{"id":"sec-sb-phishing-report-process","audience":"small-business","category":"security","track":"security","technique":"context","title":"Write a phishing report process for a small office","free":false,"task":"You run a 12-person accounting office with no IT department. Write the phishing report process for the staff binder: exactly 4 numbered steps, each under 15 words, using only the tools and people in your notes. Step 1 is what to do before anything else. End with one line: 'If you already clicked: ...'. Plain text, under 90 words.","materialLabel":"Your setup notes (attached to your prompt automatically)","material":"Notes for the binder - Lakeside Bookkeeping (12 staff)\n\nWho handles it: Carla Mendes (office manager) is our security contact. Her cell is (555) 012-7781. Our outside IT company is BrightDesk IT, but they bill $150 per call, so staff should go through Carla first.\n\nOur email has a \"Report phishing\" button in the toolbar. When you click it, the message goes to Carla and is moved out of your inbox. This is better than forwarding, because forwarding loses the hidden details BrightDesk needs.\n\nLast March, someone forwarded a fake invoice to the whole office \"as a warning\" and two people clicked the link in the forward.\n\nIf someone already clicked a link or typed their password, Carla wants a phone call right away, not an email, because she can lock the account from her phone. Even after hours.\n\nWe don't have a security team, an incident hotline, or a SOC.\n\nThings staff ask: \"What if it's from a client I know?\" Answer: still report it. Client email accounts get hacked too.","rules":[{"type":"numberedItems","count":4},{"type":"plainText"},{"type":"maxWords","max":90}],"mistakes":[{"title":"A corporate template","why":"The AI writes a policy for a company with a security team and an incident hotline you don't have.","fix":"Say: \"12-person office, no IT department. Use only the tools and people in my notes.\"","checks":["r1"]},{"title":"Telling people to forward","why":"Forwarding is the AI's default advice, and it caused your last incident.","fix":"Add: \"Use the Report phishing button. Never forward.\"","checks":["r0","r1"]},{"title":"Forgetting the already-clicked case","why":"The AI covers spotting phishing but not what to do after a click.","fix":"Ask: \"End with: If you already clicked: call Carla at (555) 012-7781.\"","checks":["r2"]},{"title":"A long policy","why":"The AI writes sections with definitions and examples.","fix":"Be exact: \"Exactly 4 numbered steps, each under 12 words.\"","checks":["numberedItems","maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in a printed binder they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Describes the office","patterns":["12","small","no it","office manager"]},{"label":"Uses your tools","patterns":["report phishing","button","carla","don'?t forward"]},{"label":"Covers already clicked","patterns":["already clicked","clicked","after hours"]},{"label":"Says exactly how many","patterns":["\\b4\\b.{0,25}(step|line|item)","exactly (4|four)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"A small office needs a process that fits its real setup. Tell the AI who you have, what tools you have, and what to do after a click.","rubricLabels":["Step 1 is to not click, reply or open anything in the email, and one step is to use the Report phishing button","No step tells staff to forward the email to anyone, and the process mentions no security team, hotline or SOC, and does not send staff straight to BrightDesk IT","The last line starts with 'If you already clicked' and says to call Carla at (555) 012-7781 right away, even after hours"]}