The Open Gate at Midnight
An email that looks exactly like the director asks to wire the grant — and only one rule stands in the way.
Friday, 6 PM. The shelter just landed its biggest grant ever. Amir closed the laptop, proud.
Forty beds funded for a year. Best week we've ever had.
11:58 PM. Like Jacob in his brother's clothes, an email glides in wearing the director's face. Chaos had been watching all week.
Chaos (off-panel): Amir — urgent. The grant has to be wired to this new account TONIGHT or we lose it. Don't call, I'm in a meeting. — The Director
It had her name, her sign-off, even her usual typo. Amir's cursor drifted toward 'Send Payment.'
She always says 'tonight' in caps when it's urgent… it really looks like her.
Chaos (off-panel): That's it. You're tired. It's late. Just click. Clicking is so easy…
A blue glow rose from the keyboard. IP Bot had been quietly watching the outbox.
Freeze, Amir. New account + 'tonight' + 'don't call' is the oldest trick in Business World. Of course it looks like her. Chaos always wears a familiar face.
Masked Crewsader landed on the windowsill, calm as the moon.
There's one rule that beats every mask: verify any money movement by a second channel. The wolf can wear grandmother's bonnet — but it can't pass the test of a voice you already trust. Don't reply to the email. Call a number you already have.
And make it the rule for EVERYONE — even the boss. Especially the boss.
Amir dialed the director's real cell — the one saved in his phone for two years.
Hey, sorry to call so late — did you just ask me to wire the grant to a new account?
…You're asleep. You sent nothing. Got it.
The mask cracked. Chaos shrieked from the screen.
Chaos (off-panel): NO! Not the second channel! My one weakness — an honest phone call!
The fake account vanished. The forty beds stayed funded.
While we're here: MFA on that email so no one can wear her face again, and kill the logins of anyone who's left.
By Monday, 'verify by a second channel' was taped above every desk.
MFA, least access, kill old logins — and that one phone call. Small locks, kept locked, stop almost every break-in.
The lesson
The #1 real threat is a familiar-looking email asking you to move money. Verify by a second channel before you act — for everyone, including the boss — and back it with MFA on email.
Ready to reach your Pitch?
You don't need a full-time CTO to do this right. Island Pitch works as your Fractional CTO — senior technology leadership at a nonprofit's budget, helping you choose well, lock the doors, and sleep at night.
Get the whole field manual
Every concept in this story — and six more chapters — in one printable PDF.
The field manual is yours — grab it now.
Our signup form is being upgraded. In the meantime, here's the full PDF — no form to fill out.
Download the field manual (PDF)Want occasional tech tips by email too? Talk to a Fractional CTO above — we'll get you on the list.