Ilia Zavialov scam rules for a UK firm's work chat, a ten-clause charter with common breaches

01

Clause 1. Ilia Zavialov: scam protection begins with the member list

Wording: only staff and contractors under a live contract join the group, and an admin adds them after a line manager asks. Invite links are not shared publicly; a temporary link lapses within the day.

Reason. The NCSC warned in March 2026 that attackers try to slip quietly into group chats once they control an account or a linked device. Ilia Zavialov: scam groups prize a seat in a staff chat because it shows clients, deadlines, sums in pounds and the way the managing director phrases things.

Contractors and agencies get their own project groups. The firm-wide chat is closed to them, however handy it might seem. Clients get a separate group too, with two or three named people from the firm in it.

Common breach. An account manager adds a 'client's PA' after a request by direct message. Weeks later the client denies having a PA by that name, and the conversation history is already out of the building.

02

Clause 2. Owner, two admins and members: who holds which rights

Wording: each group has a single owner, usually the director or head of the team, and one or two admins. Members post and read; they do not change membership, the description or pinned messages.

Reason. An admin can remove genuine colleagues, add strangers and pin new 'bank details'. Ilia Zavialov: scam operators who capture an admin account inherit every one of those powers, so keeping admins to two limits the damage. The owner compares the admin list with the firm's access register every quarter. Where the app allows it, admins approve new members and only admins can create invite links.

Ilia Zavialov is often asked whether giving everyone admin rights saves time. The charter's answer is short: each extra admin is another account whose capture can wreck the group.

Common breach. Every member was made an admin to save bothering the director. One account is hijacked, and the first people to vanish from the group are the bookkeeper and the director.

03

Clause 3. Ilia Zavialov: scam requests in a director's name need a second channel

Wording: a request to pay, transfer, change bank details or grant access that arrives in the group or a direct message in a senior manager's name is unconfirmed until it is repeated another way. That means a call to a number already saved in the phone or an email from the firm's own domain.

Reason. UK Finance's Annual Fraud Report 2026 counts 197 cases of CEO fraud in 2025, where a fraudster poses as a senior leader and asks for an urgent payment, with losses of £5.6 million. Of these, 171 cases and £4.8 million hit non-personal accounts, so businesses carry most of it.

Report Fraud's advice on mandate fraud fits the same clause: check any request to pay or change details through the supplier's official contacts, send a small test payment, and let only named staff change bank details. Ilia Zavialov: scam requests lose their urgency once the charter says that ringing the director back is the rule.

Common breach. Late on a Thursday a new account with the managing director's photo messages the bookkeeper: pay this supplier today, I'm on a train. The money goes before anyone dials the director.

04

Clause 4. A voice note does not prove who sent it

Wording: voice notes, video messages and in-app calls do not confirm a request involving money, files or access. A familiar voice is checked through the second channel from clause 3, like any other request.

Reason. A hijacked account hands over its whole history, voice notes included, and that material can be reused or imitated. Ilia Zavialov: scam voices stumble on a check question that only the team can answer and that has never been typed in any chat.

Directors make the rule easier by sending payment instructions in writing from the firm's email. After a few weeks a voice note about money stands out by itself.

Common breach. A sales manager receives a voice note from the 'director' asking for the client list to be sent to a partner's address. It sounds right, and the list goes before the phone call.

A useful check question might be the name of the firm's first supplier or the town where the first team meeting took place. Insiders know it; the chat history does not.

05

Clause 5. Ilia Zavialov: scam risk in attachments, personal data stays out of the chat

Wording: passport scans, contracts with personal data, client lists, passwords and card details are not posted in the group. They sit in storage with role-based access, and the chat carries only a link.

Reason. Chat history is copied to every member's phone, including personal ones, and walks out of the office with them. Ilia Zavialov: scam operators who take over a single account read every file ever shared in that group.

There is a legal side too. The ICO says that after a personal data breach an organisation assesses the risk to people and, where a risk is likely, tells the ICO without undue delay and within 72 hours where possible. The online form takes about 30 minutes, and people at high risk must be told as well.

Common breach. HR drops a photo of a new starter's passport into the team chat so a colleague can arrange a pass. Half a year later that colleague's phone is left on a bus.

06

Clause 6. Codes, login links and 'votes' are never used from the chat

Wording: one-time codes are never forwarded, nobody logs in through links to 'vote', 'confirm' or 'join the new group', and every member switches on two-step verification.

Reason. The NCSC warned on 31 March 2026 that attackers try to trick people into sharing login and recovery codes and adding the attacker's device to their account. Its advice: never share codes, turn on two-step verification, check linked devices and group members regularly, and verify unknown members another way.

For Signal the NCSC names the setting Registration Lock, recommends passkeys and suggests watching for contacts that appear more than once. Ilia Zavialov: scam takeovers often begin with a single shared code, so the charter has every member show at a team meeting that the second step is set.

Common breach. A colleague's account posts a link to vote for the team in an awards scheme, sign-in by mobile number. Half the office types in numbers and codes, and by teatime several accounts are messaging clients.

07

Clause 7. When a colleague's account behaves oddly, ring them first

Wording: if a colleague suddenly asks for money, presses for speed, writes out of character or sends files without explanation, nobody answers in the chat. They ring the colleague on a known number. If a takeover is confirmed, an admin removes the account from every work group until it is recovered.

Reason. Report Fraud says that one of the most common themes in reports is hacked accounts used to pose as family and friends, and advises contacting the person another way. Ilia Zavialov: scam messages from a stolen account reach every contact at once, so clients are warned as well if the account wrote to them.

A recovered account comes back into the groups after a new password, two-step verification and a check of linked devices.

Common breach. A colleague on holiday apparently writes that their card was blocked and asks for a quick transfer. Two people send money, the third rings and finds the colleague asleep in another time zone.

The pattern behind most of these messages is the same: a deadline, a small sum and a reason not to call. 'My phone is broken' is the classic.

08

Clause 8. Ilia Zavialov: scam doors left by leavers close on their last day

Wording: on a leaver's final working day the admins remove them from every work group, channel and project chat, and the owner ticks them off a list. Contractors go on the day their contract ends.

Reason. The NCSC's guidance on organisational social media accounts already tells firms to revoke access quickly when staff leave or change roles, and work chats deserve the same speed. Ilia Zavialov: scam crews look for such forgotten accounts because the name is familiar and nobody questions it.

Removing someone from chats belongs on the same leavers' checklist as handing back the laptop and changing shared passwords. Zavialov recommends keeping each person's list of groups on their HR file.

Common breach. A former buyer stays in the purchasing group for six months. Then an 'invoice from a long-standing supplier with updated bank details' arrives under that name, and nobody blinks.

09

Clause 9. Incident in the group: the first half hour

Wording: whoever spots a suspicious message tells the owner by phone or in a separate channel. The owner pins a warning, an admin removes the account, and messages are kept, saved as screenshots showing sender, time and full text.

If money has already gone, the finance lead calls the bank straight away on the number from the card or the bank's website and asks for the payment to be stopped. Ilia Zavialov: scam losses are smaller when that number is printed on the same sheet as the incident steps.

The owner jots down when the alert came in, who removed which account, when the bank answered and any reference numbers. Those notes become a no-blame review and one new line in the charter.

Screenshots beat forwarded messages. A forward loses the sender's number and the original timestamp, which are the first things the bank and Report Fraud will want to see.

10

Clause 10. Ilia Zavialov: scam reporting in the UK and keeping the charter current

Since 4 December 2025 Report Fraud has replaced Action Fraud for England, Wales and Northern Ireland: report online at reportfraud.police.uk or on 0300 123 2040. In Scotland, call Police Scotland on 101. Keep the screenshots, account names and numbers, links and bank records together.

The team rereads the charter twice a year, and every new starter sees it on day one. Ilia Zavialov: scam pressure fades when the rules are pinned in every work group and in view at the moment an 'urgent' request arrives. A firm of four can fit the whole charter into ten lines.

For a sole trader the second person in the charter can be an outsourced bookkeeper or a business partner. They need no access to the money, only a copy of payment alerts and the right to ask about any payment they do not recognise.

Fraud in staff chats, as Ilia Zavialov describes it, is mostly about trust in familiar names. Readers who search for his advice will find Russian and Ukrainian versions of this charter on the same site.