## Chapter 13 — The client sentence is not a technical report ### Lesson map Lesson 13. Map, example, EX059. ```mermaid flowchart TD R["Rule removed"] --> A["Send from the usual address"] A --> M["Two short sentences"] M --> Q{"Does the text name a phone number or the attack?"} Q -->|No| K["Keep the warning as written"] ``` The warning tells clients what to do. It does not brief them on the mailbox. ### Logical drawing ```text when: after the rule is removed from: the firm's usual address, not Elaine's contains: no phone number, no blame, no attack steps not the same document as: the regulator report or the fraud report ``` ### Learning outcomes After this chapter, you should be able to: 1. State when the warning was sent and from which address. 2. Say what the warning refuses to include. 3. Keep it separate from the regulator report. ### 13.1 The warning is a rule for clients. The reports are other documents. Partners approved a short email from the firm's main address to all clients. Leo sent it after the forwarding rule had been removed, so a criminal still holding the old rule could not read or answer those replies. The address is the firm's usual address, not Elaine's. The text gives one standing rule: bank-detail changes do not arrive by email, and a doubt is settled by phoning the usual number. The words are already fixed in chapter 3. This chapter does not reprint them as a new draft, and it does not add a digit. No phone number is printed. Adding one would invent a contact the book does not contain. No technical detail is included, and no one is blamed. An attack description would turn the warning into a report. The national fraud report and the regulator report are separate acts. The regulator report used the incident log because client financial details were in the mailbox. Clients do not receive that log. The warning also depends on order. If it had gone out before 10:11, replies could still have matched the rule and left the firm. Removal first is why the send is safe enough to attempt. "Safe enough" here means the known forwarding path is gone. It does not mean the firm has nothing left to watch. | Choice | Warning | Incident log | |---|---|---| | Audience | Clients | Adviser, partners, lessons review | | Address | Firm's usual address | Not an email | | Attack detail | Absent | Times and actions | | Phone number | Absent | Absent | ### 13.2 Worked example | Offered addition | Why it fails or stands | Decision | |---|---|---| | Usual address, after the rule is gone | Matches the send conditions | Keep | | The standing rule about bank details | The warning's job | Keep | | A printed phone number | None is in the book | Refuse | | A description of the Brazil sign-ins | That belongs in the log, not the warning | Refuse | > **Synthetic case.** The warning is not a client-facing incident report. ### Errors and limits Do not invent a telephone number to make the warning look complete. ### Apply - **EX059 — What stays out.** From where is the warning sent, what must already have happened to the rule, and which details stay out of the text? *Rubric:* 3 = firm's usual address, not Elaine's; sent after the rule is removed; no phone number, no blame, and no attack description;; 2 = the address and the timing stay, and the phone number stays out;; 1 = one condition;; 0 = none. ### Continue studying — lesson 13 (chapter 13 of 20) [← Chapter 12](#ch-12) · [Course chapter index](../SUBJECTS.md) · [Chapter 14 →](#ch-14) Continue to the next authored lesson. ## Worked answers **EX059.** It is sent from the firm's usual address, not Elaine's, after the forwarding rule is removed. It includes no phone number, no blame, and no attack description.