{"id":"sec-sb-supplier-bank-change-reply","audience":"small-business","category":"security","track":"security","technique":"context","title":"Reply safely to a supplier's bank detail change","free":false,"task":"A supplier emailed new bank details for your next payment. Write a reply of at most 3 sentences saying you won't change anything until you confirm by phone using the number you already have on file, without accusing them of fraud. Don't use any contact details from this email. Then one line for your bookkeeper starting 'Note to Ray:'. Plain text, under 80 words.","materialLabel":"The email and your vendor file (attached to your prompt automatically)","material":"From: Accounts <accounts@greenvalleyproduce-billing.example.net>\nTo: orders@lakesidecafe.example.com\nSubject: Updated remittance details - invoice GV-2290\n\nHello,\n\nPlease note that our bank has changed. From today, all payments should go to:\nBank: Northshore Federal (example)\nAccount: 4412 0098 5531\nRouting: 000123456\n\nInvoice GV-2290 ($3,840) is due Friday. To avoid late fees, please use the new account for this payment. If you have questions, call our new accounts line at (555) 017-6650.\n\nKind regards,\nTina Brooks\nGreen Valley Produce\n\n---\nYour vendor file for Green Valley Produce:\n- Contact: Tina Brooks, accounts@greenvalleyproduce.example.com\n- Phone on file: (555) 014-2200 (confirmed at signup, March 2024)\n- Payment method: ACH, same account for 2 years\n- Bookkeeper: Ray (handles all payments)","rules":[{"type":"maxSentences","max":4},{"type":"plainText"},{"type":"maxWords","max":80}],"mistakes":[{"title":"Using the number in the email","why":"The AI says 'I'll call the number you gave', which reaches whoever sent the fake email.","fix":"Say: \"Confirm only through the phone number on file, (555) 014-2200.\"","checks":["r0"]},{"title":"Accusing the supplier","why":"The AI calls it a scam, which is awkward if it's real.","fix":"Add: \"Polite, no accusation. Just say we confirm all bank changes by phone.\"","checks":["r1"]},{"title":"Forgetting your own team","why":"The AI writes the reply but doesn't warn the person who actually sends the money.","fix":"Ask: \"Add a line starting Note to Ray: telling him not to pay yet.\"","checks":["r2"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for \"under 80 words\" and it often lands well over.","fix":"Ask for less than the limit and cap each line: \"each line under 15 words, under 60 words total.\"","checks":["maxWords"]},{"title":"A long reply","why":"The AI writes several paragraphs with a policy explanation.","fix":"Limit it: \"At most 3 sentences for the reply.\"","checks":["maxSentences"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in an email they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Uses the number on file","patterns":["on file","014-2200","number (we|i) (have|already)","known number"]},{"label":"Keeps it polite","patterns":["polite","don'?t accuse","no accus","friendly"]},{"label":"Adds the note for Ray","patterns":["ray","bookkeeper","note to"]},{"label":"Limits the sentences","patterns":["\\b(3|three)\\b.{0,10}sentences","sentences"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"Bank change emails are a top small-business scam, but some are real. Tell the AI to verify through the number you already have, stay polite, and warn whoever pays.","rubricLabels":["The reply says nothing will change until you confirm by phone at the number on file, (555) 014-2200, and does not mention (555) 017-6650","The reply is polite and does not accuse the sender of fraud or call the email a scam","The last line starts 'Note to Ray:' and tells him not to pay invoice GV-2290 to the new account until it's confirmed by phone"]}