Cybersecurity Awareness for Employees Course: Payment fraud, fake invoices and CEO scams

1. Pregunta 1 de 16

   What is "whaling"?

   • ABlocking spam calls that come from overseas numbers
   • BPhishing that is done through fishing and hunting websites
   • CSpear phishing aimed at senior executives
   • DSending phishing emails to thousands of random people at once
   Ver respuesta

   Respuesta: C. Spear phishing aimed at senior executives

   Whaling is spear phishing that targets a "big phish", such as a CEO or other senior executive.

2. Pregunta 2 de 16

   In business email compromise, what does the scammer usually pretend to be?

   • AA new customer asking for a copy of your company's price list
   • BAn automatic software update from your computer's maker
   • CA leader, coworker or partner asking for money
   • DA local charity that is looking for volunteers
   Ver respuesta

   Respuesta: C. A leader, coworker or partner asking for money

   Business email compromise impersonates leaders, colleagues or partners to request money transfers or information.

3. Pregunta 3 de 16

   Read the email. Which warning signs does it show?

   From: Mark Olsen, President <mark.olsen.office@mailservice.example>

   Subject: Quick favour

   Are you at your desk? I am in meetings offsite all day and cannot take calls. I need you to buy six $200 gift cards for client thank-you gifts. Please keep this between us, I want it to be a surprise.

   Scratch the backs and send me photos of the card numbers by noon. I will pay you back tomorrow.

   Mark

   • AGift cards, secrecy and a boss who is "offsite"
   • BIt was sent during work hours
   • CA short subject line and a signature with only a first name
   • DA friendly tone and a request that mentions the company's clients
   Ver respuesta

   Respuesta: A. Gift cards, secrecy and a boss who is "offsite"

   The CAFC describes gift card requests from a "boss" who says they are working offsite, and the RCMP lists demands for secrecy and pressure to act quickly as warning signs of business email compromise.

4. Pregunta 4 de 16

   Read the email. What should you do next?

   From: Mark Olsen, President <mark.olsen.office@mailservice.example>

   Subject: Quick favour

   Are you at your desk? I am in meetings offsite all day and cannot take calls. I need you to buy six $200 gift cards for client thank-you gifts. Please keep this between us, I want it to be a surprise.

   Scratch the backs and send me photos of the card numbers by noon. I will pay you back tomorrow.

   Mark

   • AContact Mark using the company directory
   • BReply to the email and ask Mark if the request is real
   • CSend the card numbers, but keep the PINs until he calls you
   • DBuy the cards, but keep the receipts in case it is a scam
   Ver respuesta

   Respuesta: A. Contact Mark using the company directory

   Verify through a separate, trusted channel such as your work directory. Replying to the suspicious email only reaches the scammer.

5. Pregunta 5 de 16

   Read the email. Which detail is the strongest warning sign?

   From: Accounts, Kestrel Paving <accounts@kestrel-paving.example>

   Subject: Updated banking details - Invoice 4471

   Hello,

   Because of an audit, our bank account has changed. Please update our banking details for all future payments. The new account details are attached.

   Invoice 4471 for $18,450 is due today. Please pay it to the new account and confirm by reply once it is done.

   Thank you, Accounts Team

   (Note: Kestrel Paving is a real supplier of your company. Its emails normally come from @kestrelpaving.example.)

   • AThe supplier is a company your business really uses
   • BA request for new bank details, with payment due today
   • CThe email mentions a real invoice number and amount
   • DThe email says thank you at the end of the message
   Ver respuesta

   Respuesta: B. A request for new bank details, with payment due today

   Payment-detail changes and urgent deadlines are key signs of a supplier or contractor swindle.

6. Pregunta 6 de 16

   Read the email. What does the sender's address tell you?

   From: Accounts, Kestrel Paving <accounts@kestrel-paving.example>

   Subject: Updated banking details - Invoice 4471

   Hello,

   Because of an audit, our bank account has changed. Please update our banking details for all future payments. The new account details are attached.

   Invoice 4471 for $18,450 is due today. Please pay it to the new account and confirm by reply once it is done.

   Thank you, Accounts Team

   (Note: Kestrel Paving is a real supplier of your company. Its emails normally come from @kestrelpaving.example.)

   • AIt is a look-alike of the real domain
   • BIt is the supplier's normal, everyday email address
   • CIt proves the email was sent by the supplier's bank
   • DIt shows the email came from inside your company
   Ver respuesta

   Respuesta: A. It is a look-alike of the real domain

   kestrel-paving.example is not kestrelpaving.example. Small changes to a real domain are a common phishing trick.

7. Pregunta 7 de 16

   Read the email. What should you do before changing anything?

   From: Accounts, Kestrel Paving <accounts@kestrel-paving.example>

   Subject: Updated banking details - Invoice 4471

   Hello,

   Because of an audit, our bank account has changed. Please update our banking details for all future payments. The new account details are attached.

   Invoice 4471 for $18,450 is due today. Please pay it to the new account and confirm by reply once it is done.

   Thank you, Accounts Team

   (Note: Kestrel Paving is a real supplier of your company. Its emails normally come from @kestrelpaving.example.)

   • ACall the supplier using the phone number in your own records
   • BCall the phone number listed in the email's attachment
   • CReply to the email to confirm the new banking details
   • DPay today to the new account so you avoid a late fee
   Ver respuesta

   Respuesta: A. Call the supplier using the phone number in your own records

   Look up the contact in your own records and confirm directly. Treat any request to change payment details as suspicious until verified.

8. Pregunta 8 de 16

   Read the email. What does the Canadian Anti-Fraud Centre call this kind of scam?

   From: Jenna Morales <jenna.morales.home@mailservice.example>

   Subject: New bank for my pay

   Hi Payroll,

   I switched banks this week. Please send my next pay to the new account below. I am on a job site all day and can't call, so please just make the change before Friday's pay run.

   Thanks, Jenna

   • AA directory scam
   • BA romance scam
   • CA tech support scam
   • DA payroll spoof
   Ver respuesta

   Respuesta: D. A payroll spoof

   In a payroll spoof, an email that seems to come from an employee asks to change direct deposit details so pay goes to the fraudster.

9. Pregunta 9 de 16

   Read the email. What is the best next step for the payroll team?

   From: Jenna Morales <jenna.morales.home@mailservice.example>

   Subject: New bank for my pay

   Hi Payroll,

   I switched banks this week. Please send my next pay to the new account below. I am on a job site all day and can't call, so please just make the change before Friday's pay run.

   Thanks, Jenna

   • ACheck with Jenna using contact details on file
   • BReply to the email and ask Jenna to attach a void cheque
   • CMake the change, but only after Friday's pay run
   • DMake the change, since the email uses Jenna's full name
   Ver respuesta

   Respuesta: A. Check with Jenna using contact details on file

   Verify payment changes independently, using contact information from your own records, not the details in the message.

10. Pregunta 10 de 16

    Read the situation. What kind of scam is this?

    A caller asks the receptionist at Larkspur Dental Clinic to "quickly confirm your address and phone number for our records." The receptionist confirms them.

    Two weeks later, an invoice arrives for $789 for a "business directory listing renewal." Nobody at the clinic remembers ordering a directory listing.

    • AA ransomware attack
    • BA QR code scam
    • CA false billing scam
    • DA payroll spoof
    Ver respuesta

    Respuesta: C. A false billing scam

    In a directory scam, a type of false billing, a caller "confirms" your details, then sends an invoice for a listing you never ordered. The call may be recorded and used as "proof".

11. Pregunta 11 de 16

    Read the situation. Which step does the Canadian Anti-Fraud Centre suggest to protect a business from this scam?

    A caller asks the receptionist at Larkspur Dental Clinic to "quickly confirm your address and phone number for our records." The receptionist confirms them.

    Two weeks later, an invoice arrives for $789 for a "business directory listing renewal." Nobody at the clinic remembers ordering a directory listing.

    • AAlways confirm company details for any caller who asks
    • BPay small invoices quickly so the amounts do not grow
    • CAsk callers to email their invoices instead of mailing them
    • DLimit who can approve payments and warn staff about these calls
    Ver respuesta

    Respuesta: D. Limit who can approve payments and warn staff about these calls

    The CAFC advises telling employees at every level to be wary of unsolicited calls and giving payment authority to only a small number of staff.

12. Pregunta 12 de 16

    A caller says they are from your company's head office. They ask a store employee to activate prepaid cards and read out the numbers. What is this?

    • AA supplier price change
    • BA normal head office request
    • CA routine security test
    • DA head office spoof
    Ver respuesta

    Respuesta: D. A head office spoof

    In a head office spoof, a fraudster phones a franchise location, claims to be from head office and asks staff to activate prepaid cards or send money transfers.

13. Pregunta 13 de 16

    A reply appears in a real email thread you have with a client. It asks you to pay future invoices to a new account. Why should you still verify?

    • AOnly new threads can be trusted
    • BAttackers can hijack real email threads
    • CReal email threads are not allowed to contain payment requests
    • DEmail threads are automatically deleted after one week
    Ver respuesta

    Respuesta: B. Attackers can hijack real email threads

    In thread hijacking, attackers reply inside an existing conversation. Confirm any payment change by phone using a number you already have.

14. Pregunta 14 de 16

    You get an urgent email that seems to be from your CEO. It asks you to wire $120,000 to a foreign account today. What does the CAFC list this as?

    • AA business executive spoof
    • BA normal end-of-month payment request from a senior leader
    • CA phishing test that is always harmless
    • DA false billing scam for a business directory listing
    Ver respuesta

    Respuesta: A. A business executive spoof

    The CAFC describes emails that seem to come from an executive and urgently ask staff to wire large amounts to foreign accounts.

15. Pregunta 15 de 16

    Your manager calls from an unknown number. The voice sounds right, but the request is unusual: buy gift cards now and send the codes. What is the best response?

    • AHang up and call your manager on a known number
    • BAsk for the request by text
    • CBuy half of the cards now and the rest of them later
    • DDo it, since you clearly recognize your manager's voice
    Ver respuesta

    Respuesta: A. Hang up and call your manager on a known number

    Scammers can clone a voice from short audio samples. Verify with a known number or your workplace's agreed call-back procedure.

16. Pregunta 16 de 16

    Supplies arrive at your office with an invoice, but no one ordered them. What does the CAFC suggest?

    • AAsk in writing for proof of the order
    • BPay the invoice, since the goods were already delivered
    • CCall the number on the invoice and pay by credit card
    • DThrow the supplies away and ignore any letters about them
    Ver respuesta

    Respuesta: A. Ask in writing for proof of the order

    For unordered supplies, the CAFC suggests sending a certified or registered letter asking for proof of order.

Teclado: 1–4 para responder, Intro para la siguiente pregunta.