Security awareness · interactive scenario
A 3-minute decision that protects your company.
You will read a message, decide how to respond, and see what happens. Spot the red flags and choose the safe move.
By the end, you will be able to
First, the basics
An urgent-request scam is a message that uses pressure and a trusted name to rush you into sending money or data before you stop to check.
Explore all three tabs below to learn more about this social-engineering attack.
Attackers impersonate someone you trust, like a boss, a vendor, or a coworker, and they pile on pressure so you act before you think.
The goal is almost always money, card or login details, or sensitive data.
Five tells show up again and again. Hover or focus each one to see an example.
Not a red flag A sender using your first name. Personalization is normal in everyday email.
Do not act on the message itself.
Verify the request through a channel you already trust, like calling the person on a known number or checking in person. Then report it to your security team.
One report can protect everyone.
1 of 3 read
I'm about to step into a board meeting and can't talk. We need to wire $24,800 to a new vendor today to close a deal. Don't loop in anyone else yet, it's confidential. Send me the company card details and I'll forward the invoice after. I'll send you a secure payment link right after I'm out. Thanks, Daniel.
Does anything look off?
Sharing card details by message hands the attacker direct access to company funds. The pressure and secrecy were the tell. A real executive expects you to verify a money request.
Links sent under pressure can capture credentials, authorize payments, or install malware, even if they look legitimate. The pressure and time crunch are designed to stop you from checking. Verify the request through a known channel before clicking anything.
You slowed down, verified through a trusted channel, and reported it. That single habit stops most social-engineering attacks. Reporting also warns your whole team.
Anatomy of the attack
The same message, with every red flag highlighted. Select each one to see why it is a tell. Found 0 of 5 red flags.
From: Daniel Okafor, CFO · daniel.okafor@
This is a lookalike external domain, not your company's real domain. The name is built to look trustworthy.
Subject:
Extreme urgency and a tight deadline are designed to make you act before you can think.
I'm about to step into a board meeting and can't talk. We need to wire $24,800 to a new vendor today to close a deal. and I'll forward the invoice after. Thanks, Daniel.
Pressure to keep it secret stops you from checking with anyone who might catch the scam.
A request to move money and share card details is the attacker's goal. Treat it as a stop signal.
A link to act on under pressure can capture credentials or trigger a payment. Verify before clicking anything.
The display name can say anything. What matters is the domain, the part right before .com.
The word right before .com is who really owns the address. Yours is "yourcompany"; this sender's is "finance-corp-secure", an outside domain dressed up to look official.
One more step
Build the report on the laptop. Drag each piece into the message, or tap it. Two of the three choices in each step are wrong.
Report sent
Security can warn the team and block the sender.
Module complete
What you learned
Spotting one red flag is enough to stop the attack.
I'm Chalece DeLaCoudray, a learning experience designer and technologist. If this is the kind of learning you want to build, let's talk.