{"id":"cx-card-photo-in-ticket-reply-security","audience":"it","category":"support-work","technique":"constraints","track":"support","level":"intermediate","title":"Reply to a customer who emailed a photo of their payment card","free":false,"task":"Reply to Noor. Start with \"Hi Noor,\" and end with \"Sam, Support\". Say we do not need card photos, say the attachment has been flagged to the security team for removal and give the 2-business-day timeline, offer the approved way to verify her, and suggest she contact her bank if she is worried. Never write any card digits. Plain text, under 90 words.","materialLabel":"Your material (attached to your prompt automatically)","material":"TICKET #7830 - Noor Haddad\n\"I can't log in and I need to cancel a charge. Here is a photo of my card (front and back) so you can see it's mine. Please just fix it.\"\nAttachment: card_front_back.jpg (the full number, expiry and security code are visible)\n\nPROCEDURE - SENSITIVE DATA IN TICKETS\n1. Never ask for card photos or full card numbers, and never repeat them in replies or notes.\n2. Flag the attachment with the 'Sensitive' button; the security team removes it within 2 business days. Agents cannot delete attachments.\n3. Approved verification: the last 4 digits of the card on the account plus the billing ZIP code.\n4. Suggest customers contact their bank if they are worried about card safety. Do not give advice about whether the card is compromised.\n\nACCOUNT\nCard on file ends in 3092.","rules":[{"type":"plainText"},{"type":"maxWords","max":90}],"mistakes":[{"title":"Repeating card details","why":"The AI mentions the last 4 digits from the account.","fix":"Say: \"Write no card digits; ask her to supply the last 4.\"","checks":["r2"]},{"title":"Promising deletion by you","why":"The AI says 'I've deleted the photo'.","fix":"Say: \"Agents flag it; security removes it in 2 business days.\"","checks":["r1"]},{"title":"Declaring the card unsafe","why":"The AI gives security advice beyond the procedure.","fix":"Say: \"Suggest her bank; don't say if it's compromised.\"","checks":["r2"]},{"title":"Getting markdown back","why":"AI adds bold and headings by default, which show up as stray symbols where this is pasted.","fix":"Say \"plain text, no bold, no headings, no asterisks\".","checks":["plainText"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting and usually runs long, so a vague \"keep it short\" lands well over the limit.","fix":"Cap each part instead of the total, for example \"each line under 15 words\".","checks":["maxWords","r0"]}],"promptHints":[{"label":"Gives greeting and sign-off","patterns":["hi noor","sam, support"]},{"label":"Names the verification method","patterns":["last 4","zip"]},{"label":"Forbids card digits","patterns":["no card (digits|numbers)","never write","don'?t (repeat|write)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]},{"label":"Sets a length limit","patterns":["\\d+\\s*words","word (limit|count)","under \\d+"]}],"hint":"Give greeting, sign-off, the exact verification method and the things the reply must not contain.","rubricLabels":["The reply starts with \"Hi Noor,\" and ends with the line \"Sam, Support\"","The reply says the attachment has been flagged to the security team and will be removed within 2 business days, and asks her to verify with the last 4 digits of the card and her billing ZIP code","The reply contains no card digits at all, suggests contacting her bank if worried, and does not say whether her card is compromised"]}