The attacker impersonated a supplier and requested a payment detail change. They used urgency, discouraged phone verification, and exploited internal deadline pressure to make an unsafe decision feel reasonable.
The attack started with a spoofed supplier email. The sender domain (supplierco-invoices.net) was not the real supplier domain (supplierco.com) - a one-word difference that was not noticed under time pressure.
The key behaviour was trusting urgency and bypassing payment verification. The policy was clear. The trusted contact number was available. The pressure of a deadline made the unsafe choice feel like the only option.
Pause the request. Use the supplier's known contact number - not the one in the email. Verify outside the email chain. Report the suspicious request regardless of outcome.
Some signals found, but the attacker's use of urgency, authority, and trust caused key clues to be missed - a completely normal response under pressure.
"Where do we see urgency causing people to skip checks in our own team?"
Run another Incident Room case focused on MFA fatigue, executive impersonation or data exposure. Or speak to BehaviourOps about a scenario tailored to your sector.