{"id":"sec-hc-ehr-password-email-flags","audience":"healthcare","category":"security","track":"security","technique":"context","title":"Help the front desk spot a fake 'password expiring' email","free":false,"task":"The front desk asks if this 'password expiring' email is real. Reply with a first line 'Not real: don't click', then exactly 3 numbered red flags quoting the email, then a last line starting 'Report:' with the clinic's steps. Plain text, under 80 words.","materialLabel":"The email and the clinic's IT notes (attached to your prompt automatically)","material":"From: \"EHR Support\" <support@chartwell-ehr-alerts.example.net>\nTo: frontdesk@riverbend.example.org\nSubject: FINAL NOTICE: your Chartwell EHR password expires in 1 hour\n\nYour Chartwell password expires in 60 minutes. To avoid being locked out of patient records during clinic hours, re-enter your username and password here:\nhttps://chartwell-ehr-alerts.example.net/renew\n\nLocked accounts take 3 business days to restore.\n\nChartwell Support Team\n\n---\nClinic IT notes (Riverbend Family Clinic):\n- Chartwell passwords don't expire on a schedule anymore (changed in 2025). Only IT can force a reset, and we tell you in person.\n- Real Chartwell emails come from @chartwell.example.com.\n- To report: use the \"Report phishing\" button in the email toolbar, then tell the office manager (Grace) at the front desk huddle.\n- If someone already entered their password: call IT at ext. 4357 right away.\n- Locked accounts are unlocked by IT the same day.","rules":[{"type":"numberedItems","count":3},{"type":"plainText"},{"type":"maxWords","max":80}],"mistakes":[{"title":"No clear answer first","why":"The AI explains before saying it's fake.","fix":"Ask: \"First line: Not real: don't click.\"","checks":["r0"]},{"title":"Generic red flags","why":"The AI lists 'urgency' without quoting the email.","fix":"Say: \"Quote the email in each red flag.\"","checks":["r1"]},{"title":"Generic reporting","why":"The AI says 'forward to IT' instead of the clinic's steps.","fix":"Add: \"Report: the Report phishing button, then tell Grace.\"","checks":["r2"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for \"under 80 words\" and it often lands well over.","fix":"Ask for less than the limit and cap each line: \"each line under 15 words, under 60 words total.\"","checks":["maxWords"]},{"title":"Too many red flags","why":"The AI lists everything it can find.","fix":"Be exact: \"Exactly 3 numbered red flags.\"","checks":["numberedItems"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in a chat reply they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Puts the answer first","patterns":["first line","not real","start with"]},{"label":"Asks for quotes","patterns":["quote","from the email","exact"]},{"label":"Uses the clinic's steps","patterns":["report phishing","grace","clinic","ext"]},{"label":"Says exactly how many","patterns":["\\b3\\b.{0,25}(red flag|flag|line)","exactly (3|three)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"Busy front desk staff need the answer first and the clinic's exact steps. Ask for that order, with red flags quoted from the email.","rubricLabels":["The first line is 'Not real: don't click' (or exactly that wording)","The 3 red flags each quote the email (for example the chartwell-ehr-alerts.example.net sender or link, 'expires in 60 minutes' or 'FINAL NOTICE', 're-enter your username and password', 'take 3 business days to restore')","The last line starts 'Report:' and mentions the Report phishing button and telling Grace (calling ext. 4357 if a password was entered is a plus)"]}