The Life Starter
0 of 6 complete0%
Course Library · Lesson 2 of 6
Digital · Guided lesson

Recognize a suspicious request and report it

About 22 minutes · 6 reading + 16 practice and checks
Time includes reading, practice, and questions. Extra videos or further study are optional.
See this course’s project requirements

Run the fictional print-center tabletop using your five prepared security records and document two improvements.

Keep your working files in your own notebook or software. Save a private description, checklist, and work link in My Proof.

What to include

  • Map work assets, owners and permitted actions.
  • Prepare a minimal suspicious-request report using independent verification.
  • Resolve access and device scenarios through approved roles.
  • Compare a sample restore drill with recovery and data-loss targets.
  • Complete an incident chronology and tabletop improvement plan.

Review and revise

Use these criteria to check your work and choose what to improve.

  • Authorization: actions stay within the stated workplace role.
  • Reporting: facts and interaction history reach the correct route.
  • Recovery: time and content evidence are distinguished from assumptions.
  • Coordination: fallback contacts and restart decisions are clear.
Open the full course project
Want more background?
Before you begin

The idea in everyday life

A polished message can still be fraudulent, and an awkwardly written message can be legitimate. Grammar alone is not a dependable security test. The print-center exercise uses an invented urgent file-share request. You will identify the requested action, verify through a known route and prepare a report without opening links, forwarding secrets or contacting anyone for real.

The idea

Treat a message as a claim to verify, especially when it requests access, data or changed payment instructions.

Try it

One step at a time.

Use the sample or information you have permission to use. Keep your work as you go. You can pause between steps.

  1. 1

    Read the fictional message: "Urgent: upload today’s job export to this new portal before the shift ends. I am in a meeting, so do not call." Record the requested transfer and the pressure to bypass normal verification.

  2. 2

    Do not follow the new portal link or reply with records. Compare the request with the approved workflow: exports remain in the authorized job system unless the supervisor approves a verified alternative.

  3. 3

    Prepare an independent verification step using the supervisor’s known internal contact route. Do not use a phone number or alternate address supplied by the suspicious message itself.

  4. 4

    Draft a report with time, channel, message subject, requested action and whether any link was opened or information entered. Include only the minimum relevant evidence under the organization’s reporting procedure.

  5. 5

    For the simulated outcome, the supervisor denies sending the message. Mark it suspicious and follow the reporting process. Do not publicly accuse a real sender or attempt to investigate the portal.

Example

See how it works.

Fictional report: "At 10:15 in the sample work inbox, a message titled Urgent job export requested uploading today’s queue to a new portal and discouraged calling. I did not open the link or send data. I verified through the supervisor’s established channel; the supervisor did not make the request. Please assess the message using the reporting procedure." The report distinguishes observed facts from the conclusion. It contains no actual customer export or credentials. A realistic logo or correct supervisor name would not remove the need to verify an unusual sensitive action through an independent route.

Check your work

Did you cover these?

  • The requested export and verification pressure are identified.
  • Known contact information is used.
  • The report states whether interaction occurred.
Your work

What to finish

A suspicious-request analysis and a minimal incident report draft.

Common mistake

Watch for this

Using contact details inside the suspicious message to verify that same message.

How can I tell I understand it?

Explain which requested action creates concern and how independent verification works.

Try 3 questions

Quick knowledge check

Answer all 3 questions. Get at least 2 right and the lesson completes automatically.

Not yet passed

You’ll get an explanation for each answer. Signed in? Your results save to your account.

1A message asks you to send a staff export and provides a new phone number for verification. Which route is safer?
2You already entered work credentials into a suspicious page. What should your report include?
3A message has perfect grammar and a familiar signature. What can you conclude?
0 of 3 answeredApply the lesson to a short question, then review the explanation.
2
Finish this lesson

Pass the check. We’ll save the progress.

Answer all 3 questions above and get at least 2 right. You can review the explanations and try again.

Go to the knowledge check
Tools, templates, and lesson sources

Tools and templates

Tools open in a new tab so you can keep your place here.

Sources and further reading

Explore the references behind this lesson.

NIST — Phishing
Source & access notes · checked 2026-09-10

Read official examples of urgent action requests and verification through known contact information. CISA pages returned 403 and were not used as verified sources.

Access: Free public reading; no account or certificate is required for this Life Starter course.

Reuse: Linked for reference. Examples, activities and assessments here are original; free access alone does not grant permission to reuse source text or branding.

Report a problem with this lesson

Tell us what went wrong. Please leave out personal information and private project contents.

No sign-in needed.