A 7-minute interactive module

The email looked right. That was the point.

Most security breaches do not start with a hacker breaking down a wall. They start with one normal-looking message and one busy person who clicks. This module gives you the habit that stops it.

What you will be able to do

Given a real-looking work message, decide whether to trust it, verify it, or report it, and take the safe action before you click or share anything.

1. Spot the four red flags that show up in almost every phishing and scam message.

2. Tell a legitimate internal request apart from a spoofed one by checking the source another way.

3. Take the right action when you are not sure: do not click, verify through a channel you trust, and report it.

A short check at the end confirms all three.

1 of 9

Spot the red flags

Here is the message again. Four things give it away.

Tap each numbered marker to see what a trained eye notices. Reveal all four to continue.

1

2

3

4

0 of 4 revealed

1. The sender address is almost right

The name says "IT Help Desk," but the address is 1t-helpdesk.co, with a number one instead of the letter i, and a domain your company does not use. Attackers copy a trusted name and change the address by one character, because most people read the name and never check the address.

2. It manufactures urgency

"Locked in 30 minutes." "You must, now, or you lose access." Pressure is the oldest trick there is. It is designed to make you act before you think. Real IT teams give you time and a way to reach them. They do not threaten you with a countdown.

3. The link does not go where it says

The text mentions your company, but the actual address is secure-check.co, not your company's domain. Hover over any link before clicking. If the real destination is not the site you expect, that is the whole scam in one line.

4. It asks for your password

A legitimate IT team will never email you a link and ask you to type your password to "verify" it. Any message that wants your credentials, a payment, or a gift card is asking for the one thing you should never hand over because someone told you to hurry.

2 of 9

Watch: 90 seconds

Three seconds is all it takes.

A short message from your security team on the one habit that stops almost every attack of this kind.

►

Stop. Check. Report.

Security team welcome · 1:30

Your security team

"Welcome to the team. Here is the most useful thing we can teach you on day one. You do not need to be a security expert to keep us safe. You need one habit, and it takes three seconds.

Stop. When a message pushes you to act fast, that pressure is the warning, not the emergency. Slow down for three seconds. Nothing bad happens if you pause.

Check. Look at who the message is really from, and where the link really goes. If someone claims to be a coworker, your bank, or IT, and something feels off, reach them a way you already trust. Call the number you have on file. Message them on the internal system. Never use the contact details inside the suspicious message itself.

Report. If anything feels wrong, use the report button. You will never be in trouble for reporting a message that turns out to be fine. The only mistake is staying quiet. One report can protect the whole company, because if it reached you, it reached other people too.

Stop. Check. Report. That is the entire job. Let us practice it."

3 of 9

Sort the messages

Green, yellow, or red?

Tap a message to pick it up, then tap the column where it belongs. Place all eight to continue.

Messages to sort

A calendar invite from your manager for a 1:1 you scheduled

"Payroll: update your direct deposit here or miss this paycheck"

A vendor emails an invoice with new bank details for payment

A text: "It's the CEO. In a meeting. Buy 5 gift cards, send codes"

A team channel post from a coworker you know, no links, no ask

A recruiter you met asks to move the chat to your personal email

"Your package is held. Pay a small fee to release it" with a link

An MFA prompt pops up on your phone when you did not just sign in

Green

Normal, act as usual

Yellow

Stop and verify first

Red

Report it

4 of 9

Your call

Tuesday, 4:52 PM. A text from your CFO.

Text message · unknown number

You are three weeks into the job. You have never texted with the CFO. The message uses her real name and title, and it is polite and specific. It is also the end of the day and you want to be helpful.

The text you are staring atIt's Dana, the CFO. Stuck in a meeting. Buy five $200 gift cards for a client and text me the codes. I'll reimburse you today.

What do you do?

Debrief

You chose

5 of 9

Match them up

Every trick has a tell, and a safe move.

Tap a warning sign on the left, then tap the safe response on the right that answers it.

The warning sign

A countdown or threat: "act in the next 30 minutes"

A sender name you know, from an address you do not

A link whose text and real destination do not match

An MFA approval you did not ask for

The safe move

Hover to see the true address, and if it is not the site you expect, do not click

Treat the pressure as the warning, slow down, and verify before acting

Deny it, then change your password and report it, because someone has your login

Check the full address, and confirm with the person through a channel you trust

6 of 9

Your call

Wednesday, 9:10 AM. A message in your work chat.

Internal chat · new contact

A few seconds later, your phone buzzes with a real MFA prompt asking you to approve a sign-in. You did not just try to log in anywhere. The chat account was created six minutes ago.

The message, and then your buzzing phoneThis is IT. You'll get a login approval on your phone. Please tap Approve so we can finish clearing the alert.

What do you do?

Debrief

You chose

One line to keep

What will you do before you click next time?

Write the one sentence you will say to yourself the next time a message tells you to hurry.

NiceThat sentence is your whole defense. People who pause and check almost never get caught, not because they know more, but because they gave themselves three seconds. Keep it somewhere you will see it in a busy moment.

8 of 9

Quick check

Three questions, then you are done.

One for each thing you set out to learn.

Red flags

Which of these, on its own, is the strongest sign a message is a scam?

The message has a typo in it.

It pressures you to act fast and asks for a password, payment, or codes.

The message arrived after normal work hours.

Correct. Urgency plus a request for credentials, money, or gift cards is the signature of nearly every phishing and social-engineering attempt.

Verify the source

A coworker's name appears on an urgent request, but something feels off. The safest way to confirm it is real is to:

Reply to the message and ask them to confirm it is really them.

Reach them through a channel you already trust, like the company directory or internal chat.

Check whether the message spelling and logo look professional.

Correct. Verifying inside the suspicious message just talks to the attacker. Always confirm out of band, through a contact method you already know is real.

Take action

You get an MFA approval prompt you did not request. You should:

Approve it, since it will keep prompting until you do.

Ignore it and move on with your day.

Deny it, change your password, and report it, because someone likely has your login.

Correct. A prompt you did not start means your password is already known to someone. Deny, reset, and report. Never approve to make it stop.

0 / 3

You are ready

You can now spot the red flags, verify the source, and take the safe action.

The whole module in three words

1

Stop

Pressure is the warning. Give yourself three seconds.

2

Check

Who is it really from, and where does the link really go?

3

Report

If anything feels off, report it. You cannot be wrong for checking.

Remember

You are the strongest layer of security here.

Firewalls and filters stop most attacks. The ones that get through are aimed at people, on a busy afternoon, hoping no one pauses. You just learned to pause. That is the whole job.

About this sample

What you just experienced was built to be seen, not just read.

This is a working sample from Doc Martins, the instructional-design practice of Dr. Marie Martin. It shows how a required, often-dreaded compliance topic becomes something people finish and actually use. Every screen was designed against one behavior change: pause before you click.

Clear objectives up front, verified by a short check at the end
Seven interaction types in seven minutes: annotated visuals, a presenter video, sorting, two branching decisions, matching, reflection, and a knowledge check
Consequence-based feedback, so learners see what their choice would cause, not just right or wrong
Built accessible and responsive, phone to desktop, ready for SCORM delivery in any LMS

Prepared as a work sample for TrainingPros. Available to build custom eLearning, onboarding, compliance, leadership, and simulation-based programs on contract.

✉

Email

info@alexandriasdesign.com

Step into the 3D learning room

alexandriasdesign.com/about-room.html

→

Dr. Marie Martin, Ed.D.

University of Southern California · Learning Design and Technology

Twenty years in learning and instructional design. Selected work includes California Community Colleges, the Microsoft Education portfolio, CalAIM healthcare training, biotechnology enterprise learning, and AI-workforce programs. Accessibility-focused, outcomes-first, SCORM-ready.

Doc Martins.

Instructional design for the modern workforce · Alexandria's Design LLC