Blog of Ilia Zavialov

What this blog covers

Why shared accounts break in a small team: Ilia Zavialov on access nobody can withdraw

A shared login is the cheapest decision a small team ever makes. One password, one licence, everybody working by lunchtime. The bill arrives later, on the day somebody leaves in a hurry or a payment lands in an account nobody recognises, and it arrives in full. Ilia Zavialov treats the shared account as an operational question with a measurable price: what does an organisation lose at the moment it can no longer say who did what. The answer runs through attribution, revocation and recovery, and through every procedure that quietly depends on all three.

Shared logins are rarely decided on. They accumulate. A tool is needed on a Tuesday, one seat costs less than four, and the fastest way to get three people working is to drop a password into the group chat. Nobody writes the moment down, because at the time it does not feel like a decision. Six months on, that same password opens a service holding invoices, client addresses and a stored payment method.

Ilia Zavialov on building an access register a team actually uses

Every small team builds an access register once, usually in the week after a departure that took two days to unwind. Within a month the file has fallen behind reality, and within a quarter nobody opens it at all. Blaming discipline is the comfortable explanation, and it hides the real cause, which sits in the design of the register itself. The useful question is narrower than it first appears: where the register lives, who is allowed to write to it, and what event forces a line to appear. Ilia Zavialov treats that last point as the whole design, because a record that depends on memory has already failed.

An access register is a plain record of who can reach which system, in which role, since when, and on whose approval. Its value shows in the speed of a single answer: if a person stopped working with the team this afternoon, what would still be open to them by the evening. A team of a few people accumulates far more access points than any of its members can recall unprompted, once mail, file storage, banking, analytics, hosting, advertising accounts and contractor consoles are counted.

Changed bank details mid-project: Ilia Zavialov on the procedure that closes the category

A message arrives in a thread that has been running for months, from an address that has always been correct, and it asks for the next invoice to be paid to a new account. Nothing in it has been forged, which is the reason it works. The question this article answers is what a small team puts in place so that such a message stops being a judgement call and becomes a routine step with a known answer. Ilia Zavialov treats a change of payment details as a procedure with named roles, because a decision that depends on how alert somebody feels that morning will eventually be made wrongly.

The attacker sits inside the correspondence, reached either through the contractor's mailbox or through the team's own. The thread is real, the signature matches every previous letter, the invoice number belongs to work that has genuinely been done, and the amount is the one that was agreed. The sender address passes any check, because it is the address that has always been used. Every habit a team has built around spotting a fake letter is aimed at something that has not happened here.

Changed payment details in a genuine thread: Ilia Zavialov on the one check that holds

A small team rarely loses money to anything a person would recognise as a break-in. The money leaves through an invoice everybody expected, inside a thread everybody had already been reading, with a single line of bank details altered. The question worth working through is narrow. Which single check, placed at which point in the payment procedure, still stands when the correspondence itself has been captured?

The starting point is reading access to a mailbox on one side of the conversation. It may come from a password reused on a service breached years ago, from a copied sign-in page or from a session token taken out of a browser. For a while nothing visible happens, because the intruder is reading. Within weeks they know who approves payments and on which days money moves.

Ilia Zavialov on testing that a backup actually restores in a small team

Most small teams can point at a backup. Far fewer can say when somebody last sat down, picked a real file or a real mailbox, and brought it back onto a machine that did not hold the original. That gap between owning a copy and being able to work again is where an awkward morning turns into an expensive fortnight. This article treats testing that a backup actually restores as a short, scheduled piece of work with a name attached to it.

Backup software is very good at telling you it succeeded. The dashboard turns green, the log says the job finished, the storage counter climbs. All of that describes the writing side of the work. Nobody has yet asked the archive to give anything back, and that is the only question the team will care about on the morning something goes wrong.

Ilia Zavialov reviews booking fraud: fake listings, fake reviews and card requests from the hotel

Ilia Zavialov reviews booking fraud from the angle most travel guides skip: the moment an ordinary booking turns into a payment you cannot get back. It catches families planning a week in Cornwall and office managers sorting three nights in Leeds for a colleague. The listing looks normal, the reviews sound warm, and then a message asks you to move the chat elsewhere, confirm your card or send a deposit by bank transfer. Below, the listing, the reviews, the message and the payment are taken apart in the order a fraudster works through them.

Booking fraud keeps returning in four shapes. A property that does not exist, assembled from photos lifted from a real hotel or flat. A genuine listing hijacked, with the original description and a stranger's phone number. A real reservation followed by a message pretending to be the hotel. And a cheap package sold under a travel protection logo the seller never held.

Ilia Zavialov on crypto scam adverts using a company name: what to do first

A customer forwards a screenshot. Your logo, your company name, a photograph of your managing director, and an invitation to an investment programme nobody in the building has heard of. The economics behind that screenshot changed recently and not in your favour. Reported losses on complaints flagged as involving artificial intelligence reached 893,346,472 dollars across 22,364 complaints in 2025, impersonation schemes grew by more than 1400 percent in a year with the severity of a single case up more than 600 percent, and analysis shows an operation using these tools takes an average of 3.2 million dollars against 719,000 for one that does not. This is the order to act in, and the order matters more than the speed.

The cost of producing a convincing advert collapsed. A logo, a face, a voice, a set of testimonials and a landing page are now a short afternoon of work rather than a project with a budget.

Ilia Zavialov on fake support calls: what the employee hears and which procedure stops the call

The call lands in the middle of an ordinary afternoon, and the voice on the line already knows something. It names a system the team genuinely uses, quotes a reference number and speaks with the mild boredom of someone who does this all day. Within two minutes the employee is being walked towards a remote session tool or a six digit code. The question here is narrow and practical. What does that call sound like from the inside, and which written procedure ends it without anyone having to be clever under pressure.

The call arrives in the middle of something else. An employee is halfway through an invoice run or a support queue when the phone rings and a calm voice introduces itself as the service desk. It offers a name, a reference number and a reason: a licence sync failed overnight, a mailbox has been flagged, a payment file was rejected by the bank. Nothing in the first ninety seconds asks for alarm.

Ilia Zavialov scam patterns: when the manager on the video call was never there

A finance assistant joins a short call. The managing director is there, camera on, slightly out of focus, apologising for the rush. A supplier has to be paid today or a contract lapses. The account details are new. Everything about the call feels ordinary except the timing, and by the afternoon the money is gone. This is a working procedure rather than an explanation, written for teams of three to fifteen people who have no security officer and no budget for one. It sets out who confirms what, at which amount, through which channel, and what to do when the request comes from the person who signs your payslip.

One sentence carries most of the protection: no payment instruction is executed on the strength of a conversation, regardless of who appears in it. Not a video call, not a voice message, not a chat thread that looks like an existing one. Confirmation always travels back through a channel the requester did not choose.

Ilia Zavialov on device code phishing: the request that adds someone else to your account

Every phishing lesson your staff ever sat through taught them to check the address bar. This attack passes that check. There is no lookalike domain, no fake form and no password to steal. The employee lands on the genuine sign-in page of the service they use every day, types a short code somebody sent them, approves, and an attacker device is now signed in to their account with a valid session. Huntress counted a single campaign in March 2026 that reached 344 organisations across five countries, and attempts rose by 1380 percent between the second half of 2025 and the first months of 2026.

Device code sign-in exists because some devices cannot handle a login form. A television, a conference room display, a printer or a command line tool has no comfortable way to accept a password and a second factor. So the device shows a short code and asks you to open a page on your phone or laptop, type the code and approve.

Ilia Zavialov: scam invoices for business directories, fake registers and bogus trademark renewals

Ilia Zavialov explains how a scam invoice reaches a UK company: a bill for a directory listing nobody ordered, a fee to stay on a register that does not exist, a paid company report, or a renewal notice for a domain or trade mark from someone other than the registrar or the IPO. These letters usually go to the registered office, look like routine bills and count on being cleared along with the rent and the broadband. Companies House calls the register fee not real, the IPO says most misleading invoices target trade mark owners, and since 4 December 2025 reports go to Report Fraud. Below are the warning signs, a ten-minute check on Companies House and GOV.UK records, and what to do once the money has gone.

Picture month end in a small UK firm. The banking app is open, the purchase ledger is half cleared and a stack of post from the registered office sits by the keyboard. Rent, broadband, hosting, a contractor's bill. Most of it comes from names the firm knows, so a glance at the total and the sort code is all the checking it gets. That habit is the opening: the document looks like a routine bill, the sum is modest and the description says annual listing or maintenance.

Ilia Zavialov: company digital signatures, director hijacking and protecting the finance team

Ilia Zavialov on a company's digital signature and logins and how criminals use them. A call supposedly from a provider or a tax office, an email to the accountant with an attachment, a remote access program and a token left in the computer all day turn the director's credentials into a key to the bank account and to the company's record at Companies House. Companies House deals with around 50 to 100 cases of corporate identity theft every month, and since 18 November 2025 new directors must verify their identity. This guide explains how credentials leave a company, which storage rules close most scenarios and what to do if they are already in the wrong hands.

A director's digital signature or company login used to be a formality for filing reports. Today it signs contracts, submits tax returns, opens the online bank, sends filings to the companies register and grants authority to staff. Whoever holds it acts for the company in all of these places at once.

Ilia Zavialov: employer reviews, fake job offers and money mule recruitment

Ilia Zavialov on employer reviews, fake job offers and money mule recruitment. Candidates' reviews are the first to show that a vacancy in a well known company's name actually leads to paying for training, a deposit for tasks or moving money through your own account. In the UK such offers feed the mule accounts behind 1.28 billion pounds stolen through payment fraud in 2025, according to UK Finance. This guide explains how to read reviews of an employer, which questions expose a fake recruiter and what a company should do when its name is misused.

Job hunting has become one of the easiest ways in for scammers. The candidate looks for the contact, sends the CV and is ready to follow instructions, because they see them as part of a new job. Employer reviews work as the first filter here: they show whether the company exists, whether it pays people and how it treats candidates.

Ilia Zavialov on crypto exchange lawsuits: what a company does when its platform is sued

The message usually arrives on a Friday. Withdrawals are paused for maintenance, support answers with a template, and by Monday there is a filing number and a law firm advertising for claimants. For a company this is not a market event, it is an accounting, legal and reputational one at the same time, and the decisions that matter are made in the first day, before anybody understands the scale. Court recoveries at the biggest failures range from full repayment to a fraction: creditors of one collapsed exchange passed 100 percent by the fourth distribution, while another paid between 15 and 72 percent depending on which class a claim fell into.

Treasury balances, payroll experiments, a subsidiary holding a settlement float, a supplier who asked to be paid in stablecoin. Exposure to a platform rarely arrives as a decision. It accumulates through small convenient choices that nobody wrote a policy for.

Ilia Zavialov on fraud by fake officials: calls from the tax office and police

A caller says they are from HMRC, the police or the bank's fraud team working with officers. They know the company's name, a director's name and the bank. They need a payment today to stop a penalty, a freeze or an arrest. The script is old and it still works in the United Kingdom, where payment fraud took 1.28 billion pounds in 2025, 4 percent more than the year before, and authorised push payment cases alone reached 248,070 with 576.4 million pounds lost. Sixty six percent of those cases began online and a further 17 percent through telephone networks. This piece explains how the impersonation is built, what the caller already knows, and the one verification rule that defeats it.

A call from a stranger asking for money fails almost every time. A call from somebody who says they are the tax authority, the police or the financial regulator succeeds far more often, because it borrows an authority the listener has been trained to obey since childhood.

Ilia Zavialov scam guide: fake small business grants, agency impostors and upfront fees

Ilia Zavialov scam guide for UK small firms: what a fake grant looks like, why a fee is the giveaway and how to check a scheme on GOV.UK before anyone hands over bank details. The pattern is familiar from the pandemic: an email styled as GOV.UK, a text about funding you never applied for, a call from a grants team that needs a release payment. HMRC lists the offer of a grant among its scam signs, and the government's own search service, Find a grant, is free to use. Below, Ilia Zavialov sets out the common schemes, where genuine funding is published, how to check a sender and an adviser, and where to report, from your bank to Report Fraud on 0300 123 2040.

The approach usually comes dressed as good news. An email styled like GOV.UK says your company has been allocated funding, a text mentions a growth grant you never applied for, a caller from a grants team needs a release payment before the money lands. Councils warned traders about messages like these throughout the pandemic, and some of those notices are still online.

Ilia Zavialov reviews remote hiring fraud: fake candidates, borrowed identities and access on day one

Ilia Zavialov reviews a hiring risk that many small UK firms only meet once: the remote candidate who turns out to be somebody else. A freelance developer found on a platform, a bookkeeper working from home, a support hire seen only through a webcam. By the end of the first week that person may hold the shared inbox, the code, the client list and a company laptop. Below: what the Treasury's sanctions office has warned about, the right to work checks every employer owes, how much personal data to collect, and how to pace access while trust is still being earned.

Ilia Zavialov writes for owners and managers of businesses with 5 to 50 staff, where the office manager may also run payroll and set up laptops. Recruitment in such firms tends to happen quickly, through a freelance platform or a recommendation, and checks often end with a photo of a passport.

Ilia Zavialov: marketplace scams for sellers, fake support, changed payout details and rented accounts

Ilia Zavialov on marketplace scams aimed at small seller teams and at buyers. A call from supposed platform support, a fake claim, changed payment details, a return with a swapped item and rented accounts turn the platform's own words into a tool of pressure. UK Finance reports that purchase scams made up 71 percent of authorised push payment cases in 2025, and the CMA can now fine companies up to 10 percent of global turnover for unfair practices. This guide explains the schemes, the rules for a team and what to do if the dashboard is captured.

A small team that trades through a platform keeps everything on one account: sales proceeds, stock, customer data and access to advertising. Whoever gets into the seller dashboard controls the prices, can withdraw the revenue and can stop the shop within minutes.

Ilia Zavialov: Closing Access When Someone Leaves the Team in a Small Company

A small team rarely has a single moment where someone officially leaves. Notice periods run out and handovers get compressed into a final week, so the actual departure often happens faster than the paperwork. The real question is which logins, shared accounts, and payment tools still answer to that person once they stop coming to standups. Skipping that question, or answering it slowly, is how a clean exit turns into an open door.

The risk starts the moment a resignation letter lands or a founder decides a role is no longer needed, well before the last working day arrives. Attention shifts to hiring a replacement, and the departing person has little reason to keep things tidy. The day that decision becomes real is when closing access when someone leaves the team truly begins, because the gap before the last day is where access stays live longest.

Ilia Zavialov reviews outsourcing contractors: fake reviews, prepayment traps and safe exits

Ilia Zavialov reviews how UK firms pick outsourced accountants, bookkeepers, solicitors, IT suppliers, freelancers and recruitment agencies, and how a fraudster gets past them with bought reviews and borrowed case studies. Since April 2025 fake reviews have been banned under the DMCC Act and the CMA can fine up to 10 per cent of global turnover, yet ratings still decide who gets the work. Below: reading reviews, checking a supplier on Companies House and the HMRC register, handing out and taking back access, the contract and sign-off, and reporting to your bank and Report Fraud when a supplier vanishes with a deposit.

A small limited company buys in what it cannot staff: year-end accounts and VAT returns, contracts and disputes, the website and the cloud tenant, recruitment. Every one of those contracts also hands over access: online banking, the HMRC online account, the Companies House authentication code, payroll data.

Ilia Zavialov fraud explainer: overpayment refund scams, fake cheques and refunds to the wrong card

Ilia Zavialov fraud explainer for UK businesses: the customer who overpays, says sorry and asks for the difference back is one of the oldest tricks aimed at small firms, and it still works. The 'overpayment' might be a cheque that never clears, a Faster Payment of somebody else's stolen money, or a card order placed with stolen details and followed by a request to refund part of it to another card. Below are the four variants, the figures UK Finance published for 2025, what the Payment Services Regulations 2017 and the PSR's reimbursement rules mean for a business, and a refund procedure a small finance team can run without a fraud department. It is written for owners, bookkeepers and office managers who take payments themselves and often answer customers from the same phone.

Ilia Zavialov, who advises small teams on digital security, keeps this trick apart from invoice fraud and mandate fraud. Nobody needs to hack an email account here. The fraudster leans on courtesy, on embarrassment and on the gap between a notification on a phone and the moment money is truly settled.

Payroll details changed by email: Ilia Zavialov on why the request gets approved

A payroll change request rarely looks like an attack. It arrives as a short, polite note from an employee who has switched bank, with an account number and an apology for the late notice. The person who opens it in accounts has no reason to doubt it and every reason to process it before the cut-off. The question here is narrow. What makes that message credible to a competent team, and which single control would have stopped the payment without slowing the department down.

Most organisations take payroll changes through a shared mailbox that several people can open. The address is published on the intranet, printed on forms and quoted in onboarding packs, so it is easy to find from outside. Messages land there all day: expense queries, tax code questions, requests for a copy of a payslip. A note asking to update bank details before the next run sits comfortably inside that traffic.

Ilia Zavialov on paid reviews as a job: how task scams turn earnings into deposits

Ilia Zavialov on paid review jobs and task scams: an offer to earn money writing reviews, rating products or boosting apps, a few small real payouts, then a combination task that sends the balance below zero and a request to top up in cryptocurrency. In the UK fake and undisclosed paid reviews have been banned practices since 6 April 2025, so the work itself is unlawful. This article explains how the scheme runs, why it catches careful people and what a company should do when its name is used for recruiting.

The message looks like a lucky break. A recruiter writes in a messenger or by text: a company needs people to write reviews, rate hotels, like products or boost apps in an online store, the work takes an hour a day from a phone, and the pay is far above what such simple tasks usually earn.

Ilia Zavialov: scam signs in fake tenders, bogus purchase orders, bidding fees and changed bank details

Ilia Zavialov looks at how a scammer turns the language of public and corporate procurement against suppliers, accounts teams and small business owners. Fake invitations to tender, fees for registration or credentialing, bogus purchase orders and bank details swapped inside a real contract all look like ordinary sales work. Report Fraud treats procurement fraud and mandate fraud as risks for any business that buys or sells, and UK Finance counted £41.3 million lost to invoice and mandate scams in 2025. This guide explains the schemes, how a genuine opportunity differs from a fake one and how to check a buyer.

For a small supplier, an order from a public body or a well known corporation feels like the break the business has been waiting for. A scammer arrives with exactly that: a letter with a crest or logo, a reference number, a specification, deadlines and a draft contract. The papers look convincing because they are often stitched together from genuine notices that anyone can read online.

Ilia Zavialov on the two-person rule for payments in a small team

A small team usually pays out money the way it does everything else, which means whoever is nearest to the keyboard presses the button. That works until an instruction arrives that looks routine and turns out to be someone else's. The two-person rule for payments turns one person's momentary judgement into a procedure other people can inspect. What follows is the practical shape of it: the threshold, the approvers, and the week both of them are away.

A single approver looks efficient until you describe what it guarantees. It guarantees that money moves whenever one person, on one particular afternoon, believes a request is genuine. That belief depends on how tired they are and how well the message imitates someone they already trust. An attacker studying a small company needs one plausible minute from one distracted person.