BEC · Incident Response · Incident Response

CFO whaling · fake email from the CEO · pressure for an urgent 380K TL transfer

Friday 16:42 · the CFO received a look-alike domain email 'from the CEO': 'Urgent supplier payment, 380K TL to this IBAN, reporting on Monday.' The bank approval window is 30 min. The CEO is on a business trip in Germany with the phone off. You will make 11 critical decisions in sequence.

Before you start the scenario

You are the decision-maker in this incident · every choice leaves time/cost/reputation behind
There are no wrong answers · just like in real life · but some paths are more expensive
You can restart it anytime · try different paths
At the end, a 3-axis score + alternative routes are shown

Scenario typeIncident Response

Estimated time~12 min

Decision nodes12

Other scenarios