Adopt one rule: any request for money, credentials, or changes to bank details that arrives by email or chat gets confirmed through a second channel you already know, such as a phone call to a saved number. Say it in writing, and make it apply to the CEO too. This beats trying to spot every fake.
Why small teams are targeted
Attackers look up a company's leadership on public sites and send a message in the founder's name asking an employee for something urgent. In a small team, people know the founder personally and want to help, which is the opening the attacker wants.
CISA's guidance on social engineering gives the core defence: verify through known channels, using phone numbers or addresses from past statements and not from the message itself. It also says to be wary of unsolicited requests about internal information and not to send financial or personal information by email.
Typical shapes of the request
- A payment request or a change of supplier bank details.
- A request to buy gift cards or prepaid cards.
- A request for a one time code or a login.
- A request to keep it quiet, because it is a surprise or confidential.
- A message from a new number claiming a phone was lost.
All share urgency, secrecy and a shortcut around normal process.
The rule
Write it on one page.
- Money or banking changes need approval from two people, one of whom did not receive the request.
- Confirm any unusual request by calling a number from your own records or speaking in person.
- Never use contact details supplied in the suspicious message.
- Nobody is ever blamed for pausing to check. Leaders say this out loud.
- Report suspicious messages to a shared channel so that others see them.
Make the founder part of it
The rule works only if the founder follows it. When the CEO really does need something fast, they should expect and welcome the callback. Joke about it if you like, but never skip it.
Technical help
Turn on warnings for external senders, set up SPF, DKIM and DMARC for your own domain so that others cannot easily spoof it, and enable MFA everywhere. CISA also lists keeping email filters and anti phishing features current. These reduce volume, but do not replace the human rule.
What to do if someone fell for it
Move fast. Contact the bank immediately to try to recall a payment, change affected passwords, revoke sessions, and report to law enforcement and the FTC as CISA advises. Preserve the messages.
Common pitfalls.
Practice it. Run a short drill once or twice a year where a leader sends a harmless fake request, such as asking for a meeting room code, and see who verifies. Share the result without naming people. Also give new hires a copy of the rule in their first week, since attackers often target recent joiners whose names appear in public announcements and who do not yet know whom to ask.
Quick check
What if the founder is travelling and cannot be called?
Use a prearranged backup channel, for example another leader who can confirm. Write that into the rule in advance.
Sources
Last reviewed: 19 October 2026.
