Annual security training fails when it is generic. People remember stories about their own money movement. Build the hour around how your organization actually pays vendors, shares files, and resets passwords.
Three checks
Channel. Did this request arrive the way this person usually asks? A wire change that appears only in email, from a cousin of the real domain, is the classic pattern.
Pressure. Urgency, secrecy, and “do not call me” are features of the fraud, not of your leadership. Give staff permission to slow down.
Out of band. Confirm payment changes and credential requests on a known number or in person. Do not reply to the message that made the request.
What to do with a suspicious message
Do not forward it around the office for opinions. Report it to the person who runs security or managed support, and do not click to “see if it is real.” One reported miss is a success. One paid invoice to the wrong account is the lesson nobody wants.
Close the hour by showing a real redacted example from your industry if you have one, and by naming who answers when someone is unsure. The point is a reflex, not a certificate.