🛡️ Safety Hub / Business

💼 Business Owners, staff & finance teams

BEC invoice fraud, CEO fraud, vendor impersonation, data protection

Business email compromise costs Pakistani companies more than any other cybercrime: a "vendor" emails new bank details, a "CEO" WhatsApps an urgent payment. One transfer, gone. These lessons build the verification habits — call back on a known number, two-person approval, delay on any change of payment details.

🧭 Your learning path

Start at the top — 10 minutes a day is enough.

📚

12 Safety Lessons for Business

BEC, CEO fraud and verification workflows

 🎯

Practice Decisions

Fraud attempts as they arrive in your inbox

 🎣

Phishing & Scam Awareness

The core course on fake messages

 🔐

Passwords & Accounts

Company account hygiene

📚 Quick lessons

12 practical cards — read one, apply it today.

🕵️‍♂️

Detect & Block BEC Invoice Fraud Emails

~4 min · beginner

 🚨

Prevent CEO‑Fraud Urgent Transfer Scams

~4 min · intermediate

 📱

Guard Against WhatsApp Supplier Impersonation

~3 min · beginner

 🔍

Spot Look‑alike Invoice Templates & Domains

~4 min · intermediate

 📞

Apply a Call‑Back Rule for All Payments

~3 min · beginner

 🛡️

Build Basic Ransomware Defenses for Your Firm

~5 min · intermediate

 📞

Spot CEO-Fraud Transfer Requests Before You Pay

~4 min · beginner

 📧

Verify Vendor Bank-Change Emails (BEC Invoices)

~5 min · intermediate

 📱

Catch WhatsApp Business Supplier Impersonation

~4 min · beginner

 🔍

See Through Lookalike Domains and Fake Invoice Templates

~4 min · intermediate

 ☎️

Build a Call-Back Payment Verification Workflow

~3 min · beginner

 🔐

Stop Business WhatsApp Account Takeover

~3 min · beginner

🎯 Decide it yourself

Real situations. Tap an answer, see what happens. (Business edition)

💬 WhatsApp Supplier Bank Detail Change medium

You run a small textile unit in Faisalabad. A message arrives on WhatsApp Business from your usual fabric supplier, saying their bank account has changed due to an audit, and your pending invoice of PKR 8.2 lakh should now go to a new Meezan Bank account. The sender's number matches your contact list, but you never spoke on phone about this. The next morning, your accounts officer is ready to release payment. What do you do first?

💡 Any bank-detail change request on WhatsApp Business must be verified by calling a known number before payment is released. Never trust a new account just because the sender appears familiar. If fraud occurs, report the account and full chat history to NCCIA through their official portal and your bank immediately.

💻 Ransomware Hits the Accounts Computer medium

You are Sana, office admin at a small Islamabad logistics company. The accounts laptop suddenly shows a lock screen demanding $3,000 in crypto to unlock all client shipment files, ledgers, and pending invoices. The deadline is 48 hours. A staff member admits opening an email attachment called 'Urgent-Easypaisa-Refund.zip' this morning. You have an external hard drive with last week's backup in the drawer.

💡 Small firms are prime ransomware targets because backups and training are often weak. Disconnect infected devices immediately, never pay ransoms, and restore from offline backups taken regularly. Train staff to avoid unknown email attachments, especially compressed files. Report serious incidents to NCCIA and review your cyber insurance and response plan.

📱 Urgent 'CEO' WhatsApp Demands Transfer hard

You are Bilal, finance manager at a Karachi textiles firm. A WhatsApp message from an unknown number appears with your CEO's display photo, claiming his SIM is dead. He urgently asks you to transfer Rs. 1,250,000 to a 'confidential supplier' in Faisalabad before a 3pm deadline, and warns not to email anyone about it. The grammar is slightly off, and the tone feels unusual.

💡 CEO fraud relies on urgency, secrecy, and channel switching to bypass normal checks. A genuine executive will never object to a quick verification call on a known number. Always confirm unusual fund requests through a trusted channel and report impersonation attempts to NCCIA so others can be warned quickly.

📧 Vendor Sends New Bank Details by Email medium

You are Hira, accounts officer at a Lahore packaging supplier. A polished email arrives from 'accounts@globalpack-pk.com' saying their bank details have changed to a new United Bank account, effective immediately, due to an audit. Your director wants the Rs. 840,000 invoice settled today. The email domain looks slightly off from the vendor's usual address. You are about to update the payment file.

💡 Vendor bank-detail changes by email are a classic Business Email Compromise trap, especially when domains look similar. Always verify new payment instructions through a previously known phone number, never the one in the suspicious email. Report confirmed scams to NCCIA and train finance staff on the call-back verification rule before any transfer.

💻 Ransomware Hits the Office hard

Monday morning at your accounting firm in Lahore. Staff open files on the shared drive and every client record, invoice, and tax return now ends with .locked. A ransom note appears demanding 0.05 BTC within 48 hours or the data will be leaked online. Three client deadlines are due this week, and the partners are panicking.

💡 Small firms are prime ransomware targets because attackers assume there are no tested backups. Disconnect infected devices immediately, keep daily offline backups, and report incidents to NCCIA. Paying the ransom rarely restores full data and encourages repeat attacks against your business and clients.

📧 CEO Urgent Transfer Request easy

You handle accounts at a logistics company in Karachi. An email, marked URGENT and CONFIDENTIAL, appears to be from your CEO asking you to transfer Rs 12,00,000 to a HBL account for a confidential acquisition in Islamabad. The tone sounds like him, and he says he is in a board meeting and cannot be disturbed. He wants it done in the next 30 minutes.

💡 CEO fraud relies on urgency, secrecy, and fear of questioning authority. Always verify urgent transfer requests through a separate channel, such as a direct call on a saved number. Never use reply buttons or contact details from the suspicious email. Report confirmed attempts to NCCIA.

💬 WhatsApp Supplier Bank-Account Change medium

You run a textile unit in Faisalabad. A WhatsApp Business message from your Lahore fabric supplier 'Khan Textiles' says their bank details have changed to a new Meezan account for the Rs 4,80,000 monthly invoice. The logo and contact number match your records. The message is signed by the same sales manager you speak to weekly. You need to release the payment before the fabric shipment leaves today.

💡 Supplier bank-detail changes received on WhatsApp or email must always be verified by calling a known phone number. Never trust the contact details inside the message itself. In Pakistan, report confirmed impersonation scams to NCCIA and alert the real supplier so other customers are warned.

📒 Fake Tender Fee for a New Supplier Directory easy

You run a small distribution business in Multan and want new wholesale suppliers. You find 'Pakistan Trade Index 2025' online and fill a 'Free Listing' form. A 'registration officer' calls, congratulates you, and asks for PKR 18,500 as a 'mandatory verification and directory fee' to be paid to a personal JazzCash account before inclusion. He offers a 30% discount if paid today.

💡 Fake supplier directories and tender fee scams thrive on urgency and personal mobile wallets. Real directories do not demand JazzCash or EasyPaisa payments to random accounts, and they always provide veriNCCIAble company details. Research independently, never rush a fee, and report suspected fraud to NCCIA. A pause protects your cash.

📱 WhatsApp Takeover at Your Boutique Shop hard

You own a ladies' clothing shop in Gulshan-e-Iqbal, Karachi, and orders come mostly through the shop's WhatsApp Business account. A staff member clicks a link received from an unknown number, and within minutes the WhatsApp Business account shows 'Logged out.' You later receive a message claiming to be from 'Meta Support' demanding a verification code to restore access. Customers are still placing afternoon orders.

💡 WhatsApp Business takeovers can drain customer trust and money within hours. Never share verification codes with anyone, even callers claiming to be support. Switch communications to a verified channel fast, warn your customer list openly, and file the incident with NCCIA so the case is tracked. Quick, transparent action limits damage.

📧 Urgent Vendor Bank-Account Change on Email medium

You run a mid-sized textile unit in Faisalabad. An email lands from 'Accounts@alhambra-textiles.pk' asking you to update the vendor's bank details for next week's shipment. The tone is polite, the invoice logo looks identical, and the deadline is tight. You are about to forward the new details to your accounts officer when the message pings again: 'Please update quietly to avoid delays.'

💡 Bank-detail change requests are a classic Business Email Compromise trap. Always verify vendor banking changes by calling a known number, never one supplied in the email. A short call-back habit protects company funds and preserves the payment trail. Report BEC attempts to NCCIA so other firms get warned.

🔗 The Vendor Breach medium

Usman's company learns that a third-party payroll vendor it uses has suffered a breach, and employee CNICs, bank account numbers, and salaries may be exposed. Usman's company did not lose the data directly, but its employees are affected and worried.

💡 A vendor breach affecting your employees' data is still your incident. Notify, guide protection, and reassess the vendor relationship.

⬇️ The Bulk Downloader medium

Tariq, a senior engineer at an Islamabad SaaS firm, notices a teammate has been downloading the entire customer database through the internal API in large batches over several days, far beyond his job needs. The teammate mentions he is 'building a side project'.

💡 Unauthorized bulk downloads of customer data — even by senior staff for 'side projects' — are insider threats. Report through proper channels.

👤 The Ghost Admin Account hard

During a routine review, Nadia, an IT administrator in Karachi, discovers an admin-level account named 'svc_backup2' that nobody on her team created. It was activated two weeks ago and has logged in from an overseas IP. It has full access to production systems.

💡 An admin account nobody created is a backdoor. Disable (do not delete) to preserve logs, then investigate how it appeared and what it touched.

🗄️ The Slow Database hard

The product database at a Lahore startup suddenly becomes extremely slow at 2 PM, timing out customer transactions. The DBA, Hamza, finds an unknown long-running query joining several sensitive tables and a new stored procedure he did not create.

💡 Unexplained database slowdowns with unknown objects are strong intrusion indicators. Preserve evidence and investigate how it was added — do not just restart.

Play scored scenarios and earn points →

🎭 Practice out loud

The AI plays the other side — the scammer, the blackmailer, the "CEO". You practice refusing.

📧

Vendor Bank Change on Letterhead

Your long-time Lahore-based fabric supplier emails saying their bank account has changed for the new order. Th…

 💼

CEO's 'Urgent Confidential Transfer'

It's 9:47 PM in Karachi. An email from the boss asks you to immediately wire Rs. 2.8 million to a new supplier…

 📱

WhatsApp Takeover of the Brand Number

Your company's verified WhatsApp Business number suddenly shows a new profile photo and starts messaging custo…

 🏷️

Lookalike Tender Fee Trap

A government-style tender email invites your construction firm to bid, asking for a Rs. 45,000 'processing fee…

 🧾

The Vendor Who Changed Banks

A trusted supplier emails from a new address asking to update their bank details before Friday's payment. Your…

 💼

The Boss's Secret Transfer

It's 9 PM in Karachi and a WhatsApp message from 'the CEO' asks for an urgent, confidential transfer to a new …

 📧

The Lookalike Invoice

An invoice arrives from a supplier whose name looks familiar, but the email ends in a domain almost identical …

 📱

The Hijacked WhatsApp Shop

Staff report that your company's WhatsApp Business account is sending strange 'payment link' messages to clien…

✅ Quick checklists

Do / don't lists — screenshot the ones you need.

📄 Before you pay a vendor invoice

✅ Always call vendor on a known number to confirm bank details; ✅ Match invoice email against verified supplier master file; ✅ Reject pressure for silent or urgent wire transfers; ✅ Require two staff approvals for any payment change; ❌ Don't rely only on email when bank details change mid-month; ❌ Don't pay invoices you cannot reconcile to a purchase order; ❌ Don't skip checking for lookalike sender domains carefully; ❌ Don't process refunds to new accounts without callback

👔 If your 'CEO' emails for a urgent transfer

✅ Pause and verify any secret transfer request by phone; ✅ Confirm the request face-to-face with the named manager; ✅ Report the email to your IT or finance lead fast; ✅ Forward the original message to NCCIA if loss occurs; ❌ Don't act on urgency, secrecy, or threats in emails; ❌ Don't trust display names that hide a different address; ❌ Don't wire funds just because the boss appears to ask; ❌ Don't reply from your phone without checking headers

💬 When a supplier pings you on WhatsApp Business

✅ Confirm new suppliers through your official landline first; ✅ Re-check supplier details before any goods are dispatched; ✅ Save verified business contacts after due verification; ✅ Enable two-step verification on all business WhatsApps; ❌ Don't trust unknown numbers sending invoices instantly; ❌ Don't share order lists without strict need-to-know; ❌ Don't move conversations off-platform to dodge records; ❌ Don't accept price changes sent only via voice notes

🔍 Spotting lookalike invoice templates and domains

✅ Compare sender domain letter by letter with the real one; ✅ Hover over links before clicking any invoice PDF link; ✅ Lock approved invoice templates inside your ERP system; ✅ Use SPF, DKIM, and DMARC to block spoofed senders; ❌ Don't open attachments from unfamiliar or misspelled domains; ❌ Don't trust logos alone as proof of supplier identity; ❌ Don't reply to payment change requests on copied logos; ❌ Don't ignore tiny character swaps in domain names

📞 Running a payment verification workflow

✅ Make callback verification mandatory for all new payees; ✅ Use a phone number from a previous invoice, not email; ✅ Log who verified, when, and with which reference number; ✅ Train new finance hires within their first two weeks; ❌ Don't skip callback just because email looks legitimate; ❌ Don't call a number given inside the suspect email; ❌ Don't allow one person to add and approve a payee alone; ❌ Don't waive checks for senior staff or VIP clients

📱 If your business WhatsApp gets hijacked

✅ Switch on two-step PIN on every business WhatsApp today; ✅ Alert customers quickly through email and website notice; ✅ Tell staff a code request means a possible takeover scam; ✅ Report hijacked numbers immediately to NCCIA for help; ❌ Don't share six-digit WhatsApp codes with anyone at all; ❌ Don't let staff install unofficial or cloned WhatsApp apps; ❌ Don't post verification codes in your team group chats; ❌ Don't ignore sudden logouts from your business account

🛡️ Training staff to catch phishing attempts

✅ Run monthly phishing drills with realistic sample messages; ✅ Show staff how to report emails using the built-in button; ✅ Reward quick reporters, even when they clicked by mistake; ✅ Update finance teams on scams flagged by NCCIA bulletins; ❌ Don't punish reporting so staff hide small mistakes fast; ❌ Don't assume experienced staff can spot every trap; ❌ Don't rely on a single annual cyber safety session only; ❌ Don't let personal email be used for supplier payment work

📋 Before you pay any tender or listing fee

✅ Search the company name plus the word 'scam' first; ✅ Verify tender notices on the issuing department's own website; ✅ Cross-check supplier listings with PK chamber registries online; ✅ Refuse any request for advance fees via mobile transfer; ❌ Don't pay to be 'approved' in a supplier directory first; ❌ Don't trust glossy profiles on unknown B2B platforms blindly; ❌ Don't share company registration papers before full checks; ❌ Don't accept vague addresses or PO box numbers alone

📧 When a vendor sends new bank details by email

✅ Verify bank detail changes only through a known phone number, not email. ✅ Call the vendor on a number from an old invoice. ✅ Require two staff approvals before updating any vendor account. ✅ Note the change in writing with date, time, and caller name. ❌ Don't reply to the email to confirm the new details. ❌ Don't update the payment file based on an email alone. ❌ Don't ignore small wording or bank name changes in emails.

👔 If your CEO messages an urgent secret transfer

✅ Pause and call the CEO on a known number before paying. ✅ Ask a finance head to independently approve the transfer. ✅ Check if the request matches normal business processes. ✅ Log the full request, including time and message content. ❌ Don't trust urgency, secrecy, or pressure in the message. ❌ Don't use contact details given inside the suspicious message. ❌ Don't send funds to a new account without dual sign-off.

💬 If a supplier contacts you on WhatsApp Business

✅ Match the WhatsApp number against your vendor master file. ✅ Confirm new orders or price changes by phone or in person. ✅ Train staff to flag suppliers pushing quick stock payments. ✅ Save verified supplier numbers as contacts in your directory. ❌ Don't trust a WhatsApp profile picture or business label. ❌ Don't pay advance deposits through unfamiliar bank accounts. ❌ Don't share order copies with sensitive pricing on WhatsApp.

📄 If an invoice looks like your usual template

✅ Compare the sender domain letter by letter with past emails. ✅ Hover over links to check the real URL before clicking. ✅ Forward suspicious invoices to your finance security inbox. ✅ Use a saved address book, not email suggestions, for vendors. ❌ Don't open invoice attachments from unknown or altered domains. ❌ Don't rely on logos and layouts to confirm a sender's identity. ❌ Don't download attachments ending in .zip, .exe, or .scr.

📞 When setting up a payment verification workflow

✅ Make call-back on a pre-recorded phone number mandatory. ✅ Store call-back numbers in your system, not in emails. ✅ Log every verification call with staff name and result. ✅ Review and test the workflow with new staff regularly. ❌ Don't accept the 'number on the invoice' as proof. ❌ Don't skip the call-back for payments flagged as urgent. ❌ Don't allow one person to create and approve a payment.

🔓 If your business WhatsApp account is taken over

✅ Enable two-step verification on WhatsApp Business today. ✅ Lock the SIM with your mobile operator through proper channels. ✅ Inform staff and clients quickly if takeover is suspected. ✅ Report the compromise to NCCIA with screenshots and logs. ❌ Don't share the six-digit code with anyone, ever. ❌ Don't ignore sudden logouts or unknown linked devices. ❌ Don't keep recovering the account without changing all passwords.

🎓 When running staff phishing awareness training

✅ Run short monthly phishing drills using safe fake emails. ✅ Reward staff who report suspicious messages quickly. ✅ Print a clear reporting step on desks or near terminals. ✅ Teach staff to recognize pressure, prizes, and threats. ❌ Don't blame staff publicly for clicking a test phish. ❌ Don't rely on a single yearly awareness session. ❌ Don't assume managers can spot every scam email.

💼 If a supplier directory or tender asks for fees

✅ Search the directory or buyer name online before paying. ✅ Cross-check listings with trade bodies and chambers. ✅ Use official government tender portals for public work. ✅ Ask your finance team to review any fee request first. ❌ Don't pay registration, listing, or tender fees upfront. ❌ Don't trust glossy PDFs claiming guaranteed orders abroad. ❌ Don't share NTN or bank details to unknown directories.

🚨 Something happened — do these steps now

Scammed, threatened, blackmailed or hacked? Work top to bottom. Do not pay, do not delete.

🧊 Stop — don't pay, don't reply, don't delete

Paying a blackmailer never ends it. Replying teaches the scammer you respond. Deleting chats destroys your own evidence. Take a breath and move to step 2.

📸 Preserve the evidence

Screenshot everything with the sender's number/username and time visible: chats, calls list, SMS, transaction receipts, URLs. Export the WhatsApp chat (Settings → Chats → Export). Write down amounts, dates and the number used.

🏦 Freeze the money path

Money sent? Call your bank or JazzCash/EasyPaisa helpline immediately (number on the back of your card / the official app) and ask them to block the card, freeze the account and recall the transfer. Note the complaint number they give you.

🏛️ Report to NCCIA

NCCIA (National Cyber Crime Investigation Agency) is Pakistan's cybercrime agency. File a complaint on the official NCCIA complaint portal or visit your nearest cybercrime circle — bring your CNIC and the evidence from step 2. You can also call the cybercrime helpline 1991.

🔑 Secure your accounts

From a different (clean) device, change the password of the hacked account first, then everywhere you reused it. Turn on two-step verification (WhatsApp, email, bank apps). Check active login sessions and kick out unknown devices.

🤝 Tell one trusted person

Shame belongs to the scammer, not you. Tell a parent, spouse, friend or teacher — they can help you complete the steps and speak to NCCIA with you. For women and children, the Madadgar national helpline 1121 also guides you.

15 — Police emergency 1991 — NCCIA cybercrime helpline 1121 — Madadgar helpline (women & children)

Helpline numbers and complaint links can change — verify on the official NCCIA and PTA websites before sharing.

🧰 Safety tools

🟥

Scam Radar

Paste a suspicious SMS, link or app and get an instant red-flag check

 🎭

Role-Play Practice

Rehearse the hard conversation with AI before you face it for real

 🎯

Decision Scenarios

Hundreds of Pakistani situations — choose and learn instantly

 ⚡

5-Minute Skills

All safety micro-cards, browsable
🧒 Kids safety 🧑‍🎓 Teens safety 👩 Women safety 👴 Seniors safety 🎮 Gaming safety