2.5The right reflex: doubt & verify
The essentials in 30 seconds
- Doubt by default: any unexpected request asking for action = pause — doubting is not paranoia, it is the standard.
- Verify via a separate channel: suspicious email → call, suspicious call → official writing — never verify via the suspicious channel.
- Doubt is shared: reporting protects the whole organization — ten false alarms beat one fraud through.
Threaded mini-case — Karim writes his rule in one sentence
Final act of the level: Karim rereads his week — fake bank email (2.1), fake advisor on the phone (2.2), fake invoice (2.3), fake CEO and their 25 000 € (2.4). One reflex neutralized them all: doubt, verify via another channel, report. He writes it in one sentence, posts it by his screen, prepares his channels (directory, official numbers in favorites) and tests his mail app's “Report” button.
Epilogue of the 2.1–2.4 thread — Karim condenses the whole level into a personal algorithm.
1. Doubt by default
Level 2 summary: facing any unexpected digital request asking for action, the reflex is doubt by default, followed by verification via another channel. Suspicious email → call; suspicious call → official email. Like Karim all week: don't judge the message, switch channels.
2. Signals and the 5-minute rule
Red flags: urgency, secrecy, unusual request, unexpected windfall, threat — each alone justifies the verification pause. No legitimate urgency dies from a 5-minute check; those forbidding it are frauds. Prepare your channels in advance (directory, favorites): verification must be EASY.
3. Doubt is shared
Doubting is neither paranoia nor defiance: it is a professional standard, like double-checking a calculation. Reporting protects the whole organization: a reported suspicious email (button or IT forward) is a team act. Better ten false alarms than one real fraud through: nobody will ever blame a verification.
Did you know?
One sentence learned by heart beats ten software tools.
🔎 Concrete example — 🔎 Concrete example — Your rule in one sentence
Karim's rule, posted by his screen:
“If a request is urgent OR unusual OR confidential
→ I verify via another channel before acting.”
Ready channels: internal directory, official numbers in favorites.Takeaway: one reflex covering all manipulation attacks.
Lesson: find and test your mail app's “Report” button.
Section vocabulary
- Separate-channel verification
- Confirming a request via ANOTHER means than its source: suspicious email → call; suspicious call → official email.
Simple example: Karim calls the CEO on the directory instead of answering the fake email.
What it is not: asking confirmation by replying to the suspicious message itself.
Reflex: switch channels every time, no exception.
- Red flags
- Urgency, secrecy, unusual request, unexpected windfall, threat: each alone justifies the verification pause.
Simple example: The fake CEO combined urgency, secrecy and transfer: triple signal.
What it is not: an expected, consistent request, with no pressure or secrecy.
Reflex: one signal is enough: take the 5-minute pause.
- Healthy doubt culture
- Doubting is neither paranoia nor defiance: it is a professional standard, like double-checking a calculation.
Simple example: Karim checks without guilt, like recounting a cash drawer.
What it is not: obeying fast “not to look paranoid”.
Reflex: present verification as procedure, not suspicion.
- Reporting
- Doubt is shared: a reported suspicious message protects the whole organization (report button or IT forward).
Simple example: Karim reports the fake email: his colleagues are alerted in turn.
What it is not: silently deleting a message that will target colleagues next.
Reflex: find the Report button before you need it.
- 5-minute rule
- No legitimate urgency dies from a 5-minute check: those forbidding it are frauds.
Simple example: Karim takes 5 minutes to call back: account and 25 000 € safe.
What it is not: acting within seconds because the message demands it.
Reflex: announce the check, do it, then act.
In practice — In practice — Your personal verification algorithm
- Write your rule in one sentence: “If a request is urgent OR unusual OR confidential → I verify via another channel before acting.”
- Prepare your verification channels: up-to-date internal directory, official numbers in favorites — verification must be EASY.
- Find your mail app's “Report” button (or the IT reporting address): test it on a real spam.
- Adopt the 5-minute rule: no legitimate urgency dies from a 5-minute check.
Ready-to-say script — announcing your verification (15 s)
“Thank you for your message. As a rule, I verify any urgent or unusual request via another channel before acting: I'll get back to you in a few minutes on the official number. It's our procedure, it protects everyone.”
Say calmly under any pressure; follow with the real verification then the report.
Copy-paste template — personal algorithm
MY RULE: urgent OR unusual OR confidential → verification via another channel.
MY READY CHANNELS: directory: _______________ / official nos. in favorites: _______________
MY REPORTING: button / IT address: _______________
5-MINUTE RULE: no legitimate urgency forbids it.Small business / self-employed
With no internal IT: channels = public official numbers + external reporting (official platforms, see 5.2).
SME in Algeria
Karim posts his rule by the screen and shares his channels with his buddy for absences.
Large company / procedure
The personal algorithm fits into the procedure: report button + level-5 incident circuit.
Personal life
Same rule at home: pressing relatives, fake couriers, unexpected windfalls — verify, then report to 33700 if SMS.
✓ Best practices
- Always verify via a different channel than the request's.
- Keep your verification channels ready (directory, favorites).
- Report: protecting colleagues is a team act.
✗ Common pitfalls
- Acting urgently without checking.
- Giving up checking for fear of “looking paranoid”.
- Keeping a doubt to yourself instead of reporting it.
Key takeaways
- One reflex covers all: pressing or unusual request → separate-channel verification.
- No legitimate urgency forbids 5 minutes of checking — those forbidding it are frauds.
- Reporting a suspicious message protects colleagues: it is a team act, not an admission of weakness.
- Better ten false alarms than one real fraud through: nobody will blame you for checking.
48h Challenge - apply tomorrow
Write your one-sentence rule, prepare your channels (directory + favorites) and test the Report button on a real spam. Share the rule with a colleague.
- I can recite my algorithm in one sentence.
- I know where the Report button is and how to use it.
- I have my channels ready and a colleague informed.
Frequently asked questions
I risk looking paranoid to my contacts…
Serious professionals (banks, suppliers, executives) KNOW these frauds and respect verification — many require it in their own procedures. Whoever is annoyed by a verification is precisely whom to distrust.
What exactly to report, and to whom?
Internally: any dubious message, to the report button or IT. Externally: phishing on signal-spam.fr / Signalement.gouv, SMS to 33700, confirmed fraud on Cybermalveillance.gouv.fr + complaint. The detailed circuit is in 5.2.
Karim hesitates: verify or act fast not to bother?