Skip to content

Your task

Commit to a first decision, inspect the evidence, revise your plan, then state a rule that works under pressure. Do not look at facilitator notes until the activity is finished.

Fictional educational message

From
Shërbimi i Llogarive <ndihma@hyrje-sigurt.example>
Subject
Urgent: confirm your account before 18:00

Hello,

We detected an unusual sign-in to your account. Access will be suspended today unless you confirm your identity.

Open the link below and enter your password and the one-time code sent to your phone.

hyrje-sigurt.example/konfirmo

Account support team

Fictional educational message. It does not represent a real Albanian institution, address or service.

1. First decision, before discussion

What will you do first, and what evidence or assumption is your decision based on?

2. Evidence map

Clue or detailWhat it suggestsWhat it does not prove alone

3. Revised verification plan

What will you not do? Which separately known channel will you use? Write the exact question you will ask.

4. Pressure test

A caller says the message is genuine and asks you to read out the one-time code. The message itself contains an ‘urgent verification’ phone number. What do you do, and why is your channel trustworthy?

5. Reusable rule

Complete: When a request is urgent or asks for a secret, I will…

Digital activity and improvement suggestions: https://codeforalbania.com/en/learn/cybersecurity/04-social-engineering/phishing-smishing-vishing

shënim: ky material u krijua në kuadër të projektit 'U.S. Cybersecurity Leadership in AI for Albania', financuar nga departamenti i shtetit i shteteve të bashkuara. mendimet, gjetjet dhe përfundimet e paraqitura këtu janë të autorit(ëve) dhe nuk pasqyrojnë domosdoshmërisht ato të departamentit të shtetit të shteteve të bashkuara.

Disclaimer: This material was created on behalf of the 'U.S. Cybersecurity Leadership in AI for Albania' project, funded by the United States Department of State. The opinions, findings, and conclusions stated herein are those of the author(s) and do not necessarily reflect those of the United States Department of State.

Disclaimer

Found something unclear, outdated or improvable? Suggest an improvement