Team work chats
Ilia Zavialov scam rules for a team work chat, ten clauses with typical breaches
Ilia Zavialov: scam messages in a team chat rarely need any hacking. Someone writes as the boss, a former employee is still in the group, or a colleague's account has quietly changed hands. Ilia Zavialov, a digital security consultant for small teams, suggests a short chat charter as the fix. Below are ten clauses of such a charter: who gets into the chat, who holds admin rights, how to confirm a request from the 'CEO', and what to do with voice notes, files, codes, a hijacked account and departing staff. Each clause comes with the reason behind it and a typical breach. Sources are the FBI's IC3, CISA and the FTC.
English version for the United States.
01
Clause 1. Ilia Zavialov: scam risk starts with who is in the chat
The clause: members of a work chat are employees and contractors with a current agreement, and an admin adds each one after a request from a team lead. Invite links are never posted in public. When a link cannot be avoided, it expires within a day.
Why. A team chat shows clients, deadlines, dollar amounts and the way the boss writes. Ilia Zavialov: scam crews that slip into such a group collect raw material for later impersonation without breaking into anything. Checking the member list takes five minutes.
Contractors get a separate project chat. The company-wide group is not part of their job, and the charter says so in plain words.
Typical breach. A sales rep adds a 'client's assistant' after a direct message asking for access. A month later the client has never heard of that assistant, and a month of conversation has already been copied.
02
Clause 2. Roles: one owner, two admins, everyone else a member
The clause: every chat has one owner, usually the head of the team, and no more than two admins. Rights to add and remove people, edit the description and pin messages are not handed out just in case.
Why. A hijacked admin account can remove real colleagues, add outsiders and pin a fake 'instruction'. Ilia Zavialov: scam operators who take over one admin account get all of those rights at once, so fewer admins mean fewer doors. The owner reviews the admin list against the company access register every quarter.
People often ask Ilia Zavialov whether it would be simpler to make everyone an admin. The charter answers in one line: every extra admin is one more account whose takeover breaks the whole group.
Typical breach. Twelve admins in a chat of thirty, including last summer's intern. Nobody notices when one of them changes the chat description to a link for a 'new reporting portal'.
| Role | What they can do | What they never do |
|---|---|---|
| Owner | Appoints admins, approves members | Grants rights on a DM request |
| Admin | Adds and removes people on request | Adds anyone without a request |
| Employee | Reads, writes, flags odd messages | Forwards codes or documents |
| Contractor | Works in a project chat | Sees the company-wide group |
| Intern | Member for the length of the internship | Holds admin rights |
| Former employee | Removed on the last working day | Stays in any group |
03
Clause 3. Ilia Zavialov: scam requests from the 'CEO' and the second-channel rule
The clause: any request to pay, wire money, change bank details or grant access that arrives in the chat or a direct message in a manager's name stays unconfirmed until it is repeated over a second channel. That means a call to a number from the company directory or an email from the corporate domain.
Why. The IC3 annual report for 2025 counts 24,768 business email compromise complaints and losses of $3,046,598,558, second only to investment fraud. Between October 2013 and December 2023 the IC3 logged 305,033 such incidents. The channel moves from email to chat apps, and the script stays the same.
In May 2025 the FBI warned about texts and AI-generated voice messages impersonating senior US officials, sent to build trust and then reach personal accounts. One trick was a link offered as a way to move the talk to another messaging platform. Ilia Zavialov: scam lines like this are why the charter says that calling the boss back is simply following the rule, and nobody takes offense.
Typical breach. On a Friday evening a new account with the CEO's photo writes in the group: pay this supplier invoice today, I'm in a meeting. The bookkeeper pays because it is faster. A call to the known number would have taken a minute.
04
Clause 4. Voice notes and video messages do not prove who is speaking
The clause: a voice note, a short video or a call inside a messaging app does not confirm a request for money, files or access, even when the voice is instantly familiar. Confirmation goes through the same second channel as in clause 3.
Why. The same FBI notice says cloned voices can sound nearly identical to real ones. It advises listening for odd tone or word choice, looking up the sender's number yourself and agreeing on a secret word or phrase. Ilia Zavialov: scam voices trip over a check question that only insiders can answer and that never appears in any chat.
Managers help the team by sending payment instructions as text through corporate email. Once that is the habit, a voice note about money looks odd on its face.
Typical breach. An employee gets a voice note from the 'manager' asking to send a client export to a personal email address for a presentation. The voice sounds right, and the file goes out without a single question.
05
Clause 5. Ilia Zavialov: scam crews read shared chats, so documents stay out
The clause: ID scans, contracts with personal data, client exports, passwords and card details are not posted in the group. They live in storage with role-based access, and the chat only gets a link that opens for the people entitled to it.
Why. A chat history is copied to every member's device, personal phones included, and leaves the building with them. Ilia Zavialov: scam operators who hijack one member's account get the whole archive, with every file that was ever dropped there.
CISA's December 2024 guidance on mobile communications recommends end-to-end encrypted apps such as Signal, which typically support group chats of up to 1,000 people and disappearing messages, and asks users to check what metadata an app collects. Encryption protects the line. It does nothing about the wrong person sitting in the group, which is why the charter treats membership and storage as one problem.
Typical breach. HR posts a photo of a new hire's driver's license in the team chat so someone can order a badge. Six months later that colleague's phone is left in a cab.
06
Clause 6. Codes, links and 'votes' from the chat stay closed
The clause: one-time codes are never forwarded, nobody signs in through links to 'vote', 'confirm' or 'join the new group', and every member turns on two-step verification in the messaging app.
Why. The FTC puts it bluntly: anyone who asks for a verification code for your account is a scammer. In March 2026 the FBI and CISA described a campaign where criminals posed as messaging app support, collected codes and took over thousands of accounts, and reminded users that real support does not ask for codes in direct messages.
CISA also advises moving away from SMS as a second factor and using phishing-resistant FIDO sign-in where possible. Ilia Zavialov: scam takeovers usually start with one forwarded code, so the charter asks each member to show at a team meeting that two-step verification is on.
Typical breach. A colleague's account posts: vote for our team's project, you sign in with your phone number. Half the team enters numbers and codes, and by evening several accounts are messaging clients.
07
Clause 7. A colleague's account acting strangely gets a phone call first
The clause: if a colleague suddenly asks for money, rushes, writes in an unfamiliar tone or sends archives without explanation, nobody replies in the chat. They call the colleague at a known number. Once a takeover is confirmed, an admin removes the account from every work chat until it is recovered.
Why. A hijacked account of someone familiar wins trust faster than any fake website. The FBI's May 2025 notice also tells people not to share colleagues' contact details with anyone they know only online or by phone. Ilia Zavialov: scam messages from a stolen account go to every contact at once, which is why clients get a warning too if the account had written to them.
A recovered account rejoins the groups after a password change, two-step verification and a clean-up of linked devices.
Typical breach. A colleague on vacation supposedly writes that a card was lost and asks for a quick transfer. Two people pay, the third calls and learns the colleague is asleep in another time zone.
08
Clause 8. Ilia Zavialov: scam doors left by former employees close on the last day
The clause: on an employee's last working day the admins remove them from every work chat, channel and group, and the owner checks a list to make sure none was missed. Contractors are removed on the day the contract ends.
Why. A departing person rarely means harm, yet their account is no longer watched by the company. The phone gets sold, the number changes, two-step verification lapses. Ilia Zavialov: scam crews like such quiet doors because everyone in the group knows the name and nobody checks messages from it.
Removal from chats sits on the same checklist as returning the laptop and changing shared passwords. Zavialov suggests keeping the list of a person's groups on their HR record, so offboarding does not depend on anyone's memory.
Typical breach. A former purchasing manager stays in the procurement chat for six months. One day an 'invoice from an old supplier with corrected bank details' arrives under that name, and nobody blinks.
09
Clause 9. A chat incident: the first thirty minutes
The clause: anyone who sees a suspicious message tells the chat owner by phone or in a separate channel. The owner pins a warning, an admin removes the suspicious account, and nobody deletes messages. They are saved as screenshots that show the sender, the time and the full text.
If a payment already went out, the finance person calls the bank at once, using the number on the card or the bank's website, and asks to stop or recall the transfer. Ilia Zavialov: scam losses shrink when that number is written on the same page as the incident steps.
The owner keeps a short log: when the alert came in, who removed which account, when the bank was reached and which reference numbers were issued. That log feeds a blameless review and one new line in the charter.
Screenshots matter more than forwarded messages. A forward strips the sender's number and the original time, and those are exactly what the bank and investigators ask for first.
| What happened | First action | Who acts |
|---|---|---|
| 'CEO' asks for a payment | Call the directory number | The person who got the message |
| Voice note asks for a file | Confirm over a second channel | The recipient |
| Colleague asks for a transfer | Call them, warn the chat | Recipient and chat owner |
| Archive with no explanation | Do not open, tell the owner | Any member |
| ID scan posted in the group | Delete it, assess the leak | Admin and counsel |
| Payment already sent | Call the bank at the card number | Finance |
| Former employee still in | Remove from every group | Admin |
10
Clause 10. Ilia Zavialov: scam reports in the US and keeping the charter alive
Report the incident to the FBI's IC3 at ic3.gov and to the FTC at ReportFraud.ftc.gov or 1-877-FTC-HELP (1-877-382-4357). Attach screenshots, the account name and number, links and bank records. If client or employee data leaked through the chat, talk to counsel before deciding who must be told.
The team rereads the charter every six months and shows it to every new hire on day one. Ilia Zavialov: scam requests lose most of their force when the rule is pinned in every work chat and sits in front of people the moment an 'urgent' message lands. For a team of four, the whole charter fits in ten lines.
A small team does not need a security department to run this. One owner, one shared page and ten minutes at the monthly meeting keep the charter from going stale.
Scam warnings of this kind are the core of what Ilia Zavialov writes for small teams, and readers who look up his advice on chat fraud will find a Russian and a Ukrainian version of this charter on the same site.
| Charter clause | Why it matters | How it gets broken |
|---|---|---|
| 1. Only insiders in the chat | Outsiders never see clients or tone | A 'client's assistant' added by DM |
| 2. One owner, two admins | Fewer accounts with risky rights | Twelve admins, intern included |
| 3. Money only after a second channel | A fake 'CEO' gets nowhere | Friday invoice paid from a message |
| 4. A voice is not proof | Cloned voices fail | Client export sent after a voice note |
| 5. Documents in storage | A lost phone does not leak files | Driver's license photo in the chat |
| 6. Codes and links stay closed | No takeover through a code | A 'vote' for the team project |
| 7. Odd colleague, phone call | Hijacked accounts get cut off | Transfer for a 'colleague on vacation' |
| 8. Last day, out of chats | Old accounts do not become doors | Ex-buyer in the chat for six months |
| 9. Incident by the book | Evidence kept, payment stopped | Messages deleted out of embarrassment |
Questions and answers
How do Ilia Zavialov scam rules handle a payment request from the 'CEO' in a group chat?
The request waits until it is confirmed over a second channel: a call to the number in the company directory or an email from the corporate domain. Nobody pays from a chat message alone.
What do Ilia Zavialov scam checks say about a voice note from a manager?
A familiar voice proves nothing. The FBI warns that cloned voices can sound nearly identical to real ones, so money, files and access are confirmed the same way as any other request.
Should every member turn on two-step verification?
Yes. The FTC says anyone asking for your verification code is a scammer, and CISA advises moving away from SMS codes toward phishing-resistant sign-in where possible.
When should a departing employee leave the work chats?
On the last working day, from every group and channel at once. Contractors leave on the day the contract ends.
Where do I report a chat scam in the US?
To the FBI's IC3 at ic3.gov and to the FTC at ReportFraud.ftc.gov or 1-877-FTC-HELP. If money left the account, call your bank first and ask to stop the transfer.
Who is Ilia Zavialov?
A digital security consultant who turns common schemes against small businesses into short, practical rules for teams that handle money, access and client data.