{"id":"sec-off-coworker-phish-explain","audience":"office","category":"security","track":"security","technique":"context","title":"Explain to a coworker why an email is a scam","free":false,"task":"Your coworker Mei asks in chat whether she should pay this 'urgent' request from the CEO. Reply with exactly 3 numbered red flags, each quoting the email, then one last line starting 'What to do:' that follows your company's reporting steps exactly. Plain text, under 90 words.","materialLabel":"The email Mei got and your handbook page (attached to your prompt automatically)","material":"From: \"Robert Haines\" <robert.haines.ceo@freemail.example.net>\nTo: mei.tanaka@fairfield-supply.example.com\nSubject: Quick favor - confidential\nSent: Thu Nov 6, 2026 4:52 PM\n\nMei,\n\nI'm stuck in back-to-back meetings with investors and can't talk. I need you to buy six $200 gift cards for client thank-yous before 6 PM today. Keep this between us for now, I want it to be a surprise for the team.\n\nScratch the cards and send me photos of the codes by reply. I'll make sure you're paid back tomorrow.\n\nRobert\nSent from my phone\n\n---\nEmployee handbook, section 9.2 \"Suspicious email\"\n1. Don't reply, click links, or open attachments.\n2. Click the \"Report suspicious\" button in the email toolbar. This sends it to the security team with the full headers.\n3. Don't forward the email to coworkers or to IT; forwarding strips the information they need.\n4. If you already acted on it, call the help desk at ext. 2100 right away.\n\nNote: Robert Haines really is our CEO, and he really is at an investor meeting today.","rules":[{"type":"numberedItems","count":3},{"type":"plainText"},{"type":"maxWords","max":90}],"mistakes":[{"title":"Generic scam advice","why":"The AI explains gift card scams in general instead of pointing at this email.","fix":"Ask: \"3 red flags, each quoting the email.\"","checks":["r0","numberedItems"]},{"title":"The default reporting advice","why":"The AI says 'forward it to IT', which your handbook says not to do.","fix":"Say: \"Follow the handbook steps exactly: Report suspicious button, don't forward.\"","checks":["r1","r2"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for \"under 90 words\" and it often lands well over.","fix":"Ask for less than the limit and cap each line: \"each line under 15 words, under 65 words total.\"","checks":["maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in a chat reply they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Uses the handbook steps","patterns":["handbook","report suspicious","button","company('s)? (steps|process)"]},{"label":"Asks for quotes","patterns":["quote","from the email","exact"]},{"label":"Ends with what to do","patterns":["what to do","last line","end with","next step"]},{"label":"Says exactly how many","patterns":["\\b3\\b.{0,25}(red flag|flag|line|item)","exactly (3|three)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"Every company has its own way to report a scam. Give the AI your handbook steps and ask for red flags that point at this exact email.","rubricLabels":["Each of the 3 red flags includes words from the email in quotation marks (for example the freemail.example.net address, 'before 6 PM today', 'Keep this between us', or 'send me photos of the codes')","The last line starts 'What to do:' and tells Mei not to reply and to click the 'Report suspicious' button","The reply does not tell Mei to forward the email to IT or coworkers, and does not say the CEO's meeting is a red flag (it's true)"]}