> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/human-security/advanced/payment-fraud-campaign.md).

# Payment fraud: campaigns

Send a realistic email asking an employee for a wire transfer to your simulation IBAN, then track what they do.

## Prerequisites

* Payment Fraud Simulation is [set up](/human-security/advanced/payment-fraud-setup.md) and your simulation IBAN is active.

## Create the campaign

{% stepper %}
{% step %}

### Start a new simulation

Go to `Simulation`, click `Create simulation` and choose `Payment fraud simulation`.
{% endstep %}

{% step %}

### Choose the recipient

Select the employee to target. **Recommended recipients** are highlighted based on how exposed they are to payment requests, but you can pick anyone.
{% endstep %}

{% step %}

### Choose the sender

The sender scenario defines who the email appears to come from:

* **Compromised colleague**: the real email address of a coworker, manager, or executive compromised by an attacker. The address is genuine, so nothing looks suspicious.
* **Impersonated colleague**: a fake address designed to look like that of a coworker, manager, or executive, similar but not identical to the real one.
* **Compromised partner**: the real email address of a vendor, supplier, or client compromised by an attacker. The address is genuine, so nothing looks suspicious.
* **Impersonated partner**: a fake address designed to look like that of a vendor, supplier, or client, similar but not identical to the real one.

For each scenario, Stoïk suggests senders based on the employee's real contacts. Keep a suggestion or enter your own sender name and address.
{% endstep %}

{% step %}

### Write the email

Start from a suggested template (CEO Fraud or fake invoice) or from scratch, then edit the subject and the body. Type `/` to add variables, formatting and images. The attachment is prefilled with the fraudulent bank details.
{% endstep %}

{% step %}

### Review and send

Review the simulation, then click `Send now`, `Schedule`, or `Save as draft`.
{% endstep %}
{% endstepper %}

## After sending

* The email is delivered through your email provider.
* Employee interactions are tracked automatically.
* A transfer to the simulation IBAN is recorded as part of the simulation, and the money is **automatically returned** to your company's bank account.

## Results

Open the simulation to follow its progress:

* **Sent**: the email was delivered
* **Opened**: the employee opened the email
* **Replied**: the employee replied to the request
* **Wire transfer executed**: the employee attempted a transfer to the simulation IBAN
* **Refunded**: the received funds were returned to your company

Each recipient has a timeline showing every event and when it happened.

## What the employee sees

As soon as the employee makes a transfer, they receive an email telling them it was a simulation. The email takes them to their [Employee app](/human-security/training/employee-app.md), where a lesson shows how to recognize payment fraud and the reflexes to adopt, such as verifying any change of bank details through a trusted channel. A quiz closes the lesson.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.stoik.io/human-security/advanced/payment-fraud-campaign.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.