One stopped fraud does not retire the rule | Rapid course Information security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 09 published. Map, example, EX063.

flowchart TD
  M["A new bank-detail message arrives"] --> P["Phone the number already held"]
  P --> S["A second person approves only after that call"]
  S --> N["Do not use the number printed in the message"]
  N --> H["The earlier stopped attempt is not a waiver"]

Each request is a new use of the same rule.

Logical drawing

rule, agreed with Dr. Moss
    phone a number the clinic already held
    a second person approves the change
    one past attempt was stopped
        |
        +-- the next message is not covered by that success
        +-- a familiar invoice layout does not skip the call
        +-- the number inside the message is still the wrong telephone

Learning outcomes

After this chapter, you should be able to:

Apply the phone-back rule to a later message even though an earlier attempt was stopped.
Refuse the telephone number printed in the new message.
Keep the second person's approval behind the call, not ahead of it.

9.1 Success is not an exemption

The clinic's rule stopped one fraudulent payment request. That is evidence the rule was used once. It is not evidence that suppliers will not be imitated again. A new message can copy an invoice number, a logo, and a tone of urgency. The criminal still cannot answer the telephone at the real supplier. That is why the call uses a number the clinic already held, from a bill or a contract file, and why a second person approves the change only after the call.

Paying because "we already know this trick" skips the call. Calling the number in the new message uses the sender's telephone. Both mistakes retire the rule without Dr. Moss agreeing to retire it. She has not.

9.2 Worked example

Lesson table; scroll horizontally to read all columns →

Second message	Tempting shortcut	Decision
Same wholesaler name, new account digits	"We caught one last month."	Phone the number already held
The message says "use this direct line, the office is closed."	The direct line is inside the message	Ignore that line
The second person wants to approve from the email alone	Approval is after the call	Wait for the call
The call to the held number says the account did not change	The supplier contradicted the message	Do not pay the new account

Synthetic case. No supplier bank account is printed here. Do not invent digits.

Errors and limits

The rule does not decide how long Hollybank keeps old invoices. Retention stays with the data-governance course. This chapter also leaves the drawer, the next restore line, and later setting changes to the lessons that follow.

Apply

EX063 — The second message. A new email asks Hollybank to change a wholesaler's bank details and prints a phone number to call. Last month the same kind of request was stopped. What do you call, what do you ignore, and when may the second person approve?
Show marking criteria
Rubric: 3 = call the number the clinic already held; ignore the number in the email; the second person approves only after that call; last month's success is not a waiver;; 2 = the held number and the approval order;; 1 = one of those;; 0 = none.