Defense & Response · 3.1
🛡️ Building Your Defenses
Habits that work regardless of how clever the attack is⏱ ~2 min
Awareness Is Your Shield
Be vigilant and recognize the signs. If something feels odd or too good to be true, it may be a scam. Trust that instinct — it's often your subconscious noticing an inconsistency before you consciously identify it.
Core Protective Habits
| Habit | Why It Works |
|---|---|
| Think before you click | Avoid clicking links or opening attachments from unknown or unexpected sources — even if they look legitimate |
| Guard your personal information | Never share passwords, credit card numbers, or personal data in messages or emails, no matter who is asking |
| Set strong, unique passwords | Use a different strong password for every account — a password manager makes this practical |
| Use multi-factor authentication | Enable MFA wherever possible; it adds a layer of security even if a password is stolen |
| Verify the caller's identity | If someone claims to represent a company, ask for proof, or contact the organization directly through a number you look up independently |
| Stay informed | Keep learning about new scams and techniques — attacker tactics evolve constantly |
| Stick to trusted sources | Only download files and software from official, trusted sources to avoid malware |
The Verification Habit — Out-of-Band Confirmation
🔒 SecurityThe single most effective defense against pretexting, vishing, and CEO fraud is out-of-band verification: if you receive an unusual request (wire transfer, password reset, urgent favor) through one channel, verify it through a completely different channel. A suspicious email from your 'CEO'? Call them on their known phone number — don't reply to the email or call a number it provides.
💡 TipOrganizations should establish a clear policy: any financial transfer request, no matter how urgent it appears or who it claims to be from, requires verbal confirmation through a known, pre-established phone number before action is taken. This single policy stops the vast majority of CEO fraud and wire transfer scams.
For Organizations: Building a Security Culture
- •Regular phishing simulation tests — send fake phishing emails internally to measure and improve click rates over time
- •Clear reporting process — make it fast and blame-free for employees to report a suspicious message or a mistake (clicking a bad link)
- •Mandatory MFA on all accounts, especially email, VPN, and financial systems
- •Least privilege access — limit what any single compromised account can actually do
- •Verification policies for financial requests — out-of-band confirmation for any payment or credential change
🧠Quick Checkfirst try = +5 XP
The single best defense against a suspicious 'urgent' request from your CEO is…
🎮 Practice what you learned
⭐ 0 XP🔥 0 days