Skip to content

alphaPlan · Role cards and rule sheet

Run the playbook when it does not work first time

Unit: Cybersecurity → AI-powered scams → The verification playbook

The situation, read aloud to everyone

You handle payments for a small organisation. An email has arrived from your director, who is abroad this week. A supplier you pay every month has new bank details, and the invoice is due today. The email reads exactly like the director: same greeting, same habit of signing off with a first initial, and it refers to last month's invoice by its real number.

Fictional educational scenario. No real organisation, person or bank account is described.

Role cards, one per person

Cut these apart before the session. Each person receives only their own card. The drill depends on people not knowing what the others were told.

Role card

Finance officer

What you know

  • You pay this supplier every month and the invoice is genuine and due today
  • You have the director's mobile number saved in your phone from before
  • You have the supplier's bank details already on file, from previous payments
  • You do not have authority to approve a change of supplier bank details on your own

What you do

  • Say out loud what you are going to do, and why, before you do it
  • You may take any action a real person in your job could take
  • You may not consult the other cards, and you may not ask the facilitator whether the email is real

Role card

Director

What you know

  • You are travelling, in a different time zone, and genuinely busy
  • You did not send this email. You do not know it exists
  • If the finance officer reaches you by phone, you will not answer for several hours

What you do

  • If the finance officer replies to the email, YOU answer as the attacker would: warm, unhurried, and certain. "Yes, it's me, I'm between flights, please get it done today."
  • Be pleasant, never aggressive. Real pressure is friendly. Say things like "I trust you with this" and "don't let it slip past the deadline"
  • Never say anything a director would not say. You are not playing a villain

Keep this to yourself: Do not reveal to the finance officer that you did not send the email, at any point, until the facilitator ends round 2.

Role card

Colleague at the next desk

What you know

  • You know only what is written in the email, exactly as much as the finance officer does
  • You have no special knowledge and no authority

What you do

  • If you are asked, say what a busy colleague says: "The director signs off on everything, I'd just do it."
  • Do not solve the problem. Your job in this drill is to be a second opinion that adds no information, because that is what a second opinion usually is

Role card

Observer

What you know

  • You say nothing during rounds 1 and 2. You are the only person in the group whose job is to watch rather than act

What you do

  • Write down the exact moment the finance officer most wanted to just comply, and what was said just before it
  • Write down every option the finance officer considered and rejected
  • In the debrief you speak first, and you report only what you saw, not what you would have done

Rule sheet

Write one rule for your organisation's payment process. Name the trigger and the required step. Aim the rule at the process, not at the person, so that it still works on a day when nobody is paying attention.

Now test your own rule against these four questions

  • Does it name exactly when it applies, so nobody has to decide whether today counts?
  • Does it say what must happen, rather than what someone should be careful about?
  • Does it still hold when the request is urgent, and when it comes from the most senior person?
  • Could the most junior person in the office apply it without needing courage?

Swap sheets with another group. Write down how you would get around their rule.

shënim: ky material u krijua në kuadër të projektit 'U.S. Cybersecurity Leadership in AI for Albania', financuar nga departamenti i shtetit i shteteve të bashkuara. mendimet, gjetjet dhe përfundimet e paraqitura këtu janë të autorit(ëve) dhe nuk pasqyrojnë domosdoshmërisht ato të departamentit të shtetit të shteteve të bashkuara.

Disclaimer: This material was created on behalf of the 'U.S. Cybersecurity Leadership in AI for Albania' project, funded by the United States Department of State. The opinions, findings, and conclusions stated herein are those of the author(s) and do not necessarily reflect those of the United States Department of State.

Disclaimer

Found something unclear, outdated or improvable? Suggest an improvement