What social-engineering applications commonly ask
Wording differs by carrier, but the same questions keep coming up.
- Training. Do people who send payments or change bank details get anti-fraud training on social engineering, at least once a year? Describe it.
- Vendor bank changes. Are changes confirmed by calling the vendor back at a number already on file, not one from the request?
- Requests from inside. Are payment requests that seem to come from executives verified, including by phone?
- Second approval. Do transfers over a set amount need a second person's approval, and what is the amount?
- Reporting. Can staff easily flag a suspicious request?
What your client gets
- A 15-minute simulation for the people who move money: a hacked vendor mailbox, a fake executive, a cloned-voice call, a payroll direct-deposit change, and one request that's real
- Their own names, approval limit and callback rule in the game
- A manager report of who practiced, when and how they did
- With the Small Office or Business plan, a renewal worksheet that lines up those questions with what the team actually practiced, plus an editable description of the training
What it isn't
- It isn't an attestation, certification or audit, and no insurer has approved it
- It doesn't change anyone's coverage, eligibility or premium
- It doesn't replace a written callback rule or dual approval. It helps a team practice the rules the client already has
- Your client answers their own application. The worksheet reminds them to make sure every answer is true of their real process
Share it with clients
Make a one-page sheet that says it was shared by your agency. It includes a QR code to the free demo and a note that it isn't insurance advice.
Want to refer clients, or share the free challenge with your book of business? Contact ShiftPoint Crisis Labs. We're an Iowa company, and you'll hear back from the founder by email.