Cybersecurity Awareness for Employees Course: Payment fraud, fake invoices and CEO scams

Untimed topic quiz: 16 questions on Payment fraud, fake invoices and CEO scams, with an explanation after each answer. Questions and answers are shuffled every time.

Course
Canada
98 questions
Checked October 13, 2026
Fact-checked October 13, 2026

Start with the lessonsCybersecurity Awareness for Employees Course: Lessons: about 150 minutes of reading. Every test question is covered in the lessons.

Topic quiz 3: Payment fraud, fake invoices and CEO scams

Question 1 of 16
What is "whaling"?
- Blocking spam calls that come from overseas numbers
- Phishing that is done through fishing and hunting websites
- Spear phishing aimed at senior executives
- Sending phishing emails to thousands of random people at once
Show answer
Answer: C. Spear phishing aimed at senior executives
Whaling is spear phishing that targets a "big phish", such as a CEO or other senior executive.
Question 2 of 16
In business email compromise, what does the scammer usually pretend to be?
- A new customer asking for a copy of your company's price list
- An automatic software update from your computer's maker
- A leader, coworker or partner asking for money
- A local charity that is looking for volunteers
Show answer
Answer: C. A leader, coworker or partner asking for money
Business email compromise impersonates leaders, colleagues or partners to request money transfers or information.
Question 3 of 16
Read the email. Which warning signs does it show?
From: Mark Olsen, President <mark.olsen.office@mailservice.example>
Subject: Quick favour
Are you at your desk? I am in meetings offsite all day and cannot take calls. I need you to buy six $200 gift cards for client thank-you gifts. Please keep this between us, I want it to be a surprise.
Scratch the backs and send me photos of the card numbers by noon. I will pay you back tomorrow.
Mark
- Gift cards, secrecy and a boss who is "offsite"
- It was sent during work hours
- A short subject line and a signature with only a first name
- A friendly tone and a request that mentions the company's clients
Show answer
Answer: A. Gift cards, secrecy and a boss who is "offsite"
The CAFC describes gift card requests from a "boss" who says they are working offsite, and the RCMP lists demands for secrecy and pressure to act quickly as warning signs of business email compromise.
Question 4 of 16
Read the email. What should you do next?
From: Mark Olsen, President <mark.olsen.office@mailservice.example>
Subject: Quick favour
Are you at your desk? I am in meetings offsite all day and cannot take calls. I need you to buy six $200 gift cards for client thank-you gifts. Please keep this between us, I want it to be a surprise.
Scratch the backs and send me photos of the card numbers by noon. I will pay you back tomorrow.
Mark
- Contact Mark using the company directory
- Reply to the email and ask Mark if the request is real
- Send the card numbers, but keep the PINs until he calls you
- Buy the cards, but keep the receipts in case it is a scam
Show answer
Answer: A. Contact Mark using the company directory
Verify through a separate, trusted channel such as your work directory. Replying to the suspicious email only reaches the scammer.
Question 5 of 16
Read the email. Which detail is the strongest warning sign?
From: Accounts, Kestrel Paving <accounts@kestrel-paving.example>
Subject: Updated banking details - Invoice 4471
Hello,
Because of an audit, our bank account has changed. Please update our banking details for all future payments. The new account details are attached.
Invoice 4471 for $18,450 is due today. Please pay it to the new account and confirm by reply once it is done.
Thank you, Accounts Team
(Note: Kestrel Paving is a real supplier of your company. Its emails normally come from @kestrelpaving.example.)
- The supplier is a company your business really uses
- A request for new bank details, with payment due today
- The email mentions a real invoice number and amount
- The email says thank you at the end of the message
Show answer
Answer: B. A request for new bank details, with payment due today
Payment-detail changes and urgent deadlines are key signs of a supplier or contractor swindle.
Question 6 of 16
Read the email. What does the sender's address tell you?
From: Accounts, Kestrel Paving <accounts@kestrel-paving.example>
Subject: Updated banking details - Invoice 4471
Hello,
Because of an audit, our bank account has changed. Please update our banking details for all future payments. The new account details are attached.
Invoice 4471 for $18,450 is due today. Please pay it to the new account and confirm by reply once it is done.
Thank you, Accounts Team
(Note: Kestrel Paving is a real supplier of your company. Its emails normally come from @kestrelpaving.example.)
- It is a look-alike of the real domain
- It is the supplier's normal, everyday email address
- It proves the email was sent by the supplier's bank
- It shows the email came from inside your company
Show answer
Answer: A. It is a look-alike of the real domain
kestrel-paving.example is not kestrelpaving.example. Small changes to a real domain are a common phishing trick.
Question 7 of 16
Read the email. What should you do before changing anything?
From: Accounts, Kestrel Paving <accounts@kestrel-paving.example>
Subject: Updated banking details - Invoice 4471
Hello,
Because of an audit, our bank account has changed. Please update our banking details for all future payments. The new account details are attached.
Invoice 4471 for $18,450 is due today. Please pay it to the new account and confirm by reply once it is done.
Thank you, Accounts Team
(Note: Kestrel Paving is a real supplier of your company. Its emails normally come from @kestrelpaving.example.)
- Call the supplier using the phone number in your own records
- Call the phone number listed in the email's attachment
- Reply to the email to confirm the new banking details
- Pay today to the new account so you avoid a late fee
Show answer
Answer: A. Call the supplier using the phone number in your own records
Look up the contact in your own records and confirm directly. Treat any request to change payment details as suspicious until verified.
Question 8 of 16
Read the email. What does the Canadian Anti-Fraud Centre call this kind of scam?
From: Jenna Morales <jenna.morales.home@mailservice.example>
Subject: New bank for my pay
Hi Payroll,
I switched banks this week. Please send my next pay to the new account below. I am on a job site all day and can't call, so please just make the change before Friday's pay run.
Thanks, Jenna
- A directory scam
- A romance scam
- A tech support scam
- A payroll spoof
Show answer
Answer: D. A payroll spoof
In a payroll spoof, an email that seems to come from an employee asks to change direct deposit details so pay goes to the fraudster.
Question 9 of 16
Read the email. What is the best next step for the payroll team?
From: Jenna Morales <jenna.morales.home@mailservice.example>
Subject: New bank for my pay
Hi Payroll,
I switched banks this week. Please send my next pay to the new account below. I am on a job site all day and can't call, so please just make the change before Friday's pay run.
Thanks, Jenna
- Check with Jenna using contact details on file
- Reply to the email and ask Jenna to attach a void cheque
- Make the change, but only after Friday's pay run
- Make the change, since the email uses Jenna's full name
Show answer
Answer: A. Check with Jenna using contact details on file
Verify payment changes independently, using contact information from your own records, not the details in the message.
Question 10 of 16
Read the situation. What kind of scam is this?
A caller asks the receptionist at Larkspur Dental Clinic to "quickly confirm your address and phone number for our records." The receptionist confirms them.
Two weeks later, an invoice arrives for $789 for a "business directory listing renewal." Nobody at the clinic remembers ordering a directory listing.
- A ransomware attack
- A QR code scam
- A false billing scam
- A payroll spoof
Show answer
Answer: C. A false billing scam
In a directory scam, a type of false billing, a caller "confirms" your details, then sends an invoice for a listing you never ordered. The call may be recorded and used as "proof".
Question 11 of 16
Read the situation. Which step does the Canadian Anti-Fraud Centre suggest to protect a business from this scam?
A caller asks the receptionist at Larkspur Dental Clinic to "quickly confirm your address and phone number for our records." The receptionist confirms them.
Two weeks later, an invoice arrives for $789 for a "business directory listing renewal." Nobody at the clinic remembers ordering a directory listing.
- Always confirm company details for any caller who asks
- Pay small invoices quickly so the amounts do not grow
- Ask callers to email their invoices instead of mailing them
- Limit who can approve payments and warn staff about these calls
Show answer
Answer: D. Limit who can approve payments and warn staff about these calls
The CAFC advises telling employees at every level to be wary of unsolicited calls and giving payment authority to only a small number of staff.
Question 12 of 16
A caller says they are from your company's head office. They ask a store employee to activate prepaid cards and read out the numbers. What is this?
- A supplier price change
- A normal head office request
- A routine security test
- A head office spoof
Show answer
Answer: D. A head office spoof
In a head office spoof, a fraudster phones a franchise location, claims to be from head office and asks staff to activate prepaid cards or send money transfers.
Question 13 of 16
A reply appears in a real email thread you have with a client. It asks you to pay future invoices to a new account. Why should you still verify?
- Only new threads can be trusted
- Attackers can hijack real email threads
- Real email threads are not allowed to contain payment requests
- Email threads are automatically deleted after one week
Show answer
Answer: B. Attackers can hijack real email threads
In thread hijacking, attackers reply inside an existing conversation. Confirm any payment change by phone using a number you already have.
Question 14 of 16
You get an urgent email that seems to be from your CEO. It asks you to wire $120,000 to a foreign account today. What does the CAFC list this as?
- A business executive spoof
- A normal end-of-month payment request from a senior leader
- A phishing test that is always harmless
- A false billing scam for a business directory listing
Show answer
Answer: A. A business executive spoof
The CAFC describes emails that seem to come from an executive and urgently ask staff to wire large amounts to foreign accounts.
Question 15 of 16
Your manager calls from an unknown number. The voice sounds right, but the request is unusual: buy gift cards now and send the codes. What is the best response?
- Hang up and call your manager on a known number
- Ask for the request by text
- Buy half of the cards now and the rest of them later
- Do it, since you clearly recognize your manager's voice
Show answer
Answer: A. Hang up and call your manager on a known number
Scammers can clone a voice from short audio samples. Verify with a known number or your workplace's agreed call-back procedure.
Question 16 of 16
Supplies arrive at your office with an invoice, but no one ordered them. What does the CAFC suggest?
- Ask in writing for proof of the order
- Pay the invoice, since the goods were already delivered
- Call the number on the invoice and pay by credit card
- Throw the supplies away and ignore any letters about them
Show answer
Answer: A. Ask in writing for proof of the order
For unordered supplies, the CAFC suggests sending a certified or registered letter asking for proof of order.

Topic quiz 3: Payment fraud, fake invoices and CEO scams

Related tests