Setting up Payment Fraud Simulation

Prepare your account to run wire-transfer fraud simulations

Payment Fraud Simulation tests whether your employees would wire money to a fraudster impersonating a colleague, a manager or a supplier. To make the test realistic, Stoïk needs a real bank account that can receive a transfer, so the simulation can detect whether the targeted employee actually sent the money.

The Payment Fraud Simulation is included in the Human Security Advanced Offer.

That account is opened in your company's name through our payment provider, Stripe. Because it is a real bank account, Stripe is legally required to verify your company and the people who own or run it. Any money wired to it during a simulation stays yours and is automatically returned within one hour.

Before you start

You will need your company's registration number and a registration document, plus, for your representative and each owner or director: their date of birth, home address, email address, a photo ID and a recent proof of home address.

Allow roughly 15 minutes for the form. Stripe's verification then runs in the background and usually takes up to 24 hours.

Getting started

Go to Stoïk Protect → Overview → Settings → Payment fraud, tick the Stripe Connected Account Agreement and select Activate. Stripe's secure form opens inside Stoïk, pre-filled with what we already know about your company.

If you started before and left, the page shows Resume and you continue where you stopped. You can leave at any point without losing your answers.

Steps

1

Business type

Two questions to identify your entity: your business type and your business structure — its precise legal form, such as a Société in France.

Both are pre-filled from your Stoïk record, so in most cases you only confirm them and continue.

2

Business details

Check the pre-filled values and complete what is missing:

• Legal business name — must match the name attached to your registration number exactly

• Trading name — optional, if you operate under a different name

• Registration number — your SIREN, CIF, KvK or local equivalent, usually already filled in

• Business address — start typing the street and pick your address from the suggestion list, so the postal code and city fill in automatically

• Business phone number

• Business website — if you have none, use "Add product description instead" and describe your activity

Screenshots

3

Account representative

This is the person authorised to represent your company, usually the person doing this setup.

Provide their legal first and last name as written on their ID, their email address, job title, date of birth, home address and phone number. If someone else should represent the company, you can add or select a different person.

Stripe then checks these details against public records. That check can stay pending for up to 24 hours, which is normal and does not block you from continuing.

Screenshots

4

Owners or directors

Stripe needs everyone who owns more than 25% of the company, directly or indirectly, along with anyone on the governing board.

First, confirm the list. Stripe looks your company up in public records and proposes the owners it found, marking each one as "will be added". Review the names and select Confirm, or Change owners if the list is wrong or incomplete. You can add anyone missing and remove anyone who no longer qualifies.

Then, complete each person. For every owner or director, provide their email address, date of birth and home address. For people found in the public records, the name is already filled in and cannot be edited.

Each person also needs two proofs:

• Identity — select Start verification and photograph their ID. You can scan it with your phone using the QR code, email the person a link so they do it themselves, or use your computer's camera.

• Home address — select Start upload, choose the document type (an electricity bill, rent receipt, tax notice or bank statement, for example), upload it, and confirm it shows their name and address exactly as entered.

Screenshots

5

Review and submit

The last step lists everything you have provided and marks anything outstanding as Incomplete or Invalid. Select Edit next to each one and complete it.

When nothing is flagged, select Agree and submit.

Screeenshots

After you submit

Your Payment fraud page tells you that Stripe is reviewing your account to issue your simulation IBAN. This usually takes up to 24 hours and needs no action from you.

Once approved, the page displays the IBAN, BIC and beneficiary name used in your simulations, and you can start launching payment fraud campaigns. Transfers received on that IBAN are refunded automatically within one hour.

If Stripe cannot open the account, the page shows a Rejected badge with the reason — contact us and we will help you resolve it.