A 45-minute, CPD-assessed course about what staff do in the moment: the well-written email from a real address, the call from someone who sounds exactly like a colleague, the prompt they did not trigger, and the minutes after they realise they have clicked. Rewritten for 2026, and scheduled, chased and certified for you.
Some of the most familiar security advice gives people false confidence now. The course teaches the behaviour that survives AI-written lures and cloned voices.
Look for spelling mistakes and odd addresses
Attackers write with the same tools as everyone else. Judge what the message asks you to do and the pressure it applies: authority, urgency, emotion, scarcity, current events.
Change your password regularly
Forced expiry pushes people into predictable variations. Use a different password for every account, a password manager, and three random words where one has to be remembered.
A familiar voice is a safe check
Voices and faces can be cloned. Call back on a number you already hold, keep two people on any payment, and verify people calling from IT too.
Delete the suspicious email
Report it, including when you have already clicked. The delay caused by embarrassment is what turns a contained incident into a reportable breach.
Written for UK financial services firms, where the target is usually a payment, a client file or a route into a larger client.
Why attacks arrive through people rather than machines, what the firm is required to do, why a firm this size is worth attacking, and what an incident really costs, which is mostly not the ransom.
The test that still works when the email is perfectly written: what is it asking you to do, and what pressure is it applying? Where attacks come from, and what happens next once a password is taken, including the mailbox rule that hides the replies.
One password per account and a password manager, multi-factor authentication and why not all of it is equally strong, devices outside the office, client data, AI tools and where the data goes, and the part that has nothing to do with computers.
Voice and video impersonation: the requests to slow right down for, how to verify properly by calling back on a number you already hold, the support desk route attackers use to reset passwords, and when it follows you home.
Why speed is the whole of it, what to do if you think you have already clicked or already told them something, what else to report, and suppliers and the incident reporting regime arriving in March 2027. Includes a filmed scenario.
What it looks like from a desk, why data is copied out before it is encrypted, why paying is never a decision anybody takes at a desk, working safely while systems are down, and the backup question.
What a good one looks like in practice, what to take away and three things to do this week, followed by the test and the certificate.
An incident costs weeks of not working, telling clients and answering the regulator. The controls that prevent most of them take seconds. By the end, a learner can:
A short film, shot for Fundsure with the same cast across the catalogue, puts the learner beside a colleague who has received a message that is not quite right. The learner chooses what he should do, and is told why the tempting answers are wrong: replying to check whether it is genuine, opening the link carefully to see where it goes, or deleting it because no harm has been done.
The test at the end draws 10 questions from a bank of 30, with a pass mark of 80%, and a pass issues a named, CPD-marked certificate that anyone can check online.
Checked against NCSC, FCA and ICO guidance. Last checked Sept 2026.
The FCA, PRA and Bank of England confirmed on 18-Mar-26 a single regime for reporting serious operational and cyber incidents and material third-party arrangements. Firms are in the preparation year now.
Cloned-voice calls are an ordinary fraud route now, not a curiosity. Hearing a familiar voice or seeing a familiar face on a call is no longer verification.
The 2025 attacks on UK retailers began with somebody talking their way past a support desk into a password reset. Verifying the person, including when they are calling from IT, is now a core behaviour.
Pasting a client document into a consumer assistant is client data leaving the firm. The approved tool on the firm's account is a different thing from a personal login, and transcribers and browser extensions are the same problem.
Modern ransomware copies data out before it encrypts, which is why “we have backups” stopped being a complete answer, and many of the groups are sanctioned, so paying can be an offence of its own.
A large share of incidents now arrive through a supplier, an outsourced support function or a managed service, which the course covers alongside the firm's own systems.
Almost every incident that reaches a regulated firm arrives through a person. The FCA expects systems and controls adequate for the business and the ability to keep important services running, and the ICO expects staff to know how to escalate a breach. Trained staff, and a record that shows it, are part of all of that.
In the Fundsure Portal the course is scheduled for everyone each year, chased before the deadline, and every sitting, score and certificate is kept and carried into the compliance officer’s report to the board.
How the portal runs trainingCybersecurity Awareness plus Data Protection, Operational Resilience, AML and CTF, Conduct Rules and the rest of the catalogue of 20, with no per-course fees.
UK data protection for a regulated firm, including what to do when personal data goes astray.
See the courseKeeping important services running when a supplier or system fails.
See the courseThe annual anti-money laundering course, where payment fraud and laundering meet.
See the courseWhy paying a ransom to a sanctioned group is a separate offence.
See the courseWe will send you a link to take the whole course, filmed scenario and test included, or walk you through the portal with a demonstration firm.
