Tuesday, 10:30 a.m. The phone rings, and the display shows the name of the bank that holds the company account. The caller is calm and professional. They introduce themselves as the fraud prevention team and explain that someone is attempting to withdraw €23,000 from the business account right now. They know when the last supplier invoice was paid. They know roughly how much.

"We need to stop this transaction immediately. You'll receive a notification on your phone - just approve it."

The notification arrives. It looks entirely legitimate, because it is - it comes from the bank's real app. Except it doesn't block the transfer. It authorizes it.

This scenario is not exaggerated for effect. It is currently one of the most common and most successful attack patterns against businesses. It does not target careless people. It targets experienced, busy professionals, and it is engineered to sound entirely reasonable at the exact moment it matters.

The illusion on the screen: why a phone number is no longer proof of identity

Most of us learned that the number on the display tells us who is calling. That rule no longer holds.

Calls today largely travel over the internet (VoIP), and the systems carrying them allow the sender to specify which number the recipient sees. The capability exists for legitimate reasons - so that employees can call out under a company's main number, whatever device they use. Fraudsters use it the same way, but enter someone else's number. This is caller ID spoofing.

If that number is saved in your contacts as "Bank", your phone will display exactly that. The device does not verify that the call actually originates from the bank - it simply matches the number against your saved contacts.

The same applies to text messages: a fraudulent SMS can appear in the same thread as genuine messages from your bank, because the sender name can be spoofed as well.

How fraudsters know your payment details

What convinces victims most is not the number - it's the detail. When a caller knows who you recently paid, the natural conclusion is that they can see your account. But none of this requires access to the bank.

• Compromised email. Access to a single business mailbox - yours, your accountant's, or a supplier's - exposes invoices, amounts, and payment schedules.
• Data breaches. Customer and vendor databases leak regularly and are traded online, often with names, phone numbers, and addresses attached.
• Public information. Company registries, websites, social media, and job listings reveal who runs the business, who handles finance, and who the company works with.
• Educated guesses. Businesses pay rent, utilities, accountants, and suppliers at similar times every month. A convincing detail doesn't need to be accurate - only plausible.

The attacker doesn't need to know everything. One detail that sounds like inside knowledge is enough.

The psychological trap: urgency that shuts down judgment

"Someone is taking €23,000 from your account right now" is a deliberate choice of words. When a person believes they are losing a large sum in real time, they shift into emergency mode. Attention narrows to a single goal - stopping the loss - and the question "is this actually my bank?" gets pushed aside.

That is why attackers never allow time. Stay on the line. Don't hang up. Every minute counts. They even have an answer for doubt: "You're absolutely right to be cautious - that's exactly why we're calling."

To be clear: this is not about naivety. The attack is designed to work on intelligent, experienced people, precisely when they are busy and under pressure.

The attack in five steps

1. Preparation. The attacker gathers information - from a compromised mailbox, leaked databases, or public sources - and selects someone in the company with account access.

2. The spoofed call. The call arrives from the bank's spoofed number. The caller poses as the security team and immediately mentions a specific detail to establish trust.

3. Manufactured urgency. Next comes the news that a large unauthorized transaction is in progress and must be stopped now.

4. The "limit" or "block" trick. The victim is told that to reverse the transaction, they must temporarily change a limit, move funds to a "safe account", or confirm a request about to arrive on their phone. In the background, the attacker has already logged into online banking - often with credentials stolen earlier - and initiated a real transfer.

5. The real approval. A push notification or SMS code arrives. Everything is authentic, because it comes from the bank itself. The victim approves it, believing they are stopping the fraud. In reality, they have just personally authorized the transfer.

Two-factor authentication (2FA) did not fail here. It did exactly what it was designed to do - it asked the account holder for confirmation. The attack succeeded because the account holder confirmed.

The one rule that stops most of these attacks

No bank will ever call you and ask you to approve a push notification, read out an SMS code, change a limit, or move money to a "safe account". Never, under any circumstances.

If any of these is requested during a call, you already know you are speaking with a fraudster - regardless of what the screen shows or how much the caller knows.

Equally important: this is not a flaw in online banking or the payment service. The payment system works as intended. The attack exploits human trust, not a technical weakness at the bank.

Checklist for staff and finance teams

• For any unexpected call "from the bank": hang up and call back using the number on the bank's website or the back of your card.
• Never approve a push notification or SMS code you did not initiate yourself.
• Never share codes or passwords over the phone with anyone.
• Require a second person to verify any limit change or transfer to a "new" account.
• Verify any change to a supplier's bank details by calling a number you already have - not one from the email.
• Define clearly who in the company can authorize payments, and up to what amount.
• Enable two-factor authentication on business email, not only on online banking.
• Share this article with everyone who has account access - recognizing the pattern is the strongest defense.

If you suspect an attack is underway

1. End the call. Immediately, without explanation, regardless of what the caller claims.

2. Verify through a second channel. Call your bank's official number from its website or the back of your card - not a number someone gave or sent you.

3. Request a freeze. If there is any doubt, ask the bank to temporarily suspend online banking and review recent transactions. The sooner you act, the better the chance a transfer can be stopped.

4. Audit devices and access. Scan computers for malware, change passwords for online banking and business email, and review who has access to company finances.

5. Report it. Report the attempt to your bank and to the police, even if no money was lost. Every report helps identify the pattern.

Security is a habit, not a product

No antivirus can prevent an employee from approving a notification in a moment of panic. What prevents it is a simple rule everyone in the company knows by heart: the bank never asks for approval over the phone. When the whole team knows the correct response is to hang up and call back, the attack loses its most powerful lever - time.

If you need help securing business email, logins, and account access, the support section has step-by-step guides.