Pause, check, call back

Most scams that reach a workplace share a shape. Someone you trust, or someone who sounds like them, asks for something valuable and says it cannot wait. It might be a wire transfer, a new bank account for a supplier, a stack of gift cards, a password reset or the six-digit code that just landed on your phone.

The details change constantly. The shape barely changes at all, which is why one simple rule handles most of it: pause, check, call back.

Why urgent requests deserve a rule

Business email compromise, where criminals pose as a colleague, boss or supplier to redirect money, remains one of the costliest crimes reported to the FBI. The FBI's 2025 Internet Crime Report lists 24,768 business email compromise complaints in 2025 with reported losses of about $3.05 billion, second only to investment fraud.

AI is making the requests more convincing. The same report notes that chat tools can quickly produce official-sounding emails that mimic a CEO, that voice cloning can be used to request wire payments, and that businesses reported more than $30 million in 2025 losses to business email compromise involving AI. The report also says plainly that not all of these scams are AI-enabled. That is useful to remember: the rule below works whether the request was written by a person or a machine.

The most famous example is from early 2024. A finance worker at the engineering firm Arup in Hong Kong joined a video call with what looked and sounded like the company's chief financial officer and other colleagues. All of them were deepfakes. According to CNN's May 2024 report, citing Hong Kong police, the worker sent HK$200 million (about US$25.6 million) across 15 transactions. Notably, he had first suspected the original message was phishing. The video call is what put his doubts to rest.

That detail matters, because seeing a face or hearing a voice is no longer enough on its own. What works is a check through a channel you control.

The rule, step by step

1. Pause. Urgency is the scammer's main tool. UK Finance's Take Five to Stop Fraud campaign makes this its first step: stop and take a moment before you send money or share information. A real request will survive a 10-minute delay. A fake one usually falls apart.

2. Check. Ask yourself whether this request matches how things normally work. The UK National Cyber Security Centre's phishing guidance recommends that employees know how key processes such as payments usually happen, so unusual requests stand out. Look closely at the sender's actual address, too. The FBI's business email compromise guidance suggests setting your email to show full addresses rather than display names, especially on a phone.

3. Call back. Confirm the request through a second channel that you choose, using contact details you already had. The NCSC recommends that all important email requests be verified using a second type of communication, such as a phone call. CISA's guidance on social engineering (now archived, but still sound) says to use contact details from previous records rather than any provided in the request. The FBI's May 2025 warning about AI voice messages impersonating senior officials gives the same advice: find the person's number independently and call them.

The key word is back. Do not reply to the email, do not call the number in the signature and do not use the link in the text. Start a fresh contact from your own address book, your company directory or a number printed on a card or official website.

What counts as an urgent request

Use the rule whenever a message combines pressure with any of these:

• Money: wire transfers, new or changed bank details, early or unusual payments, invoices from a "new account."

• Gift cards: the FTC is blunt that no real business or government agency will ever tell you to buy a gift card to pay them. A boss asking you to buy cards for a customer and send the numbers fits the same pattern.

• Credentials: passwords, password resets, requests to "verify your account."

• Login codes: one-time codes and MFA prompts. The FBI's May 2025 announcement advises never sharing a two-factor code with anyone by email, text or messaging app. A real IT team does not need your code.

• Data: customer lists, payroll files, tax forms, employee records.

• Secrecy: "keep this between us" or "don't loop in finance." Secrecy is a request too, and a big warning sign.

Your one-page team card

Copy this, print it and stick it near anyone who approves payments or resets accounts.

Pause, check, call back

If a request is urgent and involves money, gift cards, passwords, login codes, data or secrecy:

1. Pause. Nothing real is ruined by a 10-minute check.

2. Check. Is this how we normally do it? Is the sender's real address right?

3. Call back on a number you already have: directory, saved contact or official website. Never the number, link or reply address in the message.

4. Never share a one-time code or MFA approval. Ever.

5. No gift cards for work payments. Ever.

6. Two people sign off on new or changed bank details.

7. Not sure? Ask. Forward it to IT or security. You will never get in trouble for checking.

If you already sent money or a code: tell IT and finance right away, then call the bank on its official number.

Adjust step 6 to fit your size. In a five-person company, the second person might be the owner. What matters is that no single message can move money on its own.

When something gets through

Even good teams get caught sometimes. Speed is what counts next. The NCSC's guidance on business payment fraud says to tell your IT contact immediately and to call your bank using the number on its official website. In the U.S., report it to the FBI at ic3.gov as quickly as possible. The FBI's 2025 report describes a case from April 2025 where a $6 million wire sent by a city government office in Oregon was recalled after the bank confirmed the instructions were fraudulent. Fast reporting does not always recover money, but it gives everyone the best chance.

Then make reporting easy. The NCSC is clear on this point: "Avoid creating a punishment or blame-oriented culture around phishing." People who feel safe admitting a mistake report it in minutes. People who fear blame wait, and waiting is what turns a recoverable loss into a permanent one.

Finally, practice. Run a short drill: send a harmless "urgent" request from a manager's name and see who pauses and calls back. Celebrate the people who check, and walk everyone else through the card. A rule that has been rehearsed is a rule people use under pressure.

Sources

• FBI Internet Crime Complaint Center, "2025 IC3 Annual Report," April 2026: 2025 Internet Crime Report (PDF)

• FBI Internet Crime Complaint Center, "Business Email Compromise," undated: IC3 BEC guidance

• FBI Internet Crime Complaint Center, "Senior US Officials Impersonated in Malicious Messaging Campaign," May 15, 2025: PSA I-051525-PSA

• CNN, "British engineering giant Arup revealed as $25 million deepfake scam victim," May 16, 2024: CNN report

• UK National Cyber Security Centre, "Phishing attacks: defending your organisation," reviewed Feb. 13, 2024: NCSC phishing guidance

• UK National Cyber Security Centre, "Business payment fraud," undated: NCSC business payment fraud

• CISA, "Avoiding Social Engineering and Phishing Attacks," Feb. 1, 2021 (archived): CISA guidance

• Federal Trade Commission, "Avoiding and Reporting Gift Card Scams," July 2023: FTC consumer advice

• UK Finance, "Take Five to Stop Fraud," undated: Take Five campaign

Or let NimBot handle it

Print the card, run one drill this month and you have a rule your team will actually use. You can do all of this yourself, and it works. If you'd rather not run it alone, NimBot handles the training, the drills and the reminders for your whole team. Try it at app.nim.bot.