The invoice was expected. The supplier had delivered, the amount was right, and the email arrived with the familiar sender name. At the bottom were the same sign-off and contact details as usual. Only the bank details had changed. A short note explained this, politely and without making a fuss.<\/p>\n\n\n
The employee in accounts prepared the payment. Then that one sentence made her pause. Had the supplier already mentioned the change? She could not remember. She had wanted to finish before lunch. Instead, she called the telephone number already held on file.<\/p>\n\n\n
\u201cNew bank details? No,\u201d her contact said. \u201cOurs are still the same.\u201d<\/p>\n\n\n
When people think of a suspicious email, they often picture strange wording, an unknown sender or an offer that sounds far too good. That makes the judgement comfortably simple: of course we would recognise something like that ourselves.<\/p>\n\n\n
It becomes harder when a message fits exactly with what we are doing. An invoice after a delivery. A file during a shared project. A reply we have been waiting for. We do not have to explain why the message has arrived. The reason is already there.<\/p>\n\n\n
Familiar presentation is reassuring too. We recognise a name, a logo and an established process. What we do not yet know is whether the message really comes from the person we think is behind it.<\/p>\n\n\n
Appearance alone cannot reliably tell us that. Yet in everyday life, we often treat familiarity as confirmation. Most of the time, it gets us through the day quite well. That is exactly what makes these situations difficult.<\/p>\n\n\n
In our story, the invoice itself looked unremarkable. The crucial change was tucked into a short note. Differences like these deserve a second look: another bank account, a new way of sending information, a request to skip a normal check just this once.<\/p>\n\n\n
That does not mean every change is an attempt at fraud. Companies do change their bank details. Colleagues cover for one another and procedures change. Treating every difference as an attack makes working together unnecessarily difficult.<\/p>\n\n\n
What helps is a clear agreement about which changes require independent confirmation. The decision then does not depend on whether someone happens to have an uneasy feeling. New bank details are checked through a contact already known to the company. That is part of the procedure, even when the email looks entirely convincing.<\/p>\n\n\n
This is where a technical subject becomes a question of how work is organised. The employee needs to know that she is allowed to take time to check. Even when a payment is urgent or someone is waiting for the task to be finished.<\/p>\n\n\n
If training says \u201cPlease check carefully\u201d, while every delay in daily work requires an explanation, there is a contradiction. Employees are then left to resolve it themselves.<\/p>\n\n\n
I think a safe process should make this decision easier. Someone checking what company rules say should be checked needs no further justification. A quick call is part of the job.<\/p>\n\n\n
The information needed must also be easy to find. Where is the known contact? Who can confirm the change? Whom do I contact internally if something does not add up?<\/p>\n\n\n
Perhaps the discrepancy is only spotted after the payment has been initiated. A practical question is then quickly joined by a personal one: \u201cHow could I have let that happen?\u201d<\/p>\n\n\n
Someone who mainly expects blame may hesitate to report it. First, another look on their own. Perhaps it will become clear. Perhaps everything was right after all.<\/p>\n\n\n
Time is lost in which the people responsible could already be responding. A useful approach to security therefore includes a clear reporting route that employees can find without a lengthy search. An initial report can be brief: what happened, when, and which message or transaction was involved?<\/p>\n\n\n
The causes can be examined carefully afterwards. That also requires a willingness to consider whether the procedure helped, or whether someone was left alone with their uncertainty.<\/p>\n\n\n
Good training can sharpen people’s awareness of these situations. It can show why a credible message may still need checking and which changes deserve particular attention. Company rules then explain how that check works in their own workplace.<\/p>\n\n\n
This is where general knowledge and company know-how belong together for me. The EU AI Act Academy therefore includes the company’s own contact people and reporting procedures in the training. Employees should be able to apply what they learn in the place where they actually work.<\/p>\n\n\n
The email in our story looked just like the others. The difference was an employee who paused, and a process that made room for her question.<\/p>\n","protected":false},"excerpt":{"rendered":"
The invoice was expected. The supplier had delivered, the amount was right, and the email arrived with the familiar sender name. At the bottom were the same sign-off and contact details as usual. Only the bank details had changed. A short note explained this, politely and without making a fuss. The employee in accounts prepared […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[],"class_list":["post-601","post","type-post","status-publish","format-standard","hentry","category-cyber-security-data-protection"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":8}},"_links":{"self":[{"href":"https:\/\/klangholz-compliance.de\/en\/wp-json\/wp\/v2\/posts\/601","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/klangholz-compliance.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/klangholz-compliance.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/klangholz-compliance.de\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/klangholz-compliance.de\/en\/wp-json\/wp\/v2\/comments?post=601"}],"version-history":[{"count":2,"href":"https:\/\/klangholz-compliance.de\/en\/wp-json\/wp\/v2\/posts\/601\/revisions"}],"predecessor-version":[{"id":603,"href":"https:\/\/klangholz-compliance.de\/en\/wp-json\/wp\/v2\/posts\/601\/revisions\/603"}],"wp:attachment":[{"href":"https:\/\/klangholz-compliance.de\/en\/wp-json\/wp\/v2\/media?parent=601"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/klangholz-compliance.de\/en\/wp-json\/wp\/v2\/categories?post=601"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/klangholz-compliance.de\/en\/wp-json\/wp\/v2\/tags?post=601"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}