{"id":"cx-phishing-report-reply-keep-email","audience":"it","category":"support-work","technique":"constraints","track":"support","level":"beginner","title":"Reply to an employee who reported a phishing email","free":false,"task":"Reply to Maya with a first line \"Hi Maya, thanks for reporting this.\" and then exactly 3 numbered steps: what to do with the email, how to send it to security, and what to do if she already clicked. Use the current guidance, not the old guidance. Plain text, under 90 words.","materialLabel":"Your material (attached to your prompt automatically)","material":"TICKET - Maya Ortiz, Accounting\n\"I got an email that says it is from the CFO asking me to buy gift cards. I think it is phishing. I did NOT click the link. What do I do?\"\n\nIT SECURITY GUIDE (updated Oct)\n- Do not click links or reply. Do not delete the email: keep it so security can inspect it.\n- Report it by forwarding it as an attachment to phishing@northfield.example (in Outlook: More actions > Forward as attachment).\n- If the person clicked a link or typed a password: call the help desk at ext. 4400 right away and change the password from a different device.\n- The security team does not reply to every report; they only contact the person if more information is needed.\n\nOLD GUIDE (retired): 'Delete the email and tell your manager.'","rules":[{"type":"numberedItems","count":3},{"type":"plainText"}],"mistakes":[{"title":"Telling her to delete it","why":"The AI follows common advice or the retired guide.","fix":"Say: \"Keep the email; don't delete it.\"","checks":["r1"]},{"title":"Missing the exact address or method","why":"The AI says 'report it to security'.","fix":"Say: \"Forward as an attachment to phishing@northfield.example.\"","checks":["r1"]},{"title":"Skipping the clicked case","why":"The AI forgets what to do if she did click.","fix":"Say: \"Step 3 covers the case where she already clicked.\"","checks":["r2"]},{"title":"Wrong structure","why":"The AI adds extra tips or bold text.","fix":"Say: \"Exactly 3 numbered steps, plain text.\"","checks":["r0","numberedItems","plainText"]}],"promptHints":[{"label":"Gives the first line","patterns":["hi maya"]},{"label":"Says exactly three numbered steps","patterns":["exactly 3","three numbered"]},{"label":"Says to use the current guide","patterns":["current","updated","old guide","retired"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"Give the first line, the number of steps, what each covers, and which guide to follow.","rubricLabels":["The first line is \"Hi Maya, thanks for reporting this.\" followed by exactly 3 numbered steps","Step 1 says not to click or reply and to keep the email (not delete it); step 2 says to forward it as an attachment to phishing@northfield.example","Step 3 says that if she clicked or typed a password she should call the help desk at ext. 4400 and change her password"]}