Create Payment Fraud Simulation

Send a realistic payment-fraud test and track what your employee does

A Payment Fraud simulation tests whether an employee would fall for a fraudulent payment request — the technique used in real "business email compromise" (BEC) attacks. You send a realistic email asking for a wire transfer to your simulation IBAN, then track what the employee does.

Before you start

Make sure Payment Fraud is set up and active. See Setting up Payment Fraud simulations.

How it works

1

Configure

Choose a recipient, a scenario, and write the payment-request email

2

Send

The employee receives a realistic email asking for a wire transfer

3

Track

Follow what the employee does, from email opened to transfer executed

Walkthrough

1

Start a new simulation

1. Sign in to Stoïk Protect

2. Go to Simulation

3. Click Create simulation and chose Payment fraud simulation

2

Choose the recipient

Select the employee to target. Recommended recipients are highlighted based on how exposed they are to payment requests, so you can pick the most realistic target. But you can select who you want.

3

Choose the sender

The sender scenario defines who the email appears to come from. Four scenarios are available:

• Compromised colleague — the real email address of a coworker, manager, or executive compromised by an attacker. The address is genuine, so nothing looks suspicious.

• Impersonated colleague — a fake address designed to look like that of a coworker, manager, or executive, similar but not identical to the real one.

• Compromised partner — the real email address of a vendor, supplier, or client compromised by an attacker. The address is genuine, so nothing looks suspicious.

• Impersonated partner — a fake address designed to look like that of a vendor, supplier, or client, similar but not identical to the real one. For each scenario, Stoïk suggests recommended senders based on your employee's real contacts. You can keep a suggestion or enter your own sender name and address.

4

Choose the scenario and edit the email

You can start from a suggested template (CEO Fraud or fake invoice) and edit it freely, or create your own from scratch. Edit the subject and the body. You can use the command / to add variables, formatting and images. The attachement is prefilled with the fraudulent bank details

5

Review and send

Review the full simulation, then choose to Send now, Schedule it for later, or Save as draft.

What happens after sending

• The email is delivered through your email provider for reliable delivery

• Employee interactions are tracked automatically

• If the employee transfers money to the simulation IBAN, the transfer is recorded as part of the simulation

• Any money received is automatically returned to your company's bank account

Reading the results

Open the simulation to follow its progress step by step:

• Sent — the email was delivered

• Opened — the employee opened the email

• Replied — the employee replied to the request

• Wire transfer executed — the employee attempted a transfer to the simulation IBAN

• Refunded — the received funds were returned to your company

Each recipient has a detailed timeline showing every event and when it happened.

The employee experience

(🔜 Oct.) When an employee falls for a simulation, they are shown a short debrief in their Training App explaining that it was a security test, how to recognize this kind of fraud, and the reflexes to adopt — such as verifying any change of bank details through a trusted channel before paying. Until it is released, you have to close the loop manually with the employee.