6.1Real-life cases
The essentials in 30 seconds
- Chain together: facing a real attack, the chain spot, doubt, verify, isolate, report, restore is what makes the difference.
- Verify: every urgent or unusual request must be checked through a separate channel, never via the contact details in the suspicious message.
- Report: alerting IT and your contact person quickly also protects colleagues — an incident handled early is an incident shared early.
Karim thread — one year on: two incidents narrowly avoided
Karim, an office employee in Algiers, reviews his two standout cases of the year: the Friday at 5 p.m. when an e-mail from the “CEO” demanded an urgent and confidential transfer, and the day a colleague's workstation displayed a ransom demand. Both cases below replay his sequence: verification through a separate channel and dual approval on one side, isolation without switching off and offline restoration on the other.
Each case follows the Context → Steps → Outcome flow: replay it on your own situations.
Why real-life cases
The previous levels built the reflexes; here we chain them together end to end. Facing a real attack, the chain of the right moves — spot, doubt, verify, isolate, report, restore — is what separates a controlled incident from a crisis.
Case 1 — An e-mail “from management” requests an urgent transfer
Context: On a Friday at 5 p.m., an e-mail from the “CEO” requests an urgent and confidential transfer to a new supplier, “tell no one about this”.
Déroulé :
- Spot the signals: urgency + secrecy + transfer = likely CEO fraud.
- Do not give in to the imposed secrecy: that is precisely the warning signal.
- Verify through a separate channel: call the CEO back on his known historical number, never the one in the e-mail.
- Apply the dual approval required for any unusual transfer.
- Report the e-mail to IT to protect colleagues.
- If a transfer had already gone out: alert the bank immediately and file a complaint.
Result: The fraud is foiled by verification through a separate channel — a procedure, not luck.
Case 2 — A workstation displays a ransom demand
Context: A colleague sees his files renamed and a message demanding a ransom: ransomware is in progress.
Déroulé :
- Isolate immediately: disconnect the network (Wi-Fi/cable) without switching the machine off.
- Alert IT and management without delay; stop touching the workstation.
- Never pay the ransom: no guarantee, and it funds crime.
- Warn colleagues if a trapped e-mail is circulating.
- Restore from the offline backup — the only one the ransomware has not encrypted.
- Document and report (Cybermalveillance, complaint); analyse the origin to prevent recurrence.
Result: The incident is contained and business resumes thanks to backups — without paying a cent.
Ready-to-say script — requesting verification before any unusual transfer (30 s)
“I have received an urgent and confidential transfer request. First, I apply our procedure: I verify through a separate channel with the sender on his known number, and I request the planned dual approval. Without confirmation, I do not pay and I report to IT.”
Copy-paste template — replayable case sheet
SITUATION to handle (suspicious e-mail, call, affected workstation): ...
SIGNALS spotted (urgency, secrecy, unusual request): ...
VERIFICATION through a separate channel (who, which known number, when): ...
ISOLATION if workstation affected (network disconnected, machine left on): ...
REPORT (IT / contact person: name, time, symptoms noted): ...
GUIDE REFERENCES (L0 → L5): ...
EXPECTED outcome (incident contained, colleagues protected): ...Small business / tight budget
One single case posted near workstations: signals in 3 lines, verification through a separate channel, IT contact noted.
Algeria SME
Adapt verification to local realities: known historical numbers, schedules and activity peaks, usual phone channels.
Remote / hybrid
Double traceability at a distance: verification by a call to a known number and immediate written report to IT.
Cross-cultural
Check local practices before transposing a case: an authority wording or an unusual channel should raise an alert everywhere.
48h challenge — apply tomorrow
Take 1 real situation (last urgent e-mail or recent doubt) and write its sequence in 4 steps (spot → verify → isolate if needed → report). Note the IT contact to alert.
- I can chain the reflexes in the right order on a real case.
- I have a replayable case sheet for my next situation.
- I have done the 48h challenge or scheduled its date.
On Friday at 5 p.m., Karim receives an e-mail from the “CEO” demanding an urgent and confidential transfer. Which sequence follows the guide?