6.2Recurring problems (playbook)
The essentials in 30 seconds
- Reflex: one symptom = likely causes = a sequence of actions — never click or pay under pressure.
- Verify: domain, hovered URL and the official number you call back yourself beat any displayed urgency.
- Report: isolate, alert IT and restore offline turn a recurring doubt into an anchored reflex.
Karim thread — the playbook taped next to the screen
Karim keeps this playbook next to his screen. Verdict after one year: three lines served him most — the urgent e-mail asking for credentials, the call from an “adviser” asking for a code, and the unknown USB stick found in the corridor. For each one, he ended up applying the sequence (do not click, call back the official number, hand over to IT) instead of handling it by feel.
Observed symptom, verified causes, actions in order: the reflex holds in three steps.
One reflex per symptom
Most risky situations keep coming back. Linking each symptom to its likely causes and to a sequence of actions saves precious time — and avoids panic.
| Symptom | Likely causes | Actions |
|---|---|---|
| Urgent e-mail requesting credentials or payment | phishing / spear phishing | do not click; check domain + hovered URL; log in via your bookmarks; report |
| Call from an “adviser” asking for a code | vishing + number spoofing | hang up, call the official number back yourself; never give a code over the phone |
| Urgent and confidential transfer from the “CEO” | CEO fraud | dual approval + call back the historical number; report |
| Encrypted files + ransom demand | ransomware | isolate without switching off, alert, do not pay, restore offline |
| Account unreachable / e-mails sent without my knowledge | hacked account | password changed from a healthy device + sessions signed out + two-factor authentication |
| E-mail sent to the wrong recipient | human error = data breach | try to recall it, report to the contact person quickly |
| Unknown USB stick found | abandoned-stick attack | never plug it in; hand it to IT |
| Doubt about public Wi-Fi | open network / fake access point | mandatory VPN or connection sharing; check the exact network name |
| Password reused almost everywhere | poor hygiene | manager + unique passwords + two-factor authentication on critical accounts |
Ready-to-say script — handling a doubt without panicking (30 s)
“My symptom: [urgent e-mail / code call / encrypted files]. I do not click, I do not pay. I verify (domain, URL, official number I call back myself), I isolate if needed without switching off, and I report to IT with the time and symptoms noted.”
Copy-paste template — express doubt sheet
Observed SYMPTOM (message, call, files, account): ...
Since when / who is affected: ...
Likely CAUSES (playbook 6.2): ...
VERIFICATION (domain, hovered URL, official number): ...
ACTIONS (in order): 1) ... 2) ... 3) ...
REPORT (IT / contact person, time, symptoms noted): ...
REVIEW: reflex to anchor for next time: ...Small business / tight budget
No formal table: one symptom, the playbook's likely cause, the action and the report to the contact person.
Algeria SME
Build local realities into verification: known official numbers, activity peaks, usual phone channels.
Remote / hybrid
Add an immediate written report to the actions: at a distance, an untracked doubt looks like a lost incident.
Cross-cultural
Check local practices before acting: an unusual channel or authority pressure should raise an alert everywhere.
48h challenge — apply tomorrow
Spot 1 current symptom (last doubt or strange message), fill in the express doubt sheet and test the 1st action (verify + report).
- I can link a symptom to its likely causes.
- I have filled in (or scheduled) an express doubt sheet.
- I know which level to revisit for my case.
Karim receives a call from an “adviser” asking for a code he has received by message. Which reflex does the playbook prescribe?
The same recurring doubt is not ten incidents: it is one missing reflex to anchor (verify through a separate channel, isolate, report, back up offline).