{"id":"sec-it-mfa-prompt-user-message","audience":"it-security","category":"security","track":"security","technique":"tone","title":"Tell a user calmly that their account was reset","free":false,"task":"Message the user whose account you just locked after an overnight flood of sign-in prompts. She's not technical and may feel embarrassed. One opening sentence on what happened with no blame, then exactly 3 numbered steps, using only the contact details in the notes. No security jargon (no MFA fatigue, push bombing, threat actor or compromise). Plain text, under 80 words.","materialLabel":"Alert and analyst notes (attached to your prompt automatically)","material":"ALERT-3390 | Nov 6, 2026 | user: dana.brooks (Finance)\n01:10 to 01:40: 14 sign-in approval prompts sent to Dana's phone from an unknown sign-in at 203.0.113.61.\n01:41: one prompt was approved.\n01:43: new session opened on the email web app from 203.0.113.61.\n02:00: SOC (Ivan) ended all sessions, reset the password, and blocked 203.0.113.61.\n02:20: no mail rules created, no emails sent from the account. Nothing else found so far.\n\nAnalyst notes:\n- Dana probably tapped approve while half asleep. Very common, not her fault.\n- Help desk will call Dana at 8:30 this morning from ext. 4400 to set up a new password with her.\n- If anyone else calls claiming to be IT and asks for a code, she should hang up and call ext. 4400 herself.\n- Her manager (Raúl) has been told.\n- Dana prefers chat messages over email.","rules":[{"type":"numberedItems","count":3},{"type":"plainText"},{"type":"maxWords","max":80}],"mistakes":[{"title":"Sounding like an incident report","why":"The AI recites the timeline and IP address, which scares a non-technical reader.","fix":"Say: \"One calm sentence on what happened. No IPs or jargon.\"","checks":["r2"]},{"title":"Blaming the user","why":"The AI often says 'you approved a fraudulent request', which makes people hide mistakes next time.","fix":"Add: \"No blame. She may feel embarrassed.\"","checks":["r0"]},{"title":"Vague next steps","why":"The AI says 'contact IT' without the time, extension or what to watch for.","fix":"Ask: \"3 numbered steps using the 8:30 call and ext. 4400 from the notes.\"","checks":["r1","numberedItems"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for \"under 80 words\" and it often lands well over.","fix":"Ask for less than the limit and cap each line: \"each line under 15 words, under 60 words total.\"","checks":["maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in a chat message they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Sets a calm, no-blame tone","patterns":["blame","calm","reassur","embarrass","kind"]},{"label":"Says who it's for","patterns":["non-?technical","user","dana","employee"]},{"label":"Bans jargon","patterns":["jargon","plain (english|language|words)","no (technical|security) terms"]},{"label":"Says exactly how many","patterns":["\\b3\\b.{0,25}(step|line|item)","exactly (3|three)"]},{"label":"Sets a word limit","patterns":["\\d+\\s*words","word (limit|count)"]}],"hint":"People report problems faster when they aren't blamed. Tell the AI who's reading, how she may feel, which words to avoid, and exactly which contact details to use.","rubricLabels":["The opening sentence says there were many sign-in prompts overnight and that her password was reset to protect her account, without blaming her (no 'you approved a malicious request' or 'your mistake')","The steps include waiting for the help desk call at 8:30 from ext. 4400 for a new password, and hanging up on anyone else asking for a code and calling ext. 4400 herself; no other phone number or link appears","Uses none of the terms MFA fatigue, push bombing, threat actor, compromise, or the IP address"]}