Dungeon #147 has a 5th-level adventure called "The Aundairian Job." It's set in Eberron, but could easily be converted. The adventure description blurb reads: "A powerful artifact lies deep in the vaults of a House Kundarak bank. Can the PCs steal it without getting captured in the process?"
Its going to a futurist campaign, by the way. So the players are going to have to hack directly into the system to get the funds. (That's the idea anyway) I just don't have any good ideas on the layout, guards, etc... I'll take a look at that Dungeon and the podcast through thanks. Hopefully it'll give me some ideas...
I've tried to do a heist twice, and not been happy with the results in either case. Both times the PCs were at a loss and would have just gone in guns (metaphorically in one case, literally in the other) blazing if I hadn't had an NPC come along and "suggest" a heist that would get them past security. Still fun both times, but I never got that Ocean's Eleven/The Sting vibe I was shooting for.
I don't have much advice for the set-up, but once it's time for the planning of the heist I would lay out all the relevant information for the PCs in very simple, clear terms. Like they were children. I mean, go for broke and tell them exactly what they need to know to get in, and exactly where the problems/hacking/fast talking/gunplay is likely to happen.
Chances are good that they'll miss the clue-by-four and come up with some crazy scheme involving 13 tons of C4 and a war-elephant anyway, but all you can do is try.
Other than that, watch the classic movies for inspiration. Like I said, The Sting and Ocean's Eleven are among my favorites. Ronin is good, The Italian Job will do in a pinch, and Lock Stock & Two Smoking Barrels is just insane. I don't know if they'll help you, but it's a fun ride!
PS I'm not saying you should railroad your players. If they come up with something that looks good and is totally awesome, let 'em rock and roll. I just want to help you avoid the hour where they stare blankly at a map layout and a security guard schedule, then decide to kill everything and run away with some bags of cash.
Oh man, doing some serious dusting off of the old rpg notes . . .
First thing to know, this was in a game that took place in the world of the Matrix movies. Yeah, total nerdgasm, but it was the spirit of the times and I freakin loved that game. Made my own system for it adapting AEG's d10 dice system. But I digress.
The heist itself was actually a simulation outside the matrix, a teaching program designed to have newly liberated hackers get used to jacking in, gathering intel, planning a mission, then executing it. So they actually got multiple tries and multiple failures, learning from their mistakes each time.
Once the guns came out and bodies started hitting the floor, a timer started counting down until Agents arrived. So they had to accomplish most (or all!) of the heist covertly, without setting off alarms and such, but blasting their way out at the very end was an option.
I really don't remember all the specifics, but I know that they had to hack in to get the blueprints and employee info, including schedules and personal info. Then they sabotaged a few of the guards while they were at home (food poisoning) so that the guards that were on shift during the heist were pulling double shifts, were exhausted, and didn't know the normal routine very well.
Then they split into three groups, which is normally bad, but each of those three groups had something important to do at every stage of the operation, so in practice we just played like they were together, with everyone on the same initiative track, going about their jobs simultaneously.
One group went to the top of the building and hacked security.
One group ambushed an armored car that was on the way to the building, quietly, and donned their uniforms.
One group went into the bank itself and got ready to be the distraction.
Once the armored car guys arrived, they went about their normal business of going in to deliver some cash. The distraction-guy was already at the teller, making some noise about being foreclosed on or something, I forget, and drawing the attention of some of the managers. The guards on duty normally would have recognized that the armored car guys weren't the right people, but of course they weren't used to this shift and didn't know better.
The hacker hacked stuff and shut off the panic buttons, which meant that they now had 10 minutes to finish the heist; if the panic buttons didn't send out an "all clear" signal every 10 minutes, the cops were automatically notified.
Then the distraction in the bank faked getting violently mad, and "overpowered" one of the armored car guard PCs. He obviously threw the fight and gave the other his weapon. The now bank robber forced the bank people to let him into the safety deposit vault.
At this point the PCs needed to get into the inner vault, which held the info that was the entire objective of the operation in the first place. But only the bank manager had the passcodes to get in, and he could enter in a false passcode that would destroy the vault's contents, so pure coercion wouldn't work. So they had to trick him.
They did that by having the fake guard come running out of the security deposit vault, yelling that the robber had gotten in to the inner vault. When they rushed in to see, they found that the robber was, indeed, gone from a room with only one entrance, and he couldn't have left without everyone seeing! In actuality, he had used a hardline to exit the simulation out of everyone's line of sight.
When they looked at the security feed from inside the inner vault, they saw the hacker's fake feed showing the robber inside.
Convinced now that inner vault security had been breached, the bank manager entered in the proper passcode to open the vault door. Then the PCs had no further use for him, so they knocked him out.
With the heist accomplished the PCs had been planning on leaving through the same hardline, but it just so happened that the cops had noticed by now that the "all-clear" signal was overdue, and had severed their phone lines. Cut off and quickly surrounded by cops, the party had to blast their way out, aided by their last companion who redialed back into the simulation a few blocks away with a sniper rifle, then took up position nearby and covered their escape.
There was a fight scene, and a car chase, and plenty of wire-fu. They all got out at the last second, when an Agent had just shown up and was about to ruin their day. I think the phone they found was in a public library, and the Agent shot up the whole place and killed many an innocent book that day in pursuit.
Good times, man. Teenage me really, really loved that game! Hope some of that loooooong post helps!
Ok so I'm double-posting, which is bad juju, but I think that a discussion of all the ways that my players screwed up before getting the heist wrong (horribly, horribly wrong) will be as useful, maybe more so, than the story of when they finally got it right (related above).
The first attempt wasn't a serious try. Since we had the rather unique situation of being able to run the simulation as many times as it would take to get it right, the PCs decided to go Neo-in-the-lobby-scene style and just light the place up. Gunning down the security guards was easy. Getting the bank manager to open the security deposit vault was likewise easy, but he flatout refused to open the inner vault and cops were already arriving outside. Disgusted, they knocked him out and tried to hack the inner vault, but it had some crazy technobabble security system and their hacker couldn't even begin to penetrate it, even after a quick mental data download from their operator outside the system.
The cops stormed the place with tear gas, a few of the PCs fell, and the rest probably would have escaped if it weren't for the Agent that showed up and quickly punched their clocks.
The next attempt was only slightly more sophisticated. Fixating now on the inner vault lock, the PCs tried to sneak in as repair men during the night shift to have all night to hack the system. The night guards wouldn't let them in, because they didn't have a work order. The PCs took care of the night guards, disabled the security (hey, the hacker couldn't handle lockzilla, but he still wasn't a pushover), and got to work on the lock. Unfortunately, they didn't know about the "all-clear" signal that had to be sent out every 10 minutes. Cops responded, Agents arrive, everyone dies.
A few more attempts ensued to get around that vault door by brute force. They threatened to execute hostages if the bank manager didn't open it. He entered in the destruct code. They kidnapped him before his shift started and tried to get the codes out of him. He told them that the codes change every day, and he has to go into work to find out what they are. They tried repeatedly to blast the door open. It was a sturdy vault, and eventually they collapsed the whole building without cracking the vault. They stole a tank and tried to use it to wrench open the vault door, and failing that to blast it open. That was hilarious, but didn't do the trick.
It was good intel gathering, if rather brutish and unsuitable for field conditions, but I like to think that it taught them the importance of knowing your enemy and planning your moves. At this point their senior instructor stepped in with a few helpful suggestions, including the idea of using misdirection instead of armored vehicles or excessive explosives (can't it be both?). The rest is history.
So I guess the moral of the story is threefold. One, give it to your players straight. It may seem to you that you've left a cunning trail of breadcrumbs leading to the important info just waiting to be uncovered through diligent investigation, but your PCs are likely to get lost. Spell things out for them, and move on to the fun part: the heist!
Two, be prepared for things to go off the rails. Unless you are planning on just giving them the plan for the heist (a legitimate move, to be fair), they are very unlikely to execute the robbery like you've planned it out in your mind ahead of time. As long as what they are doing seems like it maybe makes sense, and fits the genre, roll with it. Maybe even fudge some of the security measures that should have stopped it. The heist should seem like it's going smoothly until the last moment, after all, when everything goes to hell!
Three, give something for everyone to do, and run things concurrently so that nobody gets bored. It isn't really that apparent from my story, but in several cases some of the players were just sitting around while someone else hacked, or sitting around while someone else interrogated. In the final heist, everyone had a job to do and they all happened simultaneously, so everyone was entertained. Aim for the latter! It simulates heist fiction, with its intricate plots and intercutting scenes, better anyway.