The Open Gate at Midnight
An email that looks exactly like the director asks to wire the grant — and only one rule stands in the way.
The Trickster in a Familiar Face — in the tradition of Jacob & Esau and the wolf at the door
Friday, 6 PM. The shelter just landed its biggest grant ever. Amir closed the laptop, proud.
Forty beds funded for a year. Best week we've ever had.
11:58 PM. Like Jacob in his brother's clothes, an email glides in wearing the director's face. Chaos had been watching all week.
Amir — urgent. The grant has to be wired to this new account TONIGHT or we lose it. Don't call, I'm in a meeting. — The Director
It had her name, her sign-off, even her usual typo. Amir's cursor drifted toward 'Send Payment.'
She always says 'tonight' in caps when it's urgent… it really looks like her.
That's it. You're tired. It's late. Just click. Clicking is so easy…
A blue glow rose from the keyboard. IP Bot had been quietly watching the outbox.
Freeze, Amir. New account + 'tonight' + 'don't call' is the oldest trick in Business World. Of course it looks like her. Chaos always wears a familiar face.
Masked Crewsader landed on the windowsill, calm as the moon.
There's one rule that beats every mask: verify any money movement by a second channel. The wolf can wear grandmother's bonnet — but it can't pass the test of a voice you already trust. Don't reply to the email. Call a number you already have.
And make it the rule for EVERYONE — even the boss. Especially the boss.
Amir dialed the director's real cell — the one saved in his phone for two years.
Hey, sorry to call so late — did you just ask me to wire the grant to a new account?
…You're asleep. You sent nothing. Got it.
The mask cracked. Chaos shrieked from the screen.
NO! Not the second channel! My one weakness — an honest phone call!
The fake account vanished. The forty beds stayed funded.
While we're here: MFA on that email so no one can wear her face again, and kill the logins of anyone who's left.
By Monday, 'verify by a second channel' was taped above every desk.
MFA, least access, kill old logins — and that one phone call. Small locks, kept locked, stop almost every break-in.
The lesson
The #1 real threat is a familiar-looking email asking you to move money. Verify by a second channel before you act — for everyone, including the boss — and back it with MFA on email.
Ready to reach your Pitch?
You don't need a full-time CTO to do this right. Island Pitch works as your Fractional CTO — senior technology leadership at a nonprofit's budget, helping you choose well, lock the doors, and sleep at night.
Get the whole field manual
Every concept in this story — and six more chapters — in one printable PDF.
The field manual is yours — grab it now.
Our signup form is being upgraded. In the meantime, here's the full PDF — no form to fill out.
Download the field manual (PDF)Want occasional tech tips by email too? Talk to a Fractional CTO above — we'll get you on the list.