Cybersecurity Awareness Platform UAE: What to Require

On 8 October 2026, Abu Dhabi Police warned businesses about fake supplier emails that ask finance teams to change bank details and send payments to new accounts. Police say the fraud is often discovered only after the transfer is complete. This invoice fraud prevention UAE guide is for finance controllers and CISOs, and it covers the controls and staff habits that apply in every sector.

‍

In short: Treat every bank-detail change as unverified until someone calls a number already on file, require a second approver, authenticate your email domain, and rehearse the change request with the people who receive it.

‍

Invoice Fraud Prevention UAE Starts at the Payee

The scam needs no malware. A criminal takes over or imitates a supplier mailbox, reads the thread about an open invoice, and sends a short note saying the bank account has changed. The accounts payable clerk sees a familiar name, a familiar amount and a plausible reason, so the request looks like routine admin.

‍

The scale is visible in US figures. The FBI's Internet Crime Complaint Center recorded 24,768 business email compromise complaints in 2025, with reported losses of about $3.05 billion out of $20.88 billion across all internet crime. That makes this one scam type about 14.6% of everything reported, in the 2025 IC3 annual report.

‍

‍

Abu Dhabi Police describe the same pattern locally, and the warning signs they list are ordinary ones: urgency, a sender domain with a small spelling difference, and an insistence on email over a phone call. Because the signals are ordinary, prevention has to sit in the payment process and in habits staff have practiced, not in instinct alone.

‍

A Bank-Detail Change Procedure, Step by Step

Abu Dhabi Police's guidance, also reported by Emirates 24|7, tells finance teams to verify bank-detail requests through official channels. What decides whether that works is where the phone number comes from, so write the procedure for the vendor master change itself:

‍

1. Log the request on receipt: who received it, when, by which channel and which account details it asks for. Change nothing yet.
2. Take the verification number from the vendor master, created at onboarding or from the signed contract, never from the email, its signature or an attached letter.
3. Call and ask the contact to read back the new account name and number. Record who called, which number, when and who answered.
4. If the known contact cannot be reached, try a second contact on the contract or the supplier's account manager. Leave the existing details in place until someone answers.
5. Have a second authorized employee, who did not take the call, review the log and approve.
6. Hold the first payment to the changed account until the approver has checked that the account holder name matches the supplier's legal name on the contract.

‍

A change request is also a signal. Abu Dhabi Police list urgency, a sender domain with a small spelling difference, an insistence on email over a phone call, and a payment account in a different country from the supplier's usual location as warning signs. Treat each one as a reason to hold the request until a second approver has seen it.

‍

The log is what makes the procedure auditable. Months later, a controller can pull any changed account and see the call, the number and both approvers, which tells you far more than a policy that says verification happened.

‍

Prevention Points by Sector

Bank details change fraud works anywhere suppliers are paid by transfer. Construction invoice fraud UAE cases get the attention, and we cover that chain of developers, contractors and subcontractors in Invoice Fraud in UAE Construction. What differs is who holds the supplier relationship, who can ask for a change and where requests arrive, so adjust these typical set-ups to yours.

‍

Healthcare. In a typical hospital group, procurement owns the supplier relationship and finance runs the payment. Make procurement place the call-back, because it holds the contacts, and keep approval with finance so two functions see every change.

‍

Retail and e-commerce. A payables desk with many logistics and service suppliers sees a steady flow of invoices, so a change request can look like part of the flow. Accept account changes only through one form or ticket, never inside an invoice email, which gives clerks a clear reason to refuse an emailed request.

‍

Higher education. Departments often deal directly with contractors and may forward requests to central payables. Make the central team the only intake point for payee changes, and tell departments that a request passed along by email is not a verified change.

‍

Groups with shared finance teams. One team often pays several entities. Verify and log each change per entity, so a call made for one company is never reused as proof for another.

‍

Who Owns What: Finance and Security

A procedure without owners gets skipped. The controller owns the steps above: who may edit the vendor master, the approval limits, the call log and the hold on first payments. The CISO owns the mailbox side: email authentication with DMARC, DKIM and SPF, and a route for staff to report lookalike domains and odd requests.

‍

Give the two roles a standing exchange. Security sends finance the supplier-related reports it receives, finance sends security the list of bank-detail changes made, and once a quarter both sample changed accounts to confirm each has a call record and a second approver.

‍

The approval step can be automated without removing the person. In Agentic Automation Rules, higher-stakes actions such as a finance approval hold always wait for analyst approval, so the hold is never applied without a person's decision.

‍

Rehearse the Request Before It Arrives

Controls fail at the moment of pressure. The day before a payment run, a supplier writes that the account has changed and the money is due today. A clerk with a written rule, who knows that calling back is expected and not rude, makes the call. A clerk who was only told to be careful often pays.

‍

Make the call-back normal. Say in training and in the procedure that verification is part of the job and that no supplier will be offended by it.

‍

Report what looks odd. A lookalike domain or an unusual urgency is worth a message to the security team, even when the clerk did not act on it. Our guide to business email compromise training for finance teams covers what to teach.

‍

Then test the procedure with the people who run it. Whitebait runs phishing simulation for UAE and GCC organizations, with Arabic and English templates, and tracks reporting rate next to click rate. Send a supplier bank-detail change scenario first to the staff who can edit the vendor master. A reporting rate that rises while the click rate falls tells you the habit is forming.

‍

When someone does act on a doubtful request, the lesson lands best straight away. Zero-Touch Training responds when a person shows a security risk, with training matched to the behavior, delivered inside Microsoft Teams in the flow of work.

‍

Start With One Page

Return to the clerk holding a new account number the day before the payment run. With a log, a verified number and a second approver in place, the request costs a few minutes and the real supplier gets paid. Without them, the transfer can leave before anyone doubts it.

‍

This week, write the six steps on one page, name who places the call in each team, and share it with everyone who can edit a supplier record.

‍

Frequently Asked Questions

What is bank details change fraud?

‍

A criminal impersonates a supplier, or uses a compromised supplier mailbox, and emails a request to pay future invoices into a new account. Abu Dhabi Police warn that it is often discovered only after the transfer is complete, so the check has to happen before the payment leaves.

‍

What if we cannot reach the supplier's known contact?

‍

Leave the existing bank details in place and try a second contact on the contract or the supplier's account manager. Never use a number from the request itself. If the payment is due, tell the approver and record the delay, because a late payment can be explained to a supplier and a payment to the wrong account may not be recoverable.

‍

Who owns invoice fraud prevention, finance or security?

‍

Both. The controller owns the procedure, the approval limits and the call log. The CISO owns mailbox security and the route for staff to report suspicious requests. Reviewing a sample of changed accounts together each quarter keeps either side from assuming the other has checked.

‍

Does the same procedure fit every sector?

‍

The steps stay the same. What changes is who places the call and where requests enter: procurement in a hospital group, one form or ticket in retail, central payables in a university. Decide those two points for your own organization, then apply the six steps without exceptions.

A security awareness manager sits down for the monthly review with two numbers already in hand, the click rate and the training completion rate, and a question from the CISO about what changed since last month. Both numbers are easy to pull and hard to act on. This post is for program owners who need security awareness metrics to run the program on, not only to report upward.

‍

In short: Track reporting rate, time to report, repeat behavior, coverage and time to response, and read each one by role and department. Keep click rate and completion as context. Tie every metric to the action it triggers.

‍

Operational Metrics Versus Board Metrics

Board reporting asks whether human risk is falling and whether the program deserves its budget. The monthly review asks something narrower: which people, in which teams, need something different next month. We cover the first question in Security Awareness KPIs for the Board on One Page, including how to frame security awareness board reporting. This post covers the layer underneath it.

‍

That layer matters because the board page is a summary of it. If the monthly numbers are thin, the summary inherits the weakness. NIST's SP 800-50 Rev. 1 includes suggested metrics and evaluation methods so that organizations can regularly improve and update a learning program, which is the job the monthly review does.

‍

Security Awareness Metrics for the Monthly Review

Completion and click rate describe activity. They show who finished a module and who fell for a lure, but not whether people are getting better at spotting and reporting attacks. Five measures close that gap.

‍

• Reporting rate. The share of people who report a simulated or real suspicious message. Whitebait tracks it next to click rate.
• Time to report. How long passes between delivery and the first report. A shorter time gives the security team a head start.
• Repeat behavior. The share of people who fail again within a set window, counted per person and not per campaign.
• Coverage. The share of people, roles and attack types (credential harvesting, QR codes, MFA bypass) actually exercised in the period.
• Time to response. How long passes between a risky behavior and the coaching that follows it.

‍

Reporting is the one to read first. The Verizon 2024 Data Breach Investigations Report found that in security awareness exercise data from 2023, 20% of users identified and reported phishing in simulation engagements, and 11% of the users who clicked the email also reported it.

‍

‍

Those figures come from a wide pool, so use them as a reminder that reporting varies between people and can be measured. In your own program, watch how your reporting rate moves from month to month. A click followed by a report is a better outcome than a click in silence, because the security team hears about the lure while it is still live.

‍

Reading Human Risk Metrics by Role

A company-wide average hides the people who matter most. A reporting rate can look healthy overall while accounts payable and executive assistants sit well below it, and those are the roles that handle bank-detail changes and calendars full of other people's requests.

‍

Human risk metrics become useful once they are cut by role, department and exposure. Odin scores each employee continuously and weights role criticality, so the review can start with the roles where a mistake costs the most. Our guides to human risk assessment by role and department and the human risk score describe what goes into those numbers.

‍

Then look at direction per person, not at the campaign average. Graybait tracks individual susceptibility over time, weakness coverage and difficulty progression, so a program that runs without campaigns still produces the per-person trend the review needs.

‍

Connect Each Metric to an Action

A metric earns its place in the review only if a result changes something. Slow time to report in one department points to a reporting habit problem, which a one-tap report button and a short nudge can address. Repeat behavior in one role points to training that does not match the work, which role-based micro-learning addresses.

‍

Time to response is the easiest metric to leave out. When the gap between a risky behavior and the training that follows is days long, the lesson arrives after the moment has passed. Zero-Touch Training responds at once with training matched to the behavior, inside Microsoft Teams, which removes the delay between exposure and response, and the metric shows it.

‍

Run the Review in Five Steps

1. Pull the five measures for the last 30 days, by role and department.
2. Flag the groups that moved furthest from their own previous month.
3. Name one action and one owner for each flagged group.
4. Check last month's actions against this month's numbers.
5. Choose which results move up into the board view.

‍

Compare each group with its own history before comparing it with anyone else. Roles, sectors and languages differ, and your first few months of data are the most honest baseline you have. In a GCC workforce that receives simulations in Arabic and English, read each language group against its own history as well.

‍

Your Next Monthly Review

Back at the monthly review, the click rate and the completion rate are still on the screen, and now they have company. Add reporting rate and time to report for the next one, cut by role, and attach one action to each result. Once those two run steadily, the board view is a selection from data you already trust.

‍

Frequently Asked Questions

What are the most useful security awareness metrics?

‍

Reporting rate, time to report, repeat behavior, coverage and time to response give the most to act on. Together they show whether people notice attacks, how fast they speak up, whether habits change and whether every role is being exercised. Click rate and completion remain useful as context alongside them.

‍

How often should I review security awareness metrics?

‍

Monthly suits the operational view, because 30 days is enough for simulations and training to produce a change you can see by role. Weekly checks suit specific alerts, such as a department with a sudden drop in reporting. The board view can then draw on the monthly results at whatever interval the board meets.

‍

How do human risk metrics differ from security awareness KPIs?

‍

Security awareness KPIs summarize program performance, such as reporting rate across the organization. Human risk metrics describe individuals and groups, such as a person's risk score, a role's repeat behavior or how fast a team responds. The second set feeds the first, and it is where the monthly actions come from.

‍

Is click rate still worth tracking?

‍

Yes. Click rate shows how convincing a lure was for a given group. Read it next to reporting rate and time to report, because a group that clicks but reports quickly is in a different position from one that clicks and stays silent.

A client's security lead wants to show the board that staff are getting better at spotting phishing, and asks the provider that runs their security operations for the numbers. For an MSSP with many clients, that one request becomes a separate program for each of them. This guide to phishing simulation for MSSPs is for MSSP and MSP leaders in the UAE and GCC who want to run it for every client without keeping a spreadsheet per client.

‍

In short: phishing simulation for MSSPs works when each client has its own environment, content in Arabic and English, approval before anything is sent, and reporting the client can read. One platform runs the program while each tenant's data stays apart.

‍

What Clients Ask Their Provider to Run

Clients ask for simulation because people sit inside most breaches. The Verizon 2026 Data Breach Investigations Report found that people were involved in 62 percent of breaches. A security lead who reads that number wants proof that their own staff are covered, and the provider is the obvious place to ask.

‍

‍

The regional context adds weight. In Dubai, the DESC SOC Security Standard is mandatory for all providers that offer security operations center services to Dubai government and semi-government entities. Providers in that market already work to written standards, so a phishing program run on the same footing is easier to defend in a client review.

‍

Phishing Simulation for MSSPs Starts With Tenants

A multi-tenant phishing simulation setup gives every client or entity a separate environment, so employee lists, templates and results for one client never mix with another's. The Fraus multi-tenant and MSSP solution provides separate environments per client or entity, approval workflows and an audit trail.

‍

Approval workflows matter more than they sound. A simulation that imitates a client's HR or finance sender and goes out without sign-off is the quickest way to lose that client's trust. An approval step lets the right person confirm the audience, template and timing, and the audit trail records who approved what.

‍

Data location comes next, because some clients cannot let employee data leave the country. Fraus can be hosted on UAE or GCC servers or deployed fully on-premise, a topic covered in on-premise phishing simulation for GCC entities. When you assess an MSSP phishing simulation platform, check these first:

‍

• A separate environment for each client or entity
• Approval before any simulation is sent
• An audit trail you can show the client
• Hosting in the UAE or GCC, or on-premise, where the client requires it
• Arabic and English content inside the same program

‍

Two Languages, One Program

Gulf workforces read Arabic and English, often in the same inbox. A program that only translates English templates feels off to Arabic speakers, and an odd lure is easy to spot, which flatters the results. Whitebait ships Arabic and English templates, and the training side is covered in Arabic Security Awareness Training: Authored or Translated?.

‍

Training follows the same rule. An MSP security awareness platform has to teach as well as test, and Codex delivers security awareness training in Arabic and English, with micro-learning that Fraus's agentic AI recommends or assigns to each person based on their training gaps and behavioral signals.

‍

Running Many Clients Without Many Campaigns

Campaign calendars grow with every client you add. A small team cannot plan, launch and review a separate campaign for each tenant every month, and the reviews are the first thing to slip. That is where a campaign-less model fits an MSSP better.

‍

Graybait runs phishing simulation without campaigns. Setup takes four steps (connect the workforce, set guardrails, choose an objective, activate), it runs for twelve months, and the team steps in only when the system asks. Agentic AI picks each employee's next simulation from their Human Risk Profile and sets its difficulty, theme and timing. The autonomous phishing simulation guide explains how that works.

‍

Where you want fixed responses, Agentic Automation Rules take a trigger such as a simulation result and assign a nudge, module or policy. Higher-stakes actions always wait for analyst approval, and every agentic action is logged for audit.

‍

Reporting Each Client Can Read

Clients ask two questions after a simulation: who clicked, and who reported. Whitebait tracks reporting rate next to click rate, so the report shows how many people raised the alarm, which is the behavior a SOC can act on.

‍

Decide on two views before the first client goes live. The client sees one page for their own board, and your delivery team reviews every client's results side by side so weak spots surface early. Either way, each client's numbers come from its own environment.

‍

Next Step for Your Provider Team

Go back to the client who asked for board numbers. Take the five checks above, run them against that one client, and set up a single tenant with Arabic and English content and an approval step. If the report that comes out of it is one the security lead can hand to the board without edits, the same pattern will carry to the rest of your clients.

‍

Frequently Asked Questions

What should a service provider look for in a phishing simulation platform?

‍

Separate environments for each client, approval before sending, an audit trail, UAE or GCC hosting or on-premise deployment, and Arabic and English content. Also look at how much staff time each client needs each month, because a platform that needs a campaign per tenant will not scale with your client list.

‍

What is managed phishing simulation?

‍

It is a service in which the provider plans, sends and reports on phishing simulations for a client instead of the client doing it in-house. The provider handles audience, content, timing and results, and the client approves and receives the reporting.

‍

Why are clients asking for phishing simulation?

‍

Boards and regulators want evidence that staff behavior is being managed, and people are involved in most breaches. Clients already trust their provider with security operations, so they ask that provider to show click and reporting rates for their own people.