Our lorries and vans fill up on fuel cards, about four hundred of them, managed through the card company's online portal. Three people in our transport office use it. The portal can block a card, change a limit, order replacements and set the address they are posted to.

It has a second step at sign in. You choose whether the code is sent by text or read out in a phone call, and the number registered for our account was the transport office landline, because that was the number on the original application in 2017.

In February one of the three entered her password into a convincing copy of the portal's sign in page, linked from an email about a price change. At about eight that evening somebody signed in with it and chose the phone call. The office was empty, so after six rings the call went to the landline's voicemail, and the code was recorded there.

Our phone system lets anyone retrieve voicemail remotely, by calling the number, pressing star and entering a PIN.…