A supplier payment has been changed following a suspicious email chain. The company has transferred funds to an account it cannot verify. The supplier has reported non-payment. Your team has been assigned to the Incident Room. You have 15 minutes to review the evidence, build the attack timeline, and identify the human behaviour that made this possible.