How the readiness check works

1 What it measures

Fifteen everyday practices, in five areas (payments, phone, email, staff and AI tools), that make impersonation fraud harder to pull off. It looks at habits and rules, not technology. It does not scan or test any system.

2 How the score works

• Yes scores 2, Partly 1, No or Not sure 0. If you're not sure a protection is in place, the check assumes it isn't.
• Four critical controls count double: the call-back rule (question 1), two-person approval (2), multi-factor sign-in (7) and a person approving every AI-initiated payment (14).
• The maximum is 38 points. Your score is your points divided by 38, times 100, rounded.
• Bands: 0 to 49 High exposure, 50 to 79 Partly ready, 80 to 100 Ready.
• If any critical control scores 0, the band is capped at Partly ready. The number still shows your real score.
• Top 3 fixes: the biggest weighted gaps come first. Ties go to the quicker fix, then to question order. Each fix links to a template in the kit.

3 Limits

This is a self-assessment, not an audit, a certification or a guarantee. A good score lowers the odds; it can't rule fraud out. The questions will be refined with feedback from a small group of pro bono pilot businesses.

4 Privacy

The check runs entirely in your browser. Your answers are not sent, saved or tracked: there are no cookies, no storage and no third-party scripts, and the site's security policy blocks any network requests from the page. The report exists only on your device. See the privacy note.

5 Why it matters: sources

• FBI Internet Crime Complaint Center, 2025 Internet Crime Report. Business email compromise: 24,768 complaints and $3,046,598,558 in reported losses. AI-related complaints: 22,364, with $893,346,472 in losses. “In 2025, businesses reported losses over $30 million to BEC scams involving AI.” ic3.gov 2025 report (PDF)
• INCIBE, Balance de ciberseguridad 2025 (Spain). 122,223 cybersecurity incidents handled. Top topics in company queries to its 017 helpline: impersonation (“Suplantación de identidad por imitación”) 18%, phishing 12% and CEO fraud (“Fraude CEO”) 9%. INCIBE press release · Balance 2025 (PDF)
• Europol, EU Serious and Organised Crime Threat Assessment 2025. “The addition of AI-powered voice cloning and live video deepfakes amplifies the threat, enabling new forms of fraud, extortion, and identity theft.” EU-SOCTA 2025 (PDF)

Questions or corrections: hello@excubohq.com. The check and the kit are free.