Deepfake Awareness Training: Teach Staff to Verify

On 8 October 2026, Abu Dhabi Police warned businesses about fake supplier emails that ask finance teams to change bank details and send payments to new accounts. Police say the fraud is often discovered only after the transfer is complete. This invoice fraud prevention UAE guide is for finance controllers and CISOs, and it covers the controls and staff habits that apply in every sector.

‍

In short: Treat every bank-detail change as unverified until someone calls a number already on file, require a second approver, authenticate your email domain, and rehearse the change request with the people who receive it.

‍

Invoice Fraud Prevention UAE Starts at the Payee

The scam needs no malware. A criminal takes over or imitates a supplier mailbox, reads the thread about an open invoice, and sends a short note saying the bank account has changed. The accounts payable clerk sees a familiar name, a familiar amount and a plausible reason, so the request looks like routine admin.

‍

The scale is visible in US figures. The FBI's Internet Crime Complaint Center recorded 24,768 business email compromise complaints in 2025, with reported losses of about $3.05 billion out of $20.88 billion across all internet crime. That makes this one scam type about 14.6% of everything reported, in the 2025 IC3 annual report.

‍

‍

Abu Dhabi Police describe the same pattern locally, and the warning signs they list are ordinary ones: urgency, a sender domain with a small spelling difference, and an insistence on email over a phone call. Because the signals are ordinary, prevention has to sit in the payment process and in habits staff have practiced, not in instinct alone.

‍

A Bank-Detail Change Procedure, Step by Step

Abu Dhabi Police's guidance, also reported by Emirates 24|7, tells finance teams to verify bank-detail requests through official channels. What decides whether that works is where the phone number comes from, so write the procedure for the vendor master change itself:

‍

1. Log the request on receipt: who received it, when, by which channel and which account details it asks for. Change nothing yet.
2. Take the verification number from the vendor master, created at onboarding or from the signed contract, never from the email, its signature or an attached letter.
3. Call and ask the contact to read back the new account name and number. Record who called, which number, when and who answered.
4. If the known contact cannot be reached, try a second contact on the contract or the supplier's account manager. Leave the existing details in place until someone answers.
5. Have a second authorized employee, who did not take the call, review the log and approve.
6. Hold the first payment to the changed account until the approver has checked that the account holder name matches the supplier's legal name on the contract.

‍

A change request is also a signal. Abu Dhabi Police list urgency, a sender domain with a small spelling difference, an insistence on email over a phone call, and a payment account in a different country from the supplier's usual location as warning signs. Treat each one as a reason to hold the request until a second approver has seen it.

‍

The log is what makes the procedure auditable. Months later, a controller can pull any changed account and see the call, the number and both approvers, which tells you far more than a policy that says verification happened.

‍

Prevention Points by Sector

Bank details change fraud works anywhere suppliers are paid by transfer. Construction invoice fraud UAE cases get the attention, and we cover that chain of developers, contractors and subcontractors in Invoice Fraud in UAE Construction. What differs is who holds the supplier relationship, who can ask for a change and where requests arrive, so adjust these typical set-ups to yours.

‍

Healthcare. In a typical hospital group, procurement owns the supplier relationship and finance runs the payment. Make procurement place the call-back, because it holds the contacts, and keep approval with finance so two functions see every change.

‍

Retail and e-commerce. A payables desk with many logistics and service suppliers sees a steady flow of invoices, so a change request can look like part of the flow. Accept account changes only through one form or ticket, never inside an invoice email, which gives clerks a clear reason to refuse an emailed request.

‍

Higher education. Departments often deal directly with contractors and may forward requests to central payables. Make the central team the only intake point for payee changes, and tell departments that a request passed along by email is not a verified change.

‍

Groups with shared finance teams. One team often pays several entities. Verify and log each change per entity, so a call made for one company is never reused as proof for another.

‍

Who Owns What: Finance and Security

A procedure without owners gets skipped. The controller owns the steps above: who may edit the vendor master, the approval limits, the call log and the hold on first payments. The CISO owns the mailbox side: email authentication with DMARC, DKIM and SPF, and a route for staff to report lookalike domains and odd requests.

‍

Give the two roles a standing exchange. Security sends finance the supplier-related reports it receives, finance sends security the list of bank-detail changes made, and once a quarter both sample changed accounts to confirm each has a call record and a second approver.

‍

The approval step can be automated without removing the person. In Agentic Automation Rules, higher-stakes actions such as a finance approval hold always wait for analyst approval, so the hold is never applied without a person's decision.

‍

Rehearse the Request Before It Arrives

Controls fail at the moment of pressure. The day before a payment run, a supplier writes that the account has changed and the money is due today. A clerk with a written rule, who knows that calling back is expected and not rude, makes the call. A clerk who was only told to be careful often pays.

‍

Make the call-back normal. Say in training and in the procedure that verification is part of the job and that no supplier will be offended by it.

‍

Report what looks odd. A lookalike domain or an unusual urgency is worth a message to the security team, even when the clerk did not act on it. Our guide to business email compromise training for finance teams covers what to teach.

‍

Then test the procedure with the people who run it. Whitebait runs phishing simulation for UAE and GCC organizations, with Arabic and English templates, and tracks reporting rate next to click rate. Send a supplier bank-detail change scenario first to the staff who can edit the vendor master. A reporting rate that rises while the click rate falls tells you the habit is forming.

‍

When someone does act on a doubtful request, the lesson lands best straight away. Zero-Touch Training responds when a person shows a security risk, with training matched to the behavior, delivered inside Microsoft Teams in the flow of work.

‍

Start With One Page

Return to the clerk holding a new account number the day before the payment run. With a log, a verified number and a second approver in place, the request costs a few minutes and the real supplier gets paid. Without them, the transfer can leave before anyone doubts it.

‍

This week, write the six steps on one page, name who places the call in each team, and share it with everyone who can edit a supplier record.

‍

Frequently Asked Questions

What is bank details change fraud?

‍

A criminal impersonates a supplier, or uses a compromised supplier mailbox, and emails a request to pay future invoices into a new account. Abu Dhabi Police warn that it is often discovered only after the transfer is complete, so the check has to happen before the payment leaves.

‍

What if we cannot reach the supplier's known contact?

‍

Leave the existing bank details in place and try a second contact on the contract or the supplier's account manager. Never use a number from the request itself. If the payment is due, tell the approver and record the delay, because a late payment can be explained to a supplier and a payment to the wrong account may not be recoverable.

‍

Who owns invoice fraud prevention, finance or security?

‍

Both. The controller owns the procedure, the approval limits and the call log. The CISO owns mailbox security and the route for staff to report suspicious requests. Reviewing a sample of changed accounts together each quarter keeps either side from assuming the other has checked.

‍

Does the same procedure fit every sector?

‍

The steps stay the same. What changes is who places the call and where requests enter: procurement in a hospital group, one form or ticket in retail, central payables in a university. Decide those two points for your own organization, then apply the six steps without exceptions.

A security awareness manager sits down for the monthly review with two numbers already in hand, the click rate and the training completion rate, and a question from the CISO about what changed since last month. Both numbers are easy to pull and hard to act on. This post is for program owners who need security awareness metrics to run the program on, not only to report upward.

‍

In short: Track reporting rate, time to report, repeat behavior, coverage and time to response, and read each one by role and department. Keep click rate and completion as context. Tie every metric to the action it triggers.

‍

Operational Metrics Versus Board Metrics

Board reporting asks whether human risk is falling and whether the program deserves its budget. The monthly review asks something narrower: which people, in which teams, need something different next month. We cover the first question in Security Awareness KPIs for the Board on One Page, including how to frame security awareness board reporting. This post covers the layer underneath it.

‍

That layer matters because the board page is a summary of it. If the monthly numbers are thin, the summary inherits the weakness. NIST's SP 800-50 Rev. 1 includes suggested metrics and evaluation methods so that organizations can regularly improve and update a learning program, which is the job the monthly review does.

‍

Security Awareness Metrics for the Monthly Review

Completion and click rate describe activity. They show who finished a module and who fell for a lure, but not whether people are getting better at spotting and reporting attacks. Five measures close that gap.

‍

• Reporting rate. The share of people who report a simulated or real suspicious message. Whitebait tracks it next to click rate.
• Time to report. How long passes between delivery and the first report. A shorter time gives the security team a head start.
• Repeat behavior. The share of people who fail again within a set window, counted per person and not per campaign.
• Coverage. The share of people, roles and attack types (credential harvesting, QR codes, MFA bypass) actually exercised in the period.
• Time to response. How long passes between a risky behavior and the coaching that follows it.

‍

Reporting is the one to read first. The Verizon 2024 Data Breach Investigations Report found that in security awareness exercise data from 2023, 20% of users identified and reported phishing in simulation engagements, and 11% of the users who clicked the email also reported it.

‍

‍

Those figures come from a wide pool, so use them as a reminder that reporting varies between people and can be measured. In your own program, watch how your reporting rate moves from month to month. A click followed by a report is a better outcome than a click in silence, because the security team hears about the lure while it is still live.

‍

Reading Human Risk Metrics by Role

A company-wide average hides the people who matter most. A reporting rate can look healthy overall while accounts payable and executive assistants sit well below it, and those are the roles that handle bank-detail changes and calendars full of other people's requests.

‍

Human risk metrics become useful once they are cut by role, department and exposure. Odin scores each employee continuously and weights role criticality, so the review can start with the roles where a mistake costs the most. Our guides to human risk assessment by role and department and the human risk score describe what goes into those numbers.

‍

Then look at direction per person, not at the campaign average. Graybait tracks individual susceptibility over time, weakness coverage and difficulty progression, so a program that runs without campaigns still produces the per-person trend the review needs.

‍

Connect Each Metric to an Action

A metric earns its place in the review only if a result changes something. Slow time to report in one department points to a reporting habit problem, which a one-tap report button and a short nudge can address. Repeat behavior in one role points to training that does not match the work, which role-based micro-learning addresses.

‍

Time to response is the easiest metric to leave out. When the gap between a risky behavior and the training that follows is days long, the lesson arrives after the moment has passed. Zero-Touch Training responds at once with training matched to the behavior, inside Microsoft Teams, which removes the delay between exposure and response, and the metric shows it.

‍

Run the Review in Five Steps

1. Pull the five measures for the last 30 days, by role and department.
2. Flag the groups that moved furthest from their own previous month.
3. Name one action and one owner for each flagged group.
4. Check last month's actions against this month's numbers.
5. Choose which results move up into the board view.

‍

Compare each group with its own history before comparing it with anyone else. Roles, sectors and languages differ, and your first few months of data are the most honest baseline you have. In a GCC workforce that receives simulations in Arabic and English, read each language group against its own history as well.

‍

Your Next Monthly Review

Back at the monthly review, the click rate and the completion rate are still on the screen, and now they have company. Add reporting rate and time to report for the next one, cut by role, and attach one action to each result. Once those two run steadily, the board view is a selection from data you already trust.

‍

Frequently Asked Questions

What are the most useful security awareness metrics?

‍

Reporting rate, time to report, repeat behavior, coverage and time to response give the most to act on. Together they show whether people notice attacks, how fast they speak up, whether habits change and whether every role is being exercised. Click rate and completion remain useful as context alongside them.

‍

How often should I review security awareness metrics?

‍

Monthly suits the operational view, because 30 days is enough for simulations and training to produce a change you can see by role. Weekly checks suit specific alerts, such as a department with a sudden drop in reporting. The board view can then draw on the monthly results at whatever interval the board meets.

‍

How do human risk metrics differ from security awareness KPIs?

‍

Security awareness KPIs summarize program performance, such as reporting rate across the organization. Human risk metrics describe individuals and groups, such as a person's risk score, a role's repeat behavior or how fast a team responds. The second set feeds the first, and it is where the monthly actions come from.

‍

Is click rate still worth tracking?

‍

Yes. Click rate shows how convincing a lure was for a given group. Read it next to reporting rate and time to report, because a group that clicks but reports quickly is in a different position from one that clicks and stays silent.

Security teams in the UAE tend to inherit awareness tooling in pieces: a training library bought one year, a phishing tool the next, and a spreadsheet that ties neither to what a person actually does. That patchwork is hard to defend in front of a board or an auditor. This guide is for CISOs and awareness managers choosing one cybersecurity awareness platform UAE organizations can run end to end.

‍

In short: a good platform trains people in Arabic and English, simulates varied attacks, scores risk per person, acts on that score automatically, and reaches staff inside their daily tools. Fraus covers each of these, and the sections below show how.

‍

What a Cybersecurity Awareness Platform UAE Buyers Need

Most programs start as a training purchase and add the rest later. A phishing tool arrives after an incident, reporting gets built by hand, and Arabic-speaking staff receive a translated course. Each piece works alone, and none of them knows what the others saw.

‍

That gap matters. The Verizon 2026 Data Breach Investigations Report puts the human element in 62% of breaches, up from 60% in the 2025 edition, as Infosecurity Magazine reports. Behavior between yearly courses is where that risk builds, and a patchwork cannot see it.

‍

‍

A platform worth buying covers five jobs in one place: training in the language people work in, simulation of the attacks they will meet, risk scoring per person, automatic action on that score, and delivery where staff already work. The rest of this guide takes them in turn and names the Fraus product behind each.

‍

Training in Arabic and English

A cybersecurity awareness training platform starts with the lesson. Codex delivers security awareness training in Arabic and English, so a warehouse supervisor and a finance director each learn in the language they work in. Whether the Arabic was authored or translated is worth testing, and the evaluation below includes that test.

‍

Codex uses agentic AI-driven micro-learning: bite-sized, targeted lessons built into everyday work, which Fraus's agentic AI recommends or assigns to each person from their training gaps and behavioral signals. Learning paths are role-based, and lessons draw on real-world scenarios, including deepfake awareness, business email compromise, and Shadow AI and GenAI risk.

‍

Nudges and compliance mapping sit in the same product, so the training record and the audit evidence come from one place. For a longer checklist on training alone, see our security awareness training UAE buyer's checklist.

‍

Phishing Simulation Without Gaps

Training tells people what to look for. Simulation shows whether they do it under pressure, and a single template library gets learned by heart. Whitebait runs phishing simulation for UAE and GCC organizations with AI-recommended campaigns, MFA bypass, QR code and credential harvesting scenarios, and Arabic and English templates. It tracks reporting rate next to click rate.

‍

Harder exercises come from Blackbait, whose AI runs OSINT reconnaissance on selected targets and escalates attacks autonomously. Dolus AI Studio turns an email screenshot or prompt into an editable template, so a suspicious message your staff actually received can become an exercise.

‍

Small teams often cannot plan and review campaigns every month. Graybait is the campaign-less option. Setup takes four steps, then it runs for twelve months through agentic AI, choosing each employee's next simulation from their Human Risk Profile, and the team steps in only when the system asks. Our guide to the phishing simulation platform UAE buyers compare goes deeper.

‍

Risk Scoring That Drives Action

Training and simulation produce results. A human risk management platform decides what to do with them. Odin scores each employee's risk continuously, builds individual threat profiles, weights scores by role criticality and escalates automatically. A payments officer and a facilities coordinator can fail the same simulation and still deserve different responses.

‍

A score matters only when something follows it. Agentic Automation Rules take triggers from simulation results, identity, endpoint, data loss prevention, directory, training and risk score events, and assign nudges, modules, videos, policies or posters. They can also notify role groups or the employee's manager. Higher-stakes actions such as step-up MFA or a finance approval hold always wait for analyst approval, and every agentic action is logged for audit.

‍

The response to a click is the clearest test of the whole chain. Zero-Touch Training delivers just-in-time coaching: when someone shows a risk, Fraus responds at once with training matched to the behavior, inside Microsoft Teams, with no manual step.

‍

Reach, Tenancy and Deployment

Staff rarely open a separate portal by choice. The Fraus Teams App shows Odin risk scores, one-tap phish reporting, policy acknowledgement and micro-training inside Microsoft Teams, so reporting a suspicious message takes one tap.

‍

For managed providers and groups with several entities, Multi-Tenant and MSSP gives each client or entity a separate environment, with approval workflows and an audit trail.

‍

Hosting decides many UAE purchases. Fraus is built in Dubai, can be hosted on UAE or GCC servers or deployed fully on-premise, holds ISO/IEC 27001 certification and UAE Information Assurance (UAE IA) compliance, and is aligned with the NIST Cybersecurity Framework. Any security awareness platform UAE procurement teams shortlist should state its hosting and certifications in writing.

‍

Evaluate Against Your Own Week

A demo shows a product on its best day. Build the evaluation from your own week instead, give every shortlisted platform the same tasks, and score the results:

‍

• Open a lesson as an Arabic-speaking employee and judge whether it reads as written for Arabic.
• Set up one simulation for finance and one for a general role, and check that the lures differ.
• Let a test user click, and time how long coaching takes to arrive.
• Ask where the risk score comes from and what it triggers.
• Request hosting options and certification evidence in writing.
• Ask how a second entity or client would be added.

‍

Then ask who has to keep it running. A platform that needs an administrator to launch every campaign and read every dashboard drifts once attention moves elsewhere. One that acts within guardrails keeps going, which is the design of Graybait and the automation rules above.

‍

Go back to the patchwork from the start. List the tools your program uses today and mark which of the five jobs each one covers. Where two tools cover one job, or none covers it, you have your first evaluation question. Then ask for a Fraus walkthrough starting from Codex and your own list.

‍

Frequently Asked Questions

What should a cybersecurity awareness platform include?

‍

At minimum: training in the languages your staff use, phishing simulation, per-person risk scoring, automation that acts on that score, and reporting for audit. Add delivery inside the tools staff already use, support for multiple entities if you manage clients, and hosting that meets your data location rules. Fraus covers these through Codex, Whitebait, Odin, Agentic Automation Rules, the Teams App and its deployment options.

‍

Is one platform better than separate tools?

‍

Separate tools each hold part of a person's story. A click in a simulation, a missed lesson and a role with payment authority only add up when one system sees all three. One platform lets the risk score drive training and escalation without manual exports, and it gives the security team a single place to report from.

‍

Can the platform run on UAE servers or on-premise?

‍

Yes. Fraus can be hosted on UAE or GCC servers or deployed fully on-premise. It is available in Arabic and English, holds ISO/IEC 27001 certification and UAE IA compliance, and is aligned with the NIST Cybersecurity Framework. Ask any shortlisted platform for the same facts in writing, including where each component is hosted.

‍

How does a human risk management platform differ from awareness training?

‍

Training delivers lessons. A human risk management platform also measures each person's behavior, scores risk by role and exposure, and responds with training, policies or escalation. Odin does this in Fraus. Our post on human risk management vs security awareness training sets out the difference in more detail.