{"id":"sec-fin-wire-request-verification","audience":"finance","category":"security","track":"security","technique":"format","title":"Flag a suspicious wire request and list required checks","free":false,"task":"An urgent wire request came in 'from the CFO'. Write your note to the AP lead: first line exactly 'Hold: do not send', then exactly 3 numbered red flags quoting the email, then exactly 2 lines starting 'Required:' with the checks your payment policy demands for this amount. Plain text, under 110 words.","materialLabel":"The email and your payment policy (attached to your prompt automatically)","material":"From: \"Grace Holloway, CFO\" <g.holloway@northpeak-finance.example.co>\nReply-To: grace.holloway.cfo@protonmail.example.net\nTo: ap-team@northpeak.example.com\nSent: Fri Nov 7, 2026 4:38 PM\nSubject: Wire needed today - acquisition (confidential)\n\nHi team,\n\nWe're closing a confidential acquisition and need a wire of $48,500 sent today before 5:30 PM to secure the deal. Please don't discuss this with anyone else, the deal is under NDA.\n\nBeneficiary: Halvorsen Advisory LLC\nBank: Coastal Trust (example)\nAccount: 7720 1184 9031\nRouting: 000987654\n\nI'm boarding a flight so email only. Confirm when done.\n\nGrace\n\n---\nNorthpeak payment policy FP-3:\n- New payees: verify by calling the requester at the number in the company directory, never one from the request.\n- Payments over $10,000 need two approvers in the payment system.\n- Grace Holloway's real address is grace.holloway@northpeak.example.com.","rules":[{"type":"numberedItems","count":3},{"type":"plainText"},{"type":"maxWords","max":110}],"mistakes":[{"title":"A long analysis","why":"The AI writes an essay about business email compromise.","fix":"Give the shape: \"Hold line, 3 numbered red flags, 2 Required: lines.\"","checks":["r0","numberedItems"]},{"title":"Generic red flags","why":"The AI lists 'urgency' and 'secrecy' without pointing at the words.","fix":"Ask: \"Quote the email in each red flag.\"","checks":["r1"]},{"title":"Generic verification","why":"The AI says 'verify with the CFO' and might suggest replying to the email.","fix":"Say: \"Use our policy: directory call-back and two approvers over $10,000.\"","checks":["r2"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for \"under 110 words\" and it often lands well over.","fix":"Ask for less than the limit and cap each line: \"each line under 15 words, under 85 words total.\"","checks":["maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in a chat message they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Asks for the hold line","patterns":["hold","do not send","first line"]},{"label":"Asks for quotes","patterns":["quote","exact","from the email"]},{"label":"Uses your payment policy","patterns":["policy","directory","two approvers","call-?back"]},{"label":"Says exactly how many","patterns":["\\b3\\b.{0,25}(red flag|flag|line)","exactly (3|three)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"In finance, the first thing the reader needs is 'stop'. Ask for the hold line first, quoted red flags, and the exact checks your policy requires.","rubricLabels":["The first line is exactly 'Hold: do not send'","The 3 numbered red flags each quote the email (for example the northpeak-finance.example.co address or protonmail Reply-To, 'before 5:30 PM', 'don't discuss this with anyone', 'email only')","There are exactly 2 lines starting 'Required:': a call-back to Grace at the company directory number (not one from the email), and two approvers because $48,500 is over $10,000"]}