Fictional practice case
Check a suspicious email
Inspect a fictional password-expiry email, identify the useful evidence, and choose a safe next step.
Scenario
An employee receives a message saying their work password expires in 30 minutes. The display name says “IT Support,” and the button says “Keep my account.” Review the details below.
Evidence
- From
IT Support <alerts@account-help.example>
- Displayed button text
Keep my account
- Displayed destination
https://login.company.example.test
- Actual destination
https://company-login.example.net/session?continue=mail
- Message claim
Your password expires in 30 minutes.
Your task
Which details justify caution, and what can the employee do without opening the message’s link?
Show the answer and explanation
What the evidence shows
Treat the message as suspicious, but do not call it proven fraud from one clue. Do not open the message link. Use a saved bookmark or type the organization’s known account portal independently, then contact the help desk through a known channel if the warning cannot be verified there.
Why
- The sender domain and actual link destination do not match the organization named in the message.
- The short deadline creates pressure, which is common in phishing but is not proof by itself.
- An independent route to the real account portal checks the claim without trusting the message.
Limits
- The domains and message are fictional.
- A mismatched display name or domain supports caution; it does not identify the sender or prove intent.
Outcome: The message has warning signs. Don’t use its link; verify the request through a channel you already trust.