In cybersecurity, some mistake can come from being too busy.
Across this QuietChain series, James Lugton (Security Officer and Infrastructure Specialist at Nochex) has been looking at how security problems usually start quietly, not with a dramatic breach. The first post, The Door Left Open, covered eSkimming – how attackers slip into a website through something as small as a forgotten plugin. The second post, The Second Knock, covered repeat targeting – why a business that’s been hit once often gets hit again. This new post is about everyday risks and how a simple mistake on a busy day can be all it takes.
A busy moment
Rachel is running her own small business. One busy morning, she approved a payment she shouldn’t have. No, not because she was careless or untrained, but because she was busy.
It was one of those days where everything feels urgent and nothing actually gets finished. Back-to-back tasks stacking up, phone buzzing non-stop and email inbox filling faster than she could clear it.
Then an email came in from “finance,” asking her to approve a payment. It looked right, and it was sitting among a dozen other things she needed to sort before lunch, so she gave it the same quick glance as everything else that morning. She clicked, approved and… the money was gone.
It was only later, once the day finally slowed down, that she noticed: one letter in the sender’s address was wrong. The kind of thing you catch straight away when your head is clear and completely miss when you’re rushing.
Why a busy brain misses it
When we’re rushed, we go on autopilot. That’s not a weakness, it’s just how we get through a packed day. We stop checking every little thing and start trusting what looks familiar: a logo where we expect it, a name we know, a request like the ones we handle all the time.
Attackers count exactly on that. A lot of the time they don’t need a clever technical trick or hacking skills – they just need to reach someone when the inbox is full and the pressure is on. Then that trustworthy-looking email does all the work.
That’s what makes it hard to defend against. There’s no system flaw to patch. The thing being used against you is an ordinary busy morning.
What helps on the merchant side (SAQ-A)
Most of what protects against this isn’t technical. It’s about giving yourself a moment to check before you act:
⚠️ Double-check unusual requests before you act on them, especially anything to do with a payment or a change of bank details. If a supplier’s account number suddenly changes, or a request feels a bit off, call to confirm it. That quick check costs almost nothing compared to the money you could lose. The attacks that work are the ones nobody stops to question.
⚠️ Keep access limited, so one wrong click can’t open everything at once. The fewer people who can move money or change payment details, and the more those actions need a second person to sign off, the harder it is for one mistake to turn into a big loss.
⚠️ Let your team slow down on anything sensitive, and make it clear that checking twice is a good thing, not a sign someone is being slow or difficult. A lot of these mistakes happen because people feel rushed. So part of the fix is simply making it okay to pause and ask, “does this look right?”
How a payments partner backs you up
Even with good habits, anyone can still have bad days because we’re all human. That’s where a strong payments partner helps – it adds a bit of friction in the right places, so a single rushed moment doesn’t turn into a loss. Not the kind of friction that slows down your day, but the kind that catches what a busy person misses.
A trusted payments provider builds these checks into how payments are handled:
✅ Flags payouts that look out of the ordinary.
If a payment is unusually large, or going to an account you’ve never paid before, the platform catches it – even when the person approving it doesn’t.
✅ Asks for extra verification on sensitive or unusual requests.
Before the money actually moves, there’s one more step to clear, which is exactly the kind of check that’s easy to skip when you’re rushing and doing it all yourself.
✅ Blocks payment flows that don’t match how your business normally runs.
When something genuinely looks wrong, it gets stopped before the money leaves – not discovered afterwards, once it’s already gone.
In Rachel’s case, that could have been the difference. The platform doesn’t get tired, distracted or overwhelmed, so it’s still paying attention on the mornings when the people using it can’t.
The quiet truth
The uncomfortable part is that this could happen to almost anyone. A busy day, a convincing email, a quick approval between two other tasks. The people who get caught out aren’t the ones who don’t care – they’re often the ones with the most on their plate.
You won’t catch every trick. But good habits, backed by the right support, mean one rushed moment doesn’t have to become a real loss.
Regular habits + strong partners = real protection.
In the next QuietChain series…
…the update that isn’t what it seems, and why the things we’re trained to trust are often the easiest to fake.
In the meantime, head over to James Lugton blog ‘Security e-drift: the quiet compromise‘ for more cybersecurity insights.
