Unit III Checkpoint: Scam or Genuine?
Where you are: Unit III — The Human Attack Surface · Checkpoint · About 12 minutes. This checkpoint draws on Chapters 1, 7, 8 and 10 of Dr. Al-Doori's Cyber Security Essentials and Lessons 3.1 to 3.5.
Unit III showed that most scams target people, not machines, and that one habit defeats most of them: verify through a channel you already trust. In this checkpoint you face three realistic messages. For each one, decide whether it is a scam or genuine and what you would do, then compare your reasoning with the model answer. All names, numbers and addresses are invented. All domains ending in .test in this checkpoint are reserved for training and cannot be real public websites.
Scenario 1: The bank text
On a Tuesday evening you get a text: "QUILLMONT BANK: Your card has been suspended due to unusual activity. Verify your identity within 2 hours to avoid permanent closure: quillmontbank-verify-secure.test". You do bank with Quillmont, whose real domain is quillmontbank.test.
What is the best response?
Model answer
c is right. The text pulls the classic levers: authority (your bank), urgency (two hours) and fear (permanent closure). The registered domain is quillmontbank-verify-secure.test, not quillmontbank.test, so it is a look-alike. Going to the bank yourself, through the app or the number on your card, checks the claim safely. Then report the text (in the UK and US, many mobile networks accept scam texts forwarded to 7726) and delete it.
a is not right: scammers send the same text to huge numbers of people, so some recipients will always be real customers. Being a customer makes the text feel real but doesn't make it real. b is not right: a reply goes straight to the scammer. d is not right: a card number alone is valuable to a criminal, and entering anything on a fake page helps them.
Scenario 2: The urgent call
Late at night your phone rings from an unknown number. It is your cousin Amira's voice, upset. She says she has lost her bag and phone while travelling abroad and needs money sent tonight to a friend's account. "Please don't tell my parents, they'll panic." The voice sounds exactly like her.
What should you do first?
Model answer
b is right. AI voice cloning means a familiar voice is no longer proof of identity, and the FBI warns that criminals use it to impersonate relatives in crisis. The routine works whatever the voice sounds like: pause, ask for the family code word (or a question only she could answer), and call back on numbers you already have, including her parents despite the plea for secrecy, which is itself a pressure tactic.
a is not right: recognition is exactly what cloning exploits. c is not right: images and video can be faked too, so a selfie is not a reliable check. d is not right: any money sent before verification goes to whoever is on the line, and a "small amount" often leads to further requests.
Scenario 3: The colleague's email
You handle payments for a student society. An email arrives from the real address of Jordan, the society's treasurer, replying inside last week's genuine thread about a venue booking. It says: "The venue has changed banks. Please pay today's deposit to the new account below. I'm in exams all day so can't take calls."
What is the safest action?
Model answer
d is right. This has the hallmarks of business email compromise: a change to payment details, urgency ("today") and a reason you can't verify ("can't take calls"). An email from a real account, even inside a genuine thread, can come from a criminal who has taken over that mailbox, and it will pass every sender check. The rule is simple: any change to payment details is confirmed by phone, on numbers you already had, before money moves.
a is not right: real addresses and real threads are exactly what a hacked account provides. b is not right: if the mailbox is hacked, the criminal reads and answers your reply. c is not right: a number supplied in a suspicious email may belong to the criminal.
Before you move on
The three scenarios used three channels (a text, a call and an email) but one answer: don't act inside the message; verify through a channel you already trust. If any answer surprised you, revisit Lesson 3.1 for the verification habit, 3.2 for business email compromise, 3.3 for scam texts and 3.4 for cloned voices. Unit IV turns to the passwords, codes and passkeys that these scams are often trying to steal.