparation and sponsor review. This is a planning estimate. The exercise does not assess live controls or certify compliance.

Background: FBI IC3 guidance on business email compromise. This original fictional sample is not endorsed by the referenced organisation. Product support: hello@t-zero.cc.