EXCUBO
ENES
Free · Private · About 10 minutes

Impersonation Readiness Check

Fifteen questions on payments, phone, email, staff and AI tools. You get a 0 to 100 score, a band, and a one-page report with your top 3 fixes and the templates to close them.

Your answers stay in this browser tab. Nothing is sent, saved or tracked. Close the tab and they are gone.

Why it matters: in 2025 the FBI’s Internet Crime Complaint Center recorded $3,046,598,558 in reported business email compromise losses. Sources and method.

Payments

1Before you change a supplier's, customer's or employee's bank details, do you always call them back on a number you already had, never one from the request? Critical

Covers emails, letters, calls and WhatsApp messages that ask you to pay a new account.

2Do payments above a set amount need approval from two people? Critical

If you work alone, count a second check by another channel, such as a call-back, as the second person.

3Does everyone know that a request marked urgent or confidential means “verify first”, even if it seems to come from the boss?

Phone

4Do you use a code word, or a question only the real person can answer, for urgent requests by phone, voice note or video call?
5Does your team know not to trust caller ID, and to hang up and call back on a known number?

Caller ID and the name shown in chat apps can be faked.

6Do you know how much of the owner's or managers' voices is public (videos, podcasts, voicemail greetings) and keep it to what you need?

Email

7Is multi-factor sign-in (a code, app or security key as well as the password) turned on for your email and online banking? Critical
8Is your email domain set up with SPF, DKIM and DMARC?

These records make it harder for others to send email in your domain's name. Your email or web provider can tell you.

9Before acting on an email about money, does your team check the full sender address for lookalikes?

For example rn instead of m, or an extra letter in the domain.

Staff

10Has everyone who handles payments or answers the phone been briefed on voice cloning and CEO fraud in the last 12 months?
11Does everyone know who to tell when something feels off, and that they won't be blamed for checking?
12Do you limit what is public about who approves payments and how (website, social media, job ads)?

AI tools

13Do you have a list of the AI tools and assistants that can reach your email, files or accounts?

Include chat assistants, meeting note-takers, browser extensions and agents.

14Is it impossible for any AI tool or agent to send a payment or change bank details without a person approving it? Critical

If you use no AI tools with access to money, answer Yes.

15Do you keep passwords away from AI tools, and have you checked what your bank's terms say about AI agents?

Yes scores 2, Partly 1, No or Not sure 0. Four critical controls count double. How the score works.

Want the templates first? Open the free template kit.