Realistic Scenarios

The domains don't match — the email is from summitconsulting.co but the company's real website is summitconsultinggroup.com. This could be a scam using a lookalike domain, or it could be (though unusual) a separate billing domain.

Don't assume the worst, but don't assume the best either. This is a $22,000 wire transfer — the stakes warrant a phone call. And notice the trap in the second option: the phone number on the invoice belongs to whoever sent the invoice. If the invoice is fraudulent, that number connects you to the attacker, who will happily "confirm" everything.

What to do:

1. Call Summit Consulting Group at the phone number on their real website (summitconsultinggroup.com) or from your notes from business discussions
2. Ask: "We received an invoice from billing@summitconsulting.co. Is that your billing address?"
3. If they confirm — proceed with normal payment processing
4. If they don't recognize it — you've just caught a fraud attempt. Report it to your security team and alert Summit Consulting that someone is impersonating them.

Rules that apply:

• Rule #1 (the real destination is the last two parts before the slash) — the domains are different
• Rule #3 (never use a suspicious message to verify itself) — don't call a number from the invoice; use one from the real website
• Rule #12 (any change to where money goes requires a phone call) — this is a new payee with wire instructions

This is legitimate. Run the checklist:

• WHO: Your real IT department, from their real email address
• WHAT: Reset your password via the real IT portal
• WHY: Quarterly review — routine, not urgent or threatening
• DOES IT MAKE SENSE: Yes — your manager independently confirmed it yesterday

Best practice is still to navigate to the IT portal directly (type the URL or use a bookmark) rather than clicking the email link. This costs nothing extra and eliminates even the theoretical risk of a compromised IT account.

The important lesson here: NOT everything is a scam. Flagging this legitimate IT communication as phishing would waste your security team's time investigating a false alarm. Calibrated judgment — the ability to distinguish real from fake based on evidence — is more valuable than blanket suspicion.

Rule that applies:

• Rule #14 (not everything is a threat — accurate judgment beats blanket suspicion)

This has every hallmark of a vishing attack using AI voice cloning. Run the checklist:

• WHO: Caller ID can be spoofed. AI can clone voices from seconds of audio. The "who" cannot be verified from the call itself.
• WHAT: Process a $95,000 wire to a NEW vendor — high-risk action
• WHY: "Before banks close," "about to board a flight," "won't be reachable" — manufactured urgency designed to prevent you from verifying
• DOES IT MAKE SENSE: Would the CFO normally call you directly to process a wire? Would they normally bypass the two-person approval process? Would a $95,000 payment really not be set up until 4:40 PM on a Friday?

Quizzing the caller isn't reliable either — attackers who clone a voice have usually also done their research, and (as you saw in Module 2) they may have been reading the real CFO's email for weeks. Personal details are not proof of identity.

What to do:

1. Hang up
2. Call the CFO at their known number from your contacts or company directory
3. If it was really them, they'll understand. If it wasn't, you just prevented a $95,000 loss.

The "won't be reachable for several hours" is the key tell — it's specifically designed to prevent the verification call. When someone tells you NOT to follow up, that's when you MUST follow up.

Rules that apply:

• Rule #5 (the more urgent it feels, the more important it is to slow down)
• Rule #7 (hang up and call back — you can't trust incoming calls)
• Rule #12 (any change to where money goes requires a phone call to confirm)

Your email account may be compromised. This is now an incident response situation — and a password change alone is NOT enough. As you learned in Lesson 2.3, attackers set up persistence that survives password resets.

Take these steps immediately:

1. Tell your colleague NOT to click the link if they haven't already — and to warn anyone else who received it
2. Change your password immediately from a trusted device
3. Check your Sent folder for messages you didn't send
4. Check your email rules and filters — look for forwarding rules you didn't create. Attackers commonly set up rules with minimal names (a period, a semicolon, a single letter) that forward emails containing keywords like "invoice," "payment," or "bank" to an external address. These rules survive password resets.
5. Review connected applications — check for OAuth apps you didn't authorize. Revoke anything unfamiliar. Remember: password resets alone do NOT invalidate existing OAuth tokens.
6. Contact your IT/security team immediately — "My colleague received an email from my account that I didn't send. I think my account may be compromised."
7. Think about exposure — did you recently enter credentials on a page you weren't 100% sure about? Do you reuse this password on other sites?

Notice how the compromise was discovered: not by you, but by a colleague who verified in person ("Did you send this?"). Your colleague applied Rule #6 (verify the person, not the account) — they didn't trust the email just because it came from your address. They walked over and asked you directly.

Rules that apply:

• Rule #6 (verify the person, not the account — your colleague did this by asking you in person)
• Rule #3 (never use a suspicious message to verify itself — your colleague went outside of it)

Click the link. Run the checklist:

• WHO: Real client, real address, in a thread you've been part of
• WHAT: Review a document — no money, no passwords, no sensitive data
• WHY: Normal project workflow — no manufactured urgency
• DOES IT MAKE SENSE: Yes, completely. This is routine collaboration.

One caveat: If the document requires you to enter credentials (username and password) to view it, pause and verify through a separate channel. A compromised account could send a link to a credential-harvesting page, even if the initial email looks perfect. But if it's just a document to review — proceed normally.

The broader lesson: Not everything is a threat. If you call to verify every routine email, your colleagues will stop taking your calls — and if you forward every normal message to the security team, you're burying them in false alarms. Save the verification call for high-risk actions: money, credentials, sensitive data, channel changes.

The goal of this course was never to make you afraid of email. It was to give you a reliable process for distinguishing the 0.1% that's dangerous from the 99.9% that's routine. The four questions work. Trust them.

Rule that applies:

• Rule #14 (not everything is a threat — accurate judgment beats blanket suspicion)