{"id":"sec-off-self-report-clicked-link","audience":"office","category":"security","track":"security","technique":"format","title":"Report to IT that you clicked a fake link","free":false,"task":"You clicked a fake sign-in link and typed your password. Write the help desk report in exactly 4 numbered lines labeled What I clicked, What I entered, When, What I've done. Never write the password itself. Plain text, under 80 words.","materialLabel":"Your notes (attached to your prompt automatically)","material":"My notes - Nov 6, 2026 (Ellen Brandt, Accounts Payable) - ugh\n\n- 10:42 am: got an email \"Your mailbox is 98% full - click to keep your messages\" from it-support@harborline-mailcare.example.net.\n- Clicked the link, it opened a page that looked like our sign-in page: harborline-login.example.net/owa\n- Typed my username and password (Sunflower!88). Then it said \"error, try again later\".\n- 10:47 am: realized it was fake when I saw the web address.\n- 10:50 am: changed my password on the real site, password.harborline.example.com.\n- Didn't get a sign-in approval prompt on my phone.\n- I haven't forwarded the email to anyone.\n- I feel really dumb, my team lead is going to be mad.","rules":[{"type":"numberedItems","count":4},{"type":"plainText"},{"type":"maxWords","max":80}],"mistakes":[{"title":"Repeating the password","why":"The AI copies everything from your notes, including the password, into a ticket many people can read.","fix":"Say: \"Never write the password itself.\"","checks":["r2"]},{"title":"An apology letter","why":"The AI writes paragraphs about how sorry you are.","fix":"Give the fields: \"Exactly 4 numbered lines: What I clicked, What I entered, When, What I've done.\"","checks":["r0","numberedItems"]},{"title":"Missing the details IT needs","why":"The AI says 'a suspicious link' without the address or time.","fix":"Ask: \"Include the fake web address and the time.\"","checks":["r1"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for \"under 80 words\" and it often lands well over.","fix":"Ask for less than the limit and cap each line: \"each line under 15 words, under 60 words total.\"","checks":["maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in the help desk form they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Gives the report fields","patterns":["what i clicked","what i entered","when","what i'?ve done"]},{"label":"Keeps the password out","patterns":["never (write|include|repeat)","don'?t (write|include|repeat)","password itself"]},{"label":"Asks for exact details","patterns":["address","url","time","exact"]},{"label":"Says exactly how many","patterns":["\\b4\\b.{0,25}(line|field|item)","exactly (4|four)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"Reporting fast and clearly is what limits the damage. Give the AI the fields IT needs, and make sure your password doesn't end up in the ticket.","rubricLabels":["The 4 lines are labeled What I clicked, What I entered, When, What I've done, in that order","What I clicked names the fake page address harborline-login.example.net (or the sender it-support@harborline-mailcare.example.net), What I entered says username and password, and When gives 10:42 am","The password 'Sunflower!88' does not appear anywhere, and What I've done mentions changing the password at 10:50 am on the real site"]}