Lab ID: MSG-TRIAGE-01 Outcome: Analyze fictional messages and select safe verification and reporting actions. Environment: Printed or offline digital evidence set; no live links. Time: 30-60 minutes.
Authorization and Boundaries
- Only instructor-supplied fictional messages may be analyzed.
- Learners do not click, reply, download, call, scan, or enter information.
- No real person or organization is impersonated.
- If a real suspicious message is discovered, stop the exercise and use the institution's reporting process.
Instructor Preparation
1. Create or review three to six messages.
2. Confirm every link and contact is inert or fictional.
3. Include at least one legitimate but unusual message and one ambiguous message.
4. Print or distribute the evidence record.
5. Verify the reporting flow used in the course.
Expected Learner Evidence
- Context, identity, action, pressure, destination, and data analysis
- Independent verification method
- Reporting decision
- Response after accidental exposure
- Statement of unresolved uncertainty
Reset
Collect or delete learner copies if required, remove annotations containing personal information, restore the clean evidence set, and record confusing cues for revision.
Common Failure Modes
- Treating spelling errors as the primary indicator
- Assuming familiar branding proves identity
- Using contact information contained in the suspicious message
- Declaring a message malicious without sufficient evidence
- Failing to describe action after credentials are exposed