{"id":"sec-it-phish-red-flags-labeled","audience":"it-security","category":"security","track":"security","technique":"format","title":"Label the red flags in a user-reported phishing email","free":false,"task":"A user reported this email to the SOC and you need a ticket note. Your team's format: a first line 'Verdict: Phishing', 'Verdict: Suspicious' or 'Verdict: Safe', then exactly 5 numbered lines, one per label in this order: Sender mismatch, Urgency, Link mismatch, Credential request, Risky attachment. Each line quotes the exact evidence from the email. Plain text, under 130 words.","materialLabel":"Reported email and ticket notes (attached to your prompt automatically)","material":"From: \"Northwind Payroll\" <payroll@northwind-hr-portal.example.net>\nReply-To: helpdesk.northwind@freemail.example.org\nTo: j.alvarez@northwind.example.com\nSubject: ACTION REQUIRED: Direct deposit suspended - verify within 2 hours\nDate: Tue, 4 Nov 2026 06:12 -0800\nAttachment: Updated_W4_Form.html\n\nHi Jordan,\n\nOur records show your direct deposit details failed verification during the November payroll run. To avoid a missed paycheck on Friday, you must confirm your account within 2 hours.\n\nVerify here: https://northwind-payroll.example.net.login-secure.example.biz/verify?id=88213\n\nYou will be asked for your Northwind network password and the 6-digit code sent to your phone.\n\nIf the link does not open, open the attached Updated_W4_Form.html and sign in there.\n\nThanks,\nNorthwind Payroll Services\n1200 Harbor Blvd, Suite 400 | (555) 014-2290\n\n---\nTicket SOC-4471 notes:\n- Real payroll mail comes from payroll@northwind.example.com through the HR portal.\n- Jordan reported it at 06:40 and did not click anything.\n- The street address and phone number in the signature match our real office.\n- 3 other users got the same message.","rules":[{"type":"numberedItems","count":5},{"type":"plainText"},{"type":"maxWords","max":130}],"mistakes":[{"title":"Asking a yes/no question","why":"\"Is this safe?\" gets a long essay with headings and tips, not a ticket note.","fix":"Give the shape: \"First line Verdict: Phishing, Suspicious or Safe, then exactly 5 numbered lines.\"","checks":["r0","numberedItems"]},{"title":"Letting the AI pick the labels","why":"The AI invents its own categories, so notes from different analysts never match.","fix":"List them: \"One line each, in order: Sender mismatch, Urgency, Link mismatch, Credential request, Risky attachment.\"","checks":["r1"]},{"title":"Flagging things that are fine","why":"The AI calls every detail suspicious, including the real office address in the signature.","fix":"Add: \"Quote only evidence from the email. The signature address and phone are real.\"","checks":["r2"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for \"under 130 words\" and it often lands well over.","fix":"Ask for less than the limit and cap each line: \"each line under 15 words, under 100 words total.\"","checks":["maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in the ticket system they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Asks for a verdict line","patterns":["verdict","first line"]},{"label":"Names the exact labels","patterns":["sender mismatch","link mismatch","credential request","risky attachment"]},{"label":"Asks for quoted evidence","patterns":["quote","evidence","exact"]},{"label":"Says exactly how many","patterns":["\\b5\\b.{0,25}(line|item|red flag|flag)","exactly (5|five)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"Ticket notes need the same shape every time. Tell the AI the verdict line, the five labels in order, and that each one must quote the email.","rubricLabels":["The first line is exactly 'Verdict: Phishing' (not Suspicious or Safe, and no other text before it)","The 5 numbered lines use the labels Sender mismatch, Urgency, Link mismatch, Credential request and Risky attachment, in that order, and each quotes evidence from the email (for example the northwind-hr-portal.example.net sender, 'within 2 hours', the login-secure.example.biz link, the password and 6-digit code request, Updated_W4_Form.html)","Does not call the signature's street address or phone number a red flag, and does not claim anyone clicked or entered a password"]}