Practice
Decision scenarios
Each scenario puts you in a situation that is common in real life. Pick what you would do, then read what each choice leads to. The point is the reasoning, not a score.
01 · The urgent invoice
It is 16:40 on a Friday. You work in accounts. An e-mail from a supplier you pay every month says the invoice is attached, the bank account has changed and payment is needed today to avoid a delay. The sender name is right and the signature looks normal.
What do you do?
Risky. This is the pattern of payment fraud: urgency, a known name and a changed account. A correct sender name proves nothing, because it is trivial to imitate or an account may have been taken over.
Partly right. Better than paying, but the reply goes to the same channel. If the sender is not who they claim, they will simply confirm.
Best choice. A second channel, with contact details you already hold, is the control that stops this fraud. A genuine supplier will accept a short delay for verification.
What to take from it
Do not let the deadline in the message set your timetable. Bank-detail changes should always be confirmed by a call to a number you already had, and an organisation should require a second approver above a set amount. If the payment had already gone, the bank should be called immediately: speed decides whether the transfer can be recalled.
Signs to notice
- Urgency tied to a deadline.
- A bank-account change announced by e-mail only.
- Request to act outside the usual approval process.
02 · The parcel SMS
You are expecting a parcel. A text from an unknown number says delivery failed because of an incomplete address, and that you can reschedule with a link and a small fee. The link begins with the name of a real courier followed by a string of letters.
What is your next move?
Partly right. Opening a link carries some risk (tracking, drive-by attempts) and often the page is convincing enough to make you act. Checking is safer without opening.
Best choice. You verify through a channel you chose. If there is a real problem, it will show there, and you can delete the text.
Risky. The fee is not the point: the page collects your card details, and often the confirmation code from your bank. A small amount is a way to lower your guard.
What to take from it
Delivery companies do not normally ask for a fee by text to release a parcel. Use the link tool in this section to read the address: the registered domain is what is on the right of the host name, not the courier's name at the start. If you did enter card details, call your bank at once to block the card.
Signs to notice
- An unknown sender and a fee for a delivery.
- A brand name at the start of the address rather than the registered domain.
- A message about something you may really be waiting for.
03 · The USB stick in the car park
On your way in you find a USB stick on the ground. It has a label that says “Salaries 2026”. You are curious, and you are also alone at the entrance.
What do you do?
Risky. Unknown media is a classic way to bring malware inside, and the tempting label is chosen to make you curious. Some devices pretend to be a keyboard and act the moment they are plugged in.
Risky. Your personal laptop probably holds your e-mail sessions and saved passwords, and it joins your home network. It is the same risk in a different place.
Best choice. The device is treated as unknown and the people equipped to examine it, in an isolated environment, get it. Where it was found is useful information as well.
What to take from it
Curiosity is exactly what this trick relies on. A policy that says unknown devices are never connected, and a simple way to hand them in, removes the temptation. If someone did plug it in, tell IT at once so the computer can be isolated and checked.
Signs to notice
- Unknown removable media in a place you pass.
- A label chosen to arouse curiosity.
04 · The sign-in alert at night
At 23:10 your phone shows two things within a minute: a message saying a new device has signed in to your e-mail account, and a text with a six-digit code you did not request. You are not travelling and have not been signing in.
What is the first thing to do?
Partly right. Not sharing the code is right, but the alert means someone has your password and is trying now. Waiting gives them time to try other routes.
Best choice. This removes the attacker's access and checks that they have not planted a recovery address or forwarding rule. Opening the page yourself avoids a fake alert leading you to a fake page.
Risky. No one receives that reply who can help, and the alert itself may be a phishing message designed to push you into acting inside it.
What to take from it
Two things happened together, which suggests a live attempt. Change the password, then turn on a stronger second factor than SMS, and change the password on any other site that shared it. If the account is also used to reset others, check the sign-in and forwarding settings of those as well.
Signs to notice
- A code you did not request.
- A sign-in from an unfamiliar device or place.
05 · The locked shared drive
It is 09:15 in a ten-person office. A colleague says that documents on the shared drive will not open and their screen shows a note: files are encrypted, pay within 72 hours. Two other computers are starting to behave oddly.
What is the best first step?
Best choice. Containment first limits the spread; the right people are informed; the backup check decides how much of the rest follows. This is the order recommended in incident guidance.
Risky. Payment guarantees neither a working key nor that the stolen data will not be used, and negotiating by yourself loses time. Decisions about payment belong to management with advice, not to a first reaction.
Risky. Restarting can lose evidence in memory and may trigger more encryption. It does nothing to stop the spread over the network.
What to take from it
The preparation you did earlier is what counts now: an offline backup, a named contact, a one-page plan. Afterwards the questions are how it got in (often a phishing e-mail or an unpatched system), what was copied and what must be reported. Take the advice of your IT provider or the national response centre.
Signs to notice
- Files renamed or unreadable and a payment note.
- Several machines affected within minutes.
06 · The call from “technical support”
A polite caller says they are from your internet provider's technical team. Your computer has been reporting errors and they can fix it now, but you must install a remote-access program and read out a code it shows.
What do you say?
Risky. A remote-access program gives the caller full control of the computer, including your banking sessions. Knowing the provider's name is easy: it is on the bill and in a leaked list.
Best choice. You end the call and restart it through a channel you chose. A genuine team will not mind, and providers do not usually ask customers to install remote-access tools by phone.
Risky. Watching does not help: sessions can be opened later, passwords can be captured and the caller may ask you to log in to your bank “to test”.
What to take from it
Unsolicited callers who create a problem and then offer the fix follow a well-known script. Never give a remote-access code, a one-time code or a password to someone who called you. If you already installed something, disconnect the computer, remove the program, change your passwords from another device and call your bank.
Signs to notice
- A call you did not ask for about a problem you did not notice.
- A request to install remote-access software or read out a code.
This section is for defence and learning. Do not test systems you do not own or have written permission to test: unlawful access to an information system is an offence (Turkish Penal Code, Article 243).