Learning objectives
After this lesson, you should be able to
- Recognize common urgency and impersonation signals
- Verify identity through an independently sourced channel
- Contain and report suspected compromise
Urgency is a signal to verify
Unexpected banking changes, new contact domains, altered pickup instructions, credential requests, and pressure to bypass process should trigger a hold and independent verification.
- Do not use the contact method in the suspicious message
- Check domains and account changes carefully
- Limit access and rotate affected credentials
- Preserve evidence and report the incident
Design out single-person failure
Sensitive payment, identity, booking, and access changes should require role-appropriate approval and an audit record.
Apply the decision protocol
Use a fictionalized or fully permissioned operating scenario. Build five columns: observed facts, supplied facts, assumptions, controlling sources, and unresolved questions. Do not advance a consequential action while a required fact, authorization, qualification, or safety condition remains unresolved.
- Demonstrate: Recognize common urgency and impersonation signals
- Demonstrate: Verify identity through an independently sourced channel
- Demonstrate: Contain and report suspected compromise
- Name the decision owner, evidence standard, stop condition, and next review time
Practice with evidence
Create a one-page decision record and ask a peer to challenge the source, version, applicability, missing facts, incentives, and proposed communication. Revise the record rather than defending the first answer. Preserve the initial and corrected versions so an editor can see what the exercise actually taught.
- Cite every externally verifiable claim
- Separate uncertainty from error
- Escalate beyond the lesson's stated competence boundary
- Remove private, proprietary, or personally identifiable information
Correct and transfer the learning
After the scenario, compare the decision to the current source and the stated objective. Record the misconception, the evidence that corrected it, the operational control that would prevent recurrence, and the conditions that would require the answer to be researched again.
Knowledge check
How should an unexpected banking change be verified?
Reveal the answer
Through a previously trusted, independently sourced contact channel and the required approval process.
Replying to the suspicious message only confirms with the possible attacker.