AI voice scam prevention: verify callers and protect payments

Learn in your browser · Chapter 01 of 08

Answer first: It is a presentation cue, not independent identity, request or destination evidence. Practise the complete fictional key after your own attempt.

An unexpected voice asking for money presents two different questions: does the voice seem familiar, and is the request authorised? Only the second question can justify an action. A recording, an imitation or a person using a believable story can create familiarity without the right to direct your payment. This workshop teaches a response that works while identity remains uncertain. You do not need to solve how the message was made before you can pause, keep money and information withheld, and seek an independent contact route.

Voice cloning means creating speech that resembles someone else's voice with AI assistance. That description explains a possibility, not a finding about any particular call. A distorted connection does not prove cloning, and a smooth, emotional voice does not establish authenticity. The selected FBI awareness notice describes financial impersonation using generated audio [FBI-AI-FRAUD]. Our practical focus is the requested action and its authority. We will not record, upload, imitate or synthesise anyone's voice, and none of the six written fictional messages is an actual recording.

The six messages belong to an invented community learning group called Harbour Circle. M01 claims a relative needs an urgent transfer after an accident. M02 claims a relative has a new WhatsApp number. M03 claims a director needs a confidential supplier payment. M04 claims a bank needs funds moved to protect them. M05 offers paid recovery after a loss. M06 asks for an account verification code to join a community group. These are labelled teaching fiction. Names, route codes, dialogue and events are invented; no route code is a number to dial.

Pressure is an attempt to shorten the time available for a decision. It may use a deadline, fear, embarrassment, loyalty or status. In M01 the instruction to act before the next ten minutes turns care for a relative into a demand for payment. A participant can care deeply while withholding the transfer. Saying that the urgency is unverified does not dismiss the person's feelings. It identifies the missing evidence needed before making an irreversible decision. The workshop therefore asks what can safely happen now, rather than whether the listener was sufficiently suspicious.

Secrecy can isolate the recipient from useful checks. M03 says that the director's request must stay outside normal procedures, while M01 says not to tell another relative. Neither instruction creates a duty for the participant in this exercise. A claimed confidentiality requirement needs its own authority, and cannot establish the authority of the same message that introduced it. Write secrecy as a requested behaviour in the worksheet. That makes it visible for a second reader instead of silently accepting it as a condition of helping.

A caller may know accurate details. A name, relationship, recent journey or familiar expression can come from many places and may also be guessed. The practical mistake is treating one true detail as permission for an unrelated action. M02 correctly mentions the fictional Sunday supper, but that does not authenticate a new number or a new payee. Record the detail as part of the message, not as a successful identity check. An apparently correct fact can increase plausibility without resolving who controls the channel or where the money would go.

Caller ID, profile photographs and logos are presentation cues. A displayed name can make a message easier to recognise, but recognition is not independent verification. A route is circular when the suspicious message supplies both the instruction and the means of confirming it. M04 offers a supposed fraud-desk extension inside the same call. Calling that extension would still depend on the caller's claim. The worksheet marks it as supplied and untrusted for verification. A separate established bank channel is needed before discussing the alleged account problem.

The first method is to name the demand in plain language. Instead of writing 'strange call', write 'unexpected caller asks me to transfer funds to a new destination and keep it secret'. Then separate what is observed from what is claimed. You have a message containing those words; you have not established an accident, a bank investigation or the sender's identity. Next identify what would be exposed by complying: money, an authentication code, account information or another person's details. This small translation makes a complicated story into a decision that can be checked.

The second method is to choose a bounded response. A useful pause sentence is 'I need to check this independently before I act.' You do not owe the unexpected caller a detailed explanation of your checks, your relatives' names or your security arrangements. In the exercise, ending contact and withholding the request counts as a completed protective step. It is not a declaration that the whole situation is solved. The next step is verification or appropriate support, with an emergency route considered separately if there is an independently apparent immediate danger.

An average analysis of M01 might say 'the voice sounds wrong, so it is AI'. That conclusion is unsupported by the written card and would train a fragile habit. A stronger analysis says 'identity, emergency and payment authority are unverified; urgency and secrecy increase the need for an independent check'. It names a known family route, keeps the transfer held, and records what would change the decision. The stronger answer remains useful if the caller sounds exactly right. Its value comes from the decision process, not from confidence in a media detector.

The paper assistant request in this chapter is optional and requires no AI use. Its role is a community worksheet editor, its constraints are fictional cards only and no identity verdict, its process separates observations from claims, its verification checks the independence of each route, its output names the demand, exposure, route and unresolved issue, and its failure handling keeps missing authority held. A vague request to 'tell me if this is a scam' asks for a verdict without showing the evidence chain. A bounded request creates a reviewable record even when a verdict is unavailable.

Community learning should not be an unannounced deception test. Participants receive labelled fiction before any reading or role play. Nobody is asked to disclose a real loss, reveal a safe word, open a bank account, send a code or imitate a relative. A facilitator can offer silent reading, large print, a transcript and an observer role. These are proposed participation choices, not evidence of an accessibility audit. Ask what would help the actual group and prepare an alternative before the session, rather than assuming that a telephone demonstration suits everyone.

Take Five's selected guidance uses a stop, challenge and protect approach [TAKE-FIVE]. In this course the worksheet turns that broad advice into separate evidence fields: the demand, the independent route, the action withheld and the next support step. This adaptation is an original teaching tool, not an official reporting form or a certification by the campaign. The completed paper record shows a learner's reasoning about fiction. It cannot establish that the same learner could manage every live incident, or that a facilitator has professional fraud-response authority.

News can make the issue feel immediate, but its evidence needs careful handling. Reuters reporting, read in syndicated form, described executive and lawyer impersonation involving apparent messaging instructions and claimed AI voice replication in an Italian banking case [REUTERS-SYNDICATED]. This is attributed reporting, not a forensic finding from this course. Reported transfer, recovery and missing-fund figures do not fully reconcile across the supplied coverage. We use no exact net-loss total as a teaching fact, name no person as culpable, and claim no certain technical explanation for the reported event.

The useful lesson from that attributed account is that several persuasive surfaces may appear together: a message, a voice and official-looking material. It does not show that a particular control would certainly have prevented the incident. Our fictional cards instead ask whether the recipient has a separate path to authority. Adding another document from the same claimant adds material, but may add no independent confirmation. Count the source relationships, rather than the number of impressive items. This prepares the next chapter's callback exercise without requiring a real organisation's internal investigation.

Finish by writing an uncertainty statement that you could read aloud calmly. For M01: 'I have a request claiming a family emergency; I have not independently confirmed the person, event or payment destination.' That sentence avoids both gullibility and an unsupported accusation. Pair it with one action: no transfer while verification is missing. Reflection should examine where emotional pressure narrowed the decision, not whether the recipient deserves blame. The skill being practised is an observable boundary between hearing a claim and authorising an action.

1. Name the exact demand.
2. Separate observed message from identity/event claims.
3. Identify money, code or information exposure.
4. Mark pressure and secrecy.
5. Select an independent check rather than a detector.
6. Write a hold and an honest uncertainty statement.

Scroll sideways to see every column.

ROLE: Community worksheet editor.
CONSTRAINTS: M01-M06 authored fiction only; no real voice, identity verdict, payment or data.
PROCESS: Separate observed words, claimed identity, requested action and pressure.
VERIFICATION: Check route provenance and reject message-supplied verification.
OUTPUT: message;claim;demand;exposure;independentSource;heldAction;unknown.
FAILURE MODES: Keep missing authority held; do not label a voice AI from a transcript.

Diagram text equivalent: Claim and demand then Independent source then Check scope then Action held then Appropriate help. At Check scope, missing or unusable evidence branches to Missing or unusable route. Keep the action held and seek an appropriate independent route; no actual contact or approval is recorded.

Learn in your browser · Chapter 02 of 08

Answer first: The preparation sheet established before the suspicious message. Practise the complete fictional key after your own attempt.

Independent verification means checking through a route whose trust does not come from the message being checked. It is a relationship between sources, not a button labelled verify. A number already used to contact a relative, retained before the suspicious message, can provide a better starting point than a number sent with that message. It still needs reasonable checking for the intended person and current situation. A new voice note saying 'yes, it is me' in the same chat adds no separate route. The worksheet makes that dependency explicit.

M01 is the first case. Its written message says, 'It is Rowan. I have had an accident. Send the urgent transfer before ten minutes pass. Do not tell Kit. Call the helper number in this message if you need proof.' Harbour Circle's fictional preparation sheet lists FAM-OLD-ROWAN as a previously established contact route and FAM-OLD-KIT as a second trusted family route. Those labels do not contain real contact details. The model answer chooses the older routes and refuses the helper route as an independent check.

The selected FTC family-emergency guidance advises checking a known family contact and involving another trusted person if necessary [FTC-FAKE-EMERGENCIES]. That is US consumer awareness guidance, not a UK reporting rule. The course adapts the contact logic to the fictional worksheet without adopting a universal legal duty. There may be no answer from the person at the first known route. Record that outcome as no contact made. Silence is not confirmation of an emergency and does not turn the suspicious helper into a trustworthy substitute.

Verification has several targets. You may need to establish who is communicating, whether the alleged event is real, and whether the proposed recipient or payment is authorised. A successful conversation with the real relative could resolve identity while leaving an unfamiliar bank destination unexplained. Treat those as separate boxes. Otherwise a reassuring first answer can spill into decisions it did not cover. The model M01 response remains a held payment until the request itself, destination and applicable payment process are checked outside the suspicious message.

A callback should begin with a short description of the claim, not an answer the other person can simply repeat. In a real situation, an independently reached relative can be asked whether they contacted you and need help. In the workshop the callback is represented by a written outcome card supplied by the facilitator. Participants do not make calls. This avoids creating accidental alerts, sharing numbers or involving unsuspecting family members. The card's answer is scripted teaching material, not proof that an actual phone connection or person has been authenticated.

For the first tabletop outcome, the facilitator card says 'At FAM-OLD-ROWAN, the fictional Rowan says no request was sent and no accident occurred.' The worksheet then records that the suspicious request was not corroborated through the selected independent route, and the transfer stays held. For the alternative outcome, the card says 'No answer at FAM-OLD-ROWAN.' The learner selects FAM-OLD-KIT and keeps the payment held. These two branches teach how to continue safely through missing information instead of treating a failed callback as a reason to obey the caller.

A family safe word may help supplement a conversation, but it is not complete authority. It could be overheard, disclosed or reused, and it does not authorise a new payment destination. Some families cannot arrange one consistently. Do not require a participant to reveal a real word during practice. The selected FBI notice includes a family phrase among awareness suggestions [FBI-AI-FRAUD]; this course deliberately keeps it subordinate to independent contact and request checks. A technique useful in one household must not become a reason to refuse support to another.

The same principle applies to private questions. Asking about a shared event may provide information, but information may have circulated beyond the household. A familiar answer is one piece of context, not a substitute for an independent route. The workshop's success criteria therefore do not reward a learner for inventing clever secret questions. They reward naming a source that was not introduced by the suspicious caller, withholding the requested action and recording the result honestly. That keeps the exercise usable without collecting intimate family histories.

An average response says 'I will ring the number the helper gave me because it sounds official.' The improved response says 'I will end this contact, select FAM-OLD-ROWAN from the pre-existing preparation sheet, and record what that check actually establishes.' It includes an unanswered-call branch and a separate payment boundary. Neither response needs a detector. The difference is whether the second interaction remains under the first claimant's control. This is the central comparison to teach, because a convincing second voice can otherwise feel like independent corroboration.

Routes also have usability requirements. A phone call may be unsuitable for someone who is Deaf, cannot speak safely, has limited credit, shares a device or needs language support. The facilitator should help plan a previously established accessible contact method with the person's agreement. A messaging route can be useful if it is independently established, but a new chat opened by the suspicious message is not thereby trusted. Record route access separately from route provenance. A correct number that the person cannot use does not complete the response plan.

When there is immediate danger, a financial verification exercise must not delay appropriate emergency help. UK official contact guidance distinguishes emergencies, including someone in immediate danger or a crime in progress, from non-emergency enquiries [UK-POLICE-CONTACT]. It is possible to seek emergency assistance while declining an unverified transfer. The workshop does not decide the truth of an alleged kidnapping or provide tactical instructions. Its emergency branch says to use the selected jurisdiction's independently verified emergency route, with access arrangements checked before delivery.

A callback record needs just enough detail to support the next decision. In fiction, record M01, the route code, its provenance from the preparation sheet, the scripted outcome and the continuing hold. Do not fill the worksheet with real numbers, dates of birth or account identifiers. A real support provider may need more information through its own secure process. Keeping the community exercise minimal preserves the distinction between rehearsing a method and operating a case service. The tutor should not become a store of participants' family security details.

The six-part paper request can be used by a learner or a helper reading the material aloud. Role: family verification planner. Constraints: M01 and route codes only, no real contact or identity verdict. Process: separate identity, event and payment checks. Verification: reject routes originating in M01 and retain unanswered branches. Output: a row for each check, source, scripted result and held action. Failure handling: keep missing checks open and use the emergency branch separately. This provides a complete task without encouraging an assistant to invent a relative's answer.

A useful challenge is to ask what evidence would change the worksheet. A direct independently established contact saying no request was made changes the corroboration field. A second message from the suspicious helper does not change the route independence field. A known relative confirming a need may open further legitimate arrangements, but it does not validate an account supplied by an impersonator. The learner should explain these differences in ordinary language. A general 'verified' stamp obscures which part was checked and makes the next decision harder to review.

Preparation matters because uncertainty is hardest when pressure is high. Before any incident, an adult can choose where independently established family and organisation contacts are stored and how to reach them if their usual device is unavailable. Do not build a public list of those contacts or put private details into a shared AI tool. In this workshop the fictional preparation sheet demonstrates the structure, not the real entries. The group can discuss a private planning habit without disclosing its content or making an agreement on behalf of absent relatives.

The chapter's final answer should be a sequence, not a diagnosis: withhold, end the suspect contact, choose an established usable route, check the particular claim, record the result and retain any remaining payment gap. If the route fails, the plan continues through another independently established source or appropriate help. A learner who cannot yet name such a route has found a preparation gap, not failed as a person. The next chapter extends the same reasoning to new messaging accounts, workplace titles and apparent instructions from senior people.

1. Keep the transfer held.
2. End suspect contact.
3. Select an established usable family route.
4. Check identity, event and payment separately.
5. If unanswered, select another independent source.
6. Record result and remaining gaps.

Scroll sideways to see every column.

ROLE: Family verification planner.
CONSTRAINTS: M01 and preparation route codes only; no real calls or secret words.
PROCESS: Separate identity, emergency and payment checks.
VERIFICATION: Reject the supplied helper; include unanswered FAM-OLD-ROWAN branch.
OUTPUT: check;routeSource;scriptedOutcome;remainingGap;heldPayment.
FAILURE MODES: No invented callback outcome; appropriate emergency route remains separate.

Diagram text equivalent: Claim and demand then Independent source then Check scope then Action held then Appropriate help. At Check scope, missing or unusable evidence branches to Missing or unusable route. Keep the action held and seek an appropriate independent route; no actual contact or approval is recorded.

Learn in your browser · Chapter 03 of 08

Answer first: No. Transport features do not establish account-holder authority. Practise the complete fictional key after your own attempt.

Messaging changes the appearance of a request without changing the need for authority. A profile name, familiar photograph or encrypted chat can be attached to an account the recipient has not independently established. Encryption protects a transport in particular ways; it does not certify the person using an account or the legitimacy of their demand. In M02, the claim 'this is my new number' asks the recipient to replace a trusted route with a new one. That replacement is the decision to examine before any later request for money.

M02 says, 'Hi, it is Rowan. My phone broke, so save this new WhatsApp number. Remember Sunday supper? Please pay the replacement-phone invoice today; the account details are attached here.' The old family route in the preparation sheet remains the starting point. The familiar Sunday detail and the new number's explanation are recorded as claims. The model answer does not rename the new account as verified Rowan or accept the attached account details. No actual attachment is supplied; the fictional card contains only the text needed to practise the decision.

M03 says, 'This is Director Vale at North Quay Studio. Move this confidential supplier payment today. Normal finance approval would disclose the project, so use the lawyer's number sent in this chat and do not consult the finance lead.' North Quay Studio is invented. The preparation sheet names ORG-DIRECTORY-VALE and ORG-FINANCE-PROCESS as pre-existing fictional routes. A claimed senior title is relevant to understanding the pressure, but it cannot create an exception to the very process needed to establish payment authority.

The selected FBI impersonation notice describes apparent authority figures using messages and generated voices, including movement to another messaging platform [FBI-IMPERSONATION]. That US warning supplies awareness context, not a global rule that a particular application is fraudulent. WhatsApp can carry ordinary legitimate conversations as well as impersonation attempts. This chapter grades the provenance of the contact, the nature of the request and the attempted process bypass. It does not grade a participant's ability to identify fraud from an application name, profile picture or national accent.

A conversation can build trust before introducing a sensitive demand. As a proposed fictional variation, an ordinary project meeting could be discussed before an urgent payment request. That meeting is not in the supplied M03 card or worksheet. M03's baseline demand is a confidential supplier payment with a finance-process bypass. An earlier harmless topic would not authenticate a later instruction. Mark a change from discussion to payment or greeting to code request if a supplied variation includes it; do not invent that history for a baseline card.

The key workplace distinction is between knowing a person and knowing their authority for this action. An independently reached director could confirm that they wrote a message while still lacking a required second approval for a payment. Conversely a process owner could explain the legitimate procedure without resolving the identity of an unexpected caller. The worksheet keeps identity, request, payee and process checks separate. It never treats 'a manager answered' as a complete payment authorisation. Actual workplace permissions and policies must be established by that workplace, not invented by this course.

An ordinary message from a known colleague may ask you to change a contact entry. The stronger response is not a permanent refusal to update contacts. It is to verify the change through the old established route or another independent organisational source before using the new one for sensitive requests. Record the source of the update and what was confirmed. If the old route cannot be reached, keep the new account's authority unresolved and use the appropriate established process. The suspicious account cannot solve that gap by declaring itself verified more emphatically.

Several accounts may repeat the same story. A supposed director, a supposed lawyer and an attached letter can all originate in the same controlled conversation. The count of voices or documents is therefore not the count of independent confirmations. In M03 the lawyer's route is supplied by the claimant and stays in the untrusted column. The improved model answer checks ORG-DIRECTORY-VALE and ORG-FINANCE-PROCESS separately. No route is dialled during the exercise, and no real employee directory, confidential project or lawyer is introduced.

An average helper response might make the message more professional: 'Dear finance, please process the director's urgent request.' That increases persuasive force while preserving the missing authority. An elite paper response first states the constraint: no forwarding as an authorised instruction. It lists the claimed director, requested process exception, source-dependent lawyer route and missing approval. Its output is a verification task for the recipient, not a polished payment order. A fluent message is useful only after the underlying action has the necessary authority and receiving purpose.

The paper request has six components. Role: workplace contact-check facilitator. Constraints: M02 and M03 only, no actual company process or transactions. Process: trace how the new identity or exception was introduced. Verification: compare the supplied contact with independently established directory and finance routes. Output: contact claim, requested action, authority gap, selected check and continuing hold. Failure handling: reject circular confirmation and leave unavailable process facts unresolved. The complete exercise answer supplies these components so a learner can assess the result rather than being told merely to write a better prompt.

Codes are a different exposure from money. M06 asks for a one-time code supposedly needed for a community group. Such a request may attempt to turn the recipient into a source of account access. Do not disclose a real code during a workshop, even as a demonstration. The selected FBI notice discusses attackers eliciting authentication codes [FBI-IMPERSONATION]. Our invented organiser has a pre-established route, GROUP-OLD-ORGANISER, and the model answer checks the request there without transmitting any code. No code value appears in the learning materials.

For a real organisation, a colleague receiving pressure may need an accessible escalation path that does not depend on the apparently senior sender. A manager's unavailability should not force the recipient to choose between obeying the message and abandoning the issue. In the fictional plan, ORG-FINANCE-PROCESS represents that separate path and the payment remains held while it is unresolved. This is a proposed workflow, not evidence that any organisation has staffed a service, tested its availability or approved a new financial control. Local responsibility must be assigned before operational use.

A workplace participant may worry about disrespecting a senior person. Practise a short response that communicates process rather than accusation: 'I will check through our established route before changing payment arrangements.' The facilitator should not ask learners to rehearse aggressive confrontation or keep a suspected fraudster talking. The learning aim is to create time and a separate evidence source. In a tabletop, a participant can simply place the request in the held column and explain the next check. Social confidence is supported, but not used as a test of worthiness.

The attributed Italian news account illustrates why apparent organisational status can matter to the recipient [CYBERNEWS-REPORTED]. It does not establish that the institution's systems were hacked, that they were not hacked, or that a particular individual should have known better. We do not reproduce alleged authorisation documents or identifiable voice samples. The fictional M03 stands on its own teaching design, with a source-dependent lawyer route and a prohibited process shortcut. The news box is context for a question about authority, not the evidence key for our invented case.

When reviewing a completed row, check verbs carefully. 'Claims to be the director' accurately describes the card. 'The director instructed the payment' would quietly accept the identity. 'An account was added' describes a change but does not show who authorised it. The worksheet's language should retain the unverified status until the scripted independent outcome is introduced. This habit makes uncertainty legible to another person and reduces the risk that a support note later becomes an apparently established fact merely through repetition or professional formatting.

At the end of this chapter, a participant should explain why a new number, senior title, familiar fact and additional supplied voice do not remove the need for a separate check. They should also recognise the limits of a completed check: contact identity, process authority and payment destination are different questions. The task is not to prohibit all digital messaging. It is to prevent persuasive messaging from silently replacing the sources that support consequential decisions. The next chapter makes the payment boundary concrete across several requested actions.

1. Identify new contact or authority claims.
2. Trace who introduced each route.
3. Check old contact or directory independently.
4. Keep finance process and destination checks separate.
5. Withhold codes and private documents.
6. Record authority gaps without polishing the instruction.

Scroll sideways to see every column.

ROLE: Workplace contact-check facilitator.
CONSTRAINTS: Fictional M02/M03; no actual company process or transaction.
PROCESS: Trace introduction of number change and finance exception.
VERIFICATION: Old family route, independent directory, normal finance process and destination are distinct.
OUTPUT: contactClaim;action;authorityGap;independentCheck;hold.
FAILURE MODES: No circular lawyer confirmation or polished unauthorised payment order.

Diagram text equivalent: Claim and demand then Independent source then Check scope then Action held then Appropriate help. At Check scope, missing or unusable evidence branches to Missing or unusable route. Keep the action held and seek an appropriate independent route; no actual contact or approval is recorded.

Learn in your browser · Chapter 04 of 08

Answer first: The paper exercise does not authorise the action; no real account is frozen. Practise the complete fictional key after your own attempt.

The safest learning exercise is one in which no payment interface is opened. A tabletop can represent a held transfer with a written decision and still teach the key distinction between preparation and authorisation. All amounts in the messages are fictional context rather than balances, instructions or market statistics. Participants must not enter account details, buy a gift card, visit a cryptocurrency service or send even a token payment. A facilitator who asks for a small real transfer has changed the activity into something outside this course's exercise contract.

M04 is the bank impersonation card: 'This is the fraud desk. Your money is at risk. Move it to the protection account I give you now. Stay on this call so I can guide you. The caller ID shows your bank, and my extension can confirm this.' The card supplies no bank account and no usable number. Its requested exposure is a transfer under the caller's direction. The model response withholds the transfer, ends the unexpected contact and selects BANK-ESTABLISHED from the preparation sheet to check the alleged problem independently.

The selected Take Five guidance highlights unexpected demands, changed payment details and pressure as warning signs [TAKE-FIVE]. These are reasons to stop and check, not measurements proving how a specific message was produced. This chapter uses a held-action ledger: proposed act, evidence missing, independent check, result and remaining decision. 'Held' means the workshop does not authorise the act. It is not a freeze placed on an actual account and not evidence that a bank can recover or block a particular payment. Only the real provider can address a real transaction.

Changing a destination can be consequential even when the surrounding invoice looks familiar. As a proposed fictional variation of M03, the supposed director could claim that the usual supplier has new bank details. No replacement details are supplied in baseline M03, which requests a confidential supplier payment and a finance-process bypass. If destination change is proposed, familiar supplier wording does not authenticate it: keep the change held and check a previously established supplier route and the normal finance process separately. In real work, use the organisation's approved procedure and independently established contacts; this course supplies no universal account-change authorisation standard.

Authentication codes, passwords and payment instructions should not be confused. A code request may expose an account even when no money is mentioned. M06's 'group enrolment' story therefore belongs in the same consequential-action ledger as the transfer requests. Its held action is disclosure of the one-time code. Verification of a community organiser's identity would not itself establish that the organiser needs an account authentication code. The learner should be able to name the particular exposure rather than writing 'nothing financial happened, so the request is harmless'.

Ask what is irreversible or difficult to undo in the requested sequence. Sending information can remain consequential after a conversation ends; paying a fee can create another loss; installing a program may create an exposure beyond the payment itself. The paper cards include none of the links, code values, installers or account details needed to carry out those actions. That absence is deliberate. Learners practise a decision boundary with complete fictional context while retaining no operational recipe for a fraud attempt. A response plan should reduce exposure, not reproduce the attack.

A stop decision needs an owner and a next step. In personal practice the recipient can withhold their own action and seek appropriate help. In a workplace setting a staff member follows the established reporting and payment process. The worksheet should not invent authority for a community facilitator to operate another adult's account. Write 'participant retains control; helper assists with independently sourced contact if requested'. That formulation allows supportive help while distinguishing it from account ownership, bank investigation or a professional decision made on behalf of the person affected.

An average M04 answer says 'I will ask the caller to prove they work for the bank.' The caller controls the answer and may supply another convincing surface. A stronger answer says 'I will not move funds on this instruction; I will independently reach the bank using a route obtained before this call or directly from its verified official channel.' It also records whether information or money has already been sent, because that changes the urgency of provider contact. The response does not wait for a voice detector or for certainty about the caller's method.

The six-part paper request is a payment-boundary review. Role: recipient's worksheet helper. Constraints: fictional M03, M04 and M06, no live account, transaction or credential. Process: identify each requested act and missing authority. Verification: separate person, process and destination checks. Output: held act, independent route, already-exposed information and next support step. Failure handling: no supplied-route substitution, no imagined account freeze and no promised refund. A learner can use this structure on paper without asking a model to make a real payment or choose a real provider.

Contact provenance and device choice are related but different. Ending a call is necessary to escape the claimant's instructions, but it does not by itself establish the next channel's security. Use an independently established route and follow the bank's current guidance for contacting it safely. If unsure whether the original connection is clear or the usual device is trustworthy, a separate available device or assisted official route may be needed. We assert no universal waiting time or certainty about telephone systems. The fictional exercise has no actual telephone connection to test.

Do not treat a payment warning screen or a familiar account name as a substitute for verifying the request. This chapter does not evaluate a bank's confirmation services, reimbursement scheme or fraud controls. A screen may answer a limited question within that provider's process, while the message's identity and purpose remain unresolved. The worksheet records such limits rather than using an apparent success indicator to authorise everything. Learners should be able to say exactly what evidence they lack without speculating about a provider feature that they have not observed.

If a request claims an emergency, the payment hold and emergency response can proceed on separate tracks. The recipient can seek appropriate emergency assistance without paying an unknown destination. A facilitator must not train learners to use the workshop as a substitute for live emergency services. The selected UK official guidance identifies 999 for emergencies [UK-POLICE-CONTACT]. In other jurisdictions, check the local official route before delivery. The paper exercise includes only a named emergency branch, not a simulated call, fabricated dispatcher decision or confirmation that a person is safe.

The response record should be time-aware without creating a false sense of precision. In fiction, 'before any transfer' and 'after the claimed code disclosure' are meaningful sequence points. In a real provider report, transaction time and method may be important, but a facilitator should not collect them into a group worksheet. Avoid inventing exact minute-by-minute results or recovery probabilities. The immediate purpose is to help the affected adult reach the appropriate provider through a trustworthy route, while keeping any new payment or information demand under separate scrutiny.

A second person's review can challenge a decision, but agreement is not automatically independent evidence. Two learners reading the same suspicious chat may both be persuaded by it. The stronger second review asks where each route originated and whether the requested action is actually covered by the available authority. In the tabletop the observer marks whether identity, destination and process gaps were kept separate. They do not sign a professional approval. A peer can improve reasoning without turning an unverified source into a verified payment instruction.

Practice a clear refusal that leaves room for legitimate resolution: 'I am keeping this action on hold until I check through an established route.' This sentence is useful for a new account, a code request and a supposed protection transfer. It avoids arguing about the caller's accent, honesty or technology. The facilitator should accept a written response or a quiet placement of a hold card as equivalent participation. The lesson is the boundary and next check, not how confidently someone can perform a confrontation in front of a group.

The completed exercise must list different held acts for baseline M03, M04 and M06: confidential supplier transfer, protection-account transfer and code disclosure. It must name separate independent routes and avoid suggesting that a successful identity check authorises all three. A supplier-destination change is a proposed fictional variation, not a supplied M03 fact; check it conditionally if introduced. If something was already sent, the next chapter's contact plan leads to prompt provider help and scoped reporting. Stopping is a practical decision with a next support step, rather than permanent abandonment of someone who might need help.

1. Identify the requested consequential action.
2. Keep it held before any exposure.
3. Reject the caller-controlled confirmation.
4. Select independent provider/process sources.
5. If something was sent, seek appropriate provider help.
6. Keep emergency help separate from payment authority.

Scroll sideways to see every column.

ROLE: Recipient's payment-boundary helper.
CONSTRAINTS: M03/M04/M06 fiction only; no live account, payment or code.
PROCESS: Identify requested act and what was already exposed.
VERIFICATION: Separate person, process and destination evidence.
OUTPUT: heldAct;independentRoute;exposure;providerStep;unknown.
FAILURE MODES: No imagined freeze/refund; no caller-supplied contact substitution.

Diagram text equivalent: Claim and demand then Independent source then Check scope then Action held then Appropriate help. At Check scope, missing or unusable evidence branches to Missing or unusable route. Keep the action held and seek an appropriate independent route; no actual contact or approval is recorded.

Learn in your browser · Chapter 05 of 08

Answer first: After an attempted worksheet row, not before it. Practise the complete fictional key after your own attempt.

A worksheet should make the response easier to carry out, not create another puzzle during a stressful moment. Harbour Circle's sheet has a message identifier, the claimed identity, requested action, pressure, supplied route, independent route source, check result, action withheld and next support step. These fields distinguish a source from a decision and a decision from an outcome. Filling a box called 'verified' would hide too much. A person could correctly identify a relative while still lacking authority for the supplied payment destination, or find an official bank channel without reaching it yet.

The preparation sheet has seven fictional route codes: FAM-OLD-ROWAN, FAM-OLD-KIT, ORG-DIRECTORY-VALE, ORG-FINANCE-PROCESS, BANK-ESTABLISHED, GROUP-OLD-ORGANISER and SUPPLIER-OLD-CONTACT. Each code represents a contact established before the suspect message, with an access method to be selected privately in real preparation. It is not a real phone number, website or service contact. The facilitator gives this sheet before distributing the six message cards. That sequence lets participants identify independence from provenance rather than accepting whatever route happens to appear most recently.

The first filled row is M01: claimed Rowan, urgent accident transfer, ten-minute deadline and secrecy, supplied helper route rejected, FAM-OLD-ROWAN selected, outcome not yet known, transfer held, second route FAM-OLD-KIT if unanswered. M02 uses the same independent family source to check a new WhatsApp account, with the invoice and new destination still held. These rows share a contact family but differ in the claim being checked. The learner must not copy 'accident verified' into M02 merely because the same fictional relative is mentioned.

M03's row names a claimed director, a confidential supplier payment and an attempt to bypass normal finance. The supplied lawyer route is not independent. ORG-DIRECTORY-VALE checks contact identity and ORG-FINANCE-PROCESS addresses actual authority, with SUPPLIER-OLD-CONTACT proposed for any changed destination. M04's row names a claimed bank fraud desk, a protection transfer and continuous-call pressure. Its supplied extension is rejected; BANK-ESTABLISHED is selected. Neither row includes an actual bank destination, account balance, organisation directory or authorisation document. The exercise is complete without those operational details.

M05 and M06 test whether learners notice exposures beyond an ordinary transfer. M05 claims a recovery agent can return lost money after an upfront fee and document submission. The selected independent route is the affected provider's established channel, represented by BANK-ESTABLISHED in this fictional bank-transfer branch; the fee and documents stay withheld. M06 claims the organiser needs an authentication code. GROUP-OLD-ORGANISER is the check source, and the code stays withheld. The message source itself is never allowed to populate the independent-route column.

The tabletop uses three adult roles: recipient, supportive helper and observer. These are learning roles, not authenticated identities or professional appointments. The recipient reads a card or receives it in text; the helper asks what was requested and where an independent route comes from; the observer checks the evidence fields. A participant can choose an observer-only role, pause or leave the activity without giving a reason. No surprise contact, impersonated relative, audio clone or realistic bank login is used. The facilitator states these boundaries before the exercise begins.

A complete first round takes one card and one worksheet row. Read the claim, mark what would be exposed, choose the separate source and write the hold. The facilitator then supplies a scripted outcome card, if that round includes one. The recipient records the outcome without changing its meaning. The observer asks whether it covers identity, event, process and destination, or only one of them. This order matters because reading the answer first can make the correct route look obvious and conceal the participant's original decision reasoning.

The supplied outcome cards create meaningful branches. M01-A says no request was sent through the old family route; M01-B says that route was unanswered. M02-A says the old route does not confirm a number change. M03-A says the pre-existing finance process has no approved exception. M04-A says the fictional bank contact does not confirm the caller's protection-transfer instruction. M06-A says the established organiser did not request a code. These are authored outcomes for practice, not observations from a service, family, bank or model. M05 remains an unverified recovery demand with provider advice still needed.

An average session scores only whether a participant says 'scam'. That rewards a label and can overlook an unsafe next step. An improved session records whether they kept the action held, rejected the supplied route, selected a usable independent source, separated what the scripted check established and chose the appropriate next support branch. A learner who says 'I do not know who sent this, so I will verify independently' may have a better response than one who confidently labels AI and calls the supplied number. The assessment must reflect that distinction.

The paper facilitator request has six parts. Role: adult tabletop guide. Constraints: labelled fiction, no real contact, payment, credential or personal account, voluntary participation. Process: show the preparation sheet, give one message, collect an attempted row, then reveal a scripted branch. Verification: check route provenance and the limits of the result. Output: completed row plus one reason and one open gap. Failure handling: stop on distress, do not invent outcomes and switch to quiet written practice if needed. This is a complete reusable instruction, not a request for an AI to impersonate a relative.

A contact-source worksheet for actual delivery is different from the fictional preparation sheet. Before a session, the facilitator selects the jurisdiction, checks official provider and reporting sources, notes the date and purpose, and offers accessible alternatives. They should not place participants' private family numbers in a shared class resource. A generic row can say 'my privately retained contact route' without revealing its content. For official services the row can cite a public source and distinguish reporting, emergency help and provider response. Actual local contacts need checking; invented route codes are never copied into that sheet as live services.

Usability is part of the exercise outcome. A route may be independently sourced but unavailable at the needed time, unsuitable for a language need or inaccessible through the participant's device. The observer records that gap instead of granting completion on provenance alone. A printed source sheet, an agreed helper, an in-person provider option or an accessible official channel may be worth preparing, according to actual availability. These are planning possibilities, not tested facilities. Do not promise that every bank, police route or community venue offers every mode of contact.

Scoring the tabletop should remain formative. The suggested criteria are a withheld consequential action, independent source selection, an honest check result, the right support purpose and respectful language. They are not a professional competency scale. The facilitator can record anonymous scenario-level gaps, such as 'three rows still used the supplied helper route', only if an actual session later occurs and its recording arrangements are appropriate. This authored workbook contains no such participant results, trial denominator or success rate. Planned measures are kept separate from observed learning.

The observer's challenge should ask for evidence rather than obedience. 'Where did that number come from?' is more useful than 'Trust me, that is wrong.' 'What remains unconfirmed?' helps the learner preserve a gap. When a participant finds a missing route, the group should identify a preparation task, not ridicule their answer. The facilitator must not turn the session into a competition over who can spot the most convincing imitation. The course is about building a response path that remains usable when persuasion, uncertainty and emotion are present.

A completed sheet is portable learning material, not a live case file or security boundary. Copying it into a document, an email or an assistant does not make its contacts current or its decisions authoritative. If the group adapts the worksheet, keep the fictional label, source date, jurisdiction and unresolved access fields visible. Remove any accidental personal details before sharing teaching copies. There is no need to retain a participant's exact voice or family story to understand whether they used the correct source relationship. The printed route offers a complete non-AI learning method.

The final tabletop answer is supplied in the separate key so facilitators can compare a real attempt with a consistent teaching reference. It includes all six rows, not just an instruction to create them. The key keeps every initial demand held pending independent checks, distinguishes scripted outcomes from reality and identifies provider or reporting help when something was already sent. Its completeness is a resource for learning, not evidence that a workshop has been delivered. The next chapter shows how to populate the official contact sheet responsibly for a selected jurisdiction.

1. Show fictional preparation sheet.
2. Offer accessible voluntary roles.
3. Attempt one row before the key.
4. Reveal the specified scripted branch.
5. Check route provenance and remaining authority gaps.
6. Debrief without blame and retain no real personal data.

Scroll sideways to see every column.

ROLE: Adult tabletop guide.
CONSTRAINTS: Labelled fiction, voluntary participation, no real calls, payments, credentials or personal accounts.
PROCESS: Preparation sheet; attempted row; then scripted outcome and debrief.
VERIFICATION: Route provenance and limits of each result.
OUTPUT: six completed rows;reason;openGap;accessAlternative.
FAILURE MODES: Stop distress; no invented outcome; switch to quiet written participation.

Diagram text equivalent: Claim and demand then Independent source then Check scope then Action held then Appropriate help. At Check scope, missing or unusable evidence branches to Missing or unusable route. Keep the action held and seek an appropriate independent route; no actual contact or approval is recorded.

Learn in your browser · Chapter 06 of 08

Answer first: Provider/account/transaction response, separate from crime reporting. Practise the complete fictional key after your own attempt.

If someone has already sent money or sensitive information, the next response should focus on reducing further harm and reaching the relevant provider. Waiting to prove that AI was involved can delay useful action. The practical question is what was sent, through which service and what help that service can provide now. In this course that situation is represented by a fictional branch card. No bank account is opened and no real report is submitted. A learner practises explaining the issue, selecting a trustworthy contact source and separating possible action from a promised result.

The UK contact sheet begins with purpose, not a single number. A bank or payment provider addresses an account or transaction; a crime-reporting service records an incident; emergency services address immediate danger. Contacting one does not necessarily complete the others. The selected NCSC guidance says to tell the bank after a fraudulent payment and identifies Report Fraud for England, Wales and Northern Ireland, with Police Scotland for Scotland [NCSC-PAYMENTS]. This distinction must survive when a facilitator shortens the sheet for printing. 'Report online' alone does not specify the right service or purpose.

The current Report Fraud homepage identifies its service for people in England, Wales and Northern Ireland and displays 0300 123 2040 [UK-REPORT-FRAUD]. It directs people in Scotland to 101. The course records the source check date as 1 October 2026; it does not establish permanent contact availability. Before delivering a workshop, recheck the official source and the selected jurisdiction. Do not rely on a renamed historical reporting service, a search advertisement or a telephone number pasted into the suspicious message. A website visit is not a report submission.

For Scotland, the selected Police Scotland contact page lists non-emergency routes including online, in person and 101, and identifies 999 for emergencies [SCOTLAND-CONTACT]. These are different purposes. The page also includes access information, which a facilitator should check for the person's actual need rather than treating all routes as interchangeable. We do not use a Scotland-specific relay route as a universal UK emergency instruction. In any jurisdiction, a threat involving immediate danger needs the appropriate official emergency path, not a wait for the workshop, a complaint reply or a crime-reference number.

The printed sheet should have separate rows for bank or provider contact, crime reporting, emergency assistance and supportive follow-up. Each row records jurisdiction, purpose, independent source, date checked, access considerations and what has not been verified. For a bank, this draft cannot supply a universal bank number because no provider is selected. The row instead says to use that provider's independently established official app, website or retained card contact and recheck safe contact guidance. A tutor should not substitute an invented Harbour Circle route code for an actual provider contact.

The US comparison is deliberately labelled. The selected FTC response guidance advises prompt contact with the company used to pay, with steps differing by payment method, and provides FTC reporting information [FTC-AFTER-SCAM]. The FBI notice identifies IC3 reporting in its US context [FBI-AI-FRAUD]. Those references do not replace UK routes or establish a worldwide reimbursement right. A US facilitator should verify applicable official contacts and local emergency arrangements before delivery. This course does not grade learners on an unprovided US emergency number or a legal entitlement that depends on the individual transaction.

In the M04 after-payment branch, the facilitator card says 'The fictional recipient says a transfer was sent before the workshop. No account identifiers, amount, provider or transaction reference are supplied.' The filled answer therefore selects prompt independently sourced bank contact, asks about protective and possible recovery steps, and identifies the jurisdiction-specific reporting route. It does not claim to cancel the transfer, obtain a refund or know the provider's decision. The absence of a provider is a visible gap to resolve through the adult's own legitimate contact process.

A concise provider explanation can be rehearsed without private details: 'I may have acted on an impersonation request. Money or account information may be exposed. Please tell me the appropriate protective and reporting steps through this official channel.' Actual providers may need further information through their own secure process. The tutor should not collect that information in an open group or offer to handle the account. The learning task is reaching the proper recipient, communicating uncertainty clearly and keeping any new demand for fees or codes under scrutiny.

An average recovery response says 'Report it and you will get the money back.' That combines reporting with an outcome the course cannot establish. A stronger response says 'Contact the payment provider promptly, describe what happened, ask what can be done, and report through the appropriate official route; recovery depends on the circumstances.' That answer is candid without discouraging action. It avoids made-up recovery percentages and does not treat a failed first contact as a reason to accept a stranger's recovery offer. The response can remain constructive while the result is uncertain.

The six-component paper request is a contact-sheet editor. Role: adult community support planner. Constraints: UK and labelled US comparison only, sources checked on the recorded date, no live submission or transaction. Process: separate purpose and jurisdiction. Verification: use the source register rather than message links and leave the provider-specific route unresolved until selected. Output: purpose, jurisdiction, source identifier, contact option, access gap and next check. Failure handling: hold stale or unsourced routes and avoid refund promises. This complete instruction asks for accountable preparation, not automatic legal or banking advice.

Information exposure may require attention even if no money moved. The M06 branch says a fictional recipient disclosed a code. The answer stops further disclosure and seeks account-provider recovery guidance through an independently established route. It does not diagnose what account was affected because the card supplies none. The selected FTC guide includes account-specific response and recovery links [FTC-AFTER-SCAM]. This chapter does not ask a facilitator to run security tools, reset another adult's credentials or claim that a password change has erased all consequences. The provider and situation determine the appropriate response.

Records should distinguish attempted contact from completed contact. 'I selected the official route' is not 'the bank received my report'. 'I sent a crime report' is not 'police investigated and recovered funds'. A real reference, if provided, belongs in the affected person's own record or the service's proper system. Our fictional worksheet uses REPORT-PENDING rather than fabricating a case reference. This language helps a supporter identify the next gap and prevents a tidy summary from being mistaken for evidence that a service interaction actually occurred.

Access needs may change the order of assistance. Someone may need help reading an official page, finding an in-person option, using an accessible channel or communicating in another language. Ask what support they want and preserve their control. Do not presume that a supporter should hear every detail, speak on their behalf or store their documents. A route that is correct in the jurisdiction but unusable by that person needs another verified option. The draft provides an access-gap field and examples of questions, not a claim to have tested services with affected users or assistive technology.

The contact sheet needs a maintenance owner. Before each delivery, the facilitator records which sources were checked, on what date and whether any route changed. A changed official service name should trigger correction of the sheet, not deletion of the old source history. This creates a simple provenance trail for teaching material. It does not turn the tutor into an official service or make the worksheet a durable incident-management system. The adult can use the sheet to find appropriate help while recognising that current provider and public-service information takes priority.

Official reporting and message reporting also differ. The selected NCSC shopping page mentions forwarding suspicious texts to 7726 and email reporting through its service [NCSC-PAYMENTS]. Those channels are not a substitute for bank contact after a payment or for the appropriate crime report. This course keeps such message-reporting information as a sourced supplementary option rather than the only action on a loss branch. A facilitator should check current official instructions and the relevant communication type, without asking learners to forward the six fictional cards to a real reporting service.

The completed exercise supplies four UK purpose rows and a separately labelled US comparison. It retains the unknown bank provider and access arrangements, shows the current Report Fraud and Scotland distinction, and puts immediate danger on its own branch. This is a ready learning reference, not proof that actual service availability, a local support partner or a live report was verified. The next chapter protects the evidence and the person while avoiding new offers that turn hope for recovery into a second exposure.

1. Identify money or information exposure.
2. Select independently established provider contact promptly.
3. Separate reporting from provider response.
4. Choose the correct jurisdiction and purpose.
5. Record attempted versus completed contact honestly.
6. Recheck official routes and access before delivery.

Scroll sideways to see every column.

ROLE: Community contact-sheet editor.
CONSTRAINTS: Dated UK sources and labelled US comparison; no submission or provider action.
PROCESS: Separate purpose and jurisdiction.
VERIFICATION: Sources from register, not message links; provider route/access unresolved until selected.
OUTPUT: purpose;jurisdiction;sourceId;contactOption;accessGap;nextCheck.
FAILURE MODES: Hold stale/unsourced routes; no refund promise or fabricated report reference.

Diagram text equivalent: Claim and demand then Independent source then Check scope then Action held then Appropriate help. At Check scope, missing or unusable evidence branches to Missing or unusable route. Keep the action held and seek an appropriate independent route; no actual contact or approval is recorded.

Learn in your browser · Chapter 07 of 08

Answer first: An edited interpretation must not be presented as exact original evidence. Practise the complete fictional key after your own attempt.

Evidence can help an appropriate provider or reporting service understand what happened, but a workshop is not the right place to collect a participant's whole incident history. The teaching distinction is between preserving a relevant record and spreading it. A screenshot sent to a group may expose names, numbers, account details or other people who did not agree to share. The Harbour Circle cards avoid that problem by supplying synthetic text. Participants can practise selecting useful fields without bringing their own voice recordings, private chats or bank statements into the session.

An evidence note should identify the contact type, what was requested, the sequence of actions and what is still uncertain. In the fictional M04 branch, a useful note says 'unexpected voice call claimed bank authority; requested protection transfer; recipient says a transfer was sent; provider details not supplied'. That is different from 'the bank was hacked by an AI system'. The latter adds a technical and causal claim not established by the card. A careful note allows a provider to ask the right questions without inheriting an invented conclusion from the supporter.

Keep originals and teaching summaries distinct. If an actual affected person has messages or receipts, an appropriate service can advise what it needs and how to send them. A community helper should not edit the original message and then present the edited text as exact evidence. In the workshop the original M05 transcript is labelled separately from the learner's summary. The summary can be shorter, but should retain the upfront-fee demand and document request. Removing those features to make a story easier to tell would remove the very evidence needed for the decision.

Access to a record is not permission to upload it to an assistant. A voice clip may concern the caller, recipient and others; a family chat may contain information unrelated to the fraud question. This course needs no AI upload. If someone later considers a tool, they must first establish the appropriate purpose, permission, data handling and service arrangements for that real context. We do not choose a lawful basis, classify any person's data or certify anonymity. The practical learning rule is simpler: use the supplied fiction and keep real incident materials out of the workshop.

M05 says, 'I am a recovery agent with your case. I can return the money today if you pay a release fee first and send a copy of your identity document. Do not contact your bank because that will slow the process.' The message contains no genuine case reference, government appointment or recovery authority. Its familiarity with an earlier loss does not prove legitimacy. The model answer withholds the fee and document, refuses the supplied contact as a verifier and selects the affected provider's independently established channel for advice about the original incident.

The selected FTC recovery-scam guidance describes unexpected offers of help that seek upfront payment or personal information [FTC-RECOVERY]. This is US consumer guidance, not proof that all paid professional services in every jurisdiction are fraudulent. The exercise concerns an unsolicited recovery demand with an unverified claimed role. A learner should challenge that exact pattern and seek an independent route, rather than generalising that no legitimate support service could ever exist. The course makes no real recommendation, licence finding or professional referral on the basis of a claimed recovery title.

A fraudster may use details from an earlier loss to create continuity. A name, approximate event or supposed case reference can make a new contact feel like part of a real investigation. The worksheet asks where the authority was independently established and who introduced the contact. M05's assertion 'with your case' remains a claim from M05. It does not replace the provider's own verified communications. The response should avoid sending another copy of the original incident file to someone whose role is unknown, even when their offer feels comforting or urgent.

An average evidence exercise gathers everything and sends it to a group helper, assuming that more material always means better support. An improved exercise selects a minimal useful summary, preserves the distinction between original and interpretation, and sends any real records only through the appropriate independently verified service process. For the synthetic M05, the relevant fields are recovery claim, fee, document request, pressure, rejected route and provider advice pending. The improved worksheet contains no actual identity document and does not claim that a synthetic case label has been registered with police or a bank.

The six-part paper request is an evidence-summary helper. Role: community learning record editor. Constraints: fictional M04 and M05 only, no real incident files or identity documents. Process: separate original words, recipient actions and interpretations. Verification: retain the payment or document exposure and mark unknown facts. Output: concise chronology, source card, uncertainty, independent support route and sharing boundary. Failure handling: do not invent technical causes, case references or recovery outcomes. This teaches careful summarisation without asking a model to decide whether a voice is authentic or a person deserves reimbursement.

The workshop retention plan is intentionally small. The facilitator can use blank sheets that learners keep or discard themselves, and can avoid collecting named responses. If actual evaluation is later planned, decide what minimal information is needed, who will access it, how long it will be kept and how participants can ask questions. Those decisions have not been implemented by this draft. A proposed anonymous scenario tally is not evidence that names have been removed safely from real data. The author record contains no participant data, recording or actual session result.

Sharing a warning can help others, but accusations and exposed details can cause additional harm. In the fictional exercise a community notice can say 'unexpected messages may request urgent transfers or codes; verify independently' without publishing a person's name, screenshot or alleged criminal identity. In real circumstances, seek the appropriate service's guidance on reporting rather than organising a group investigation. This chapter does not teach tracing a caller, confronting a suspect or gathering material through deceptive contact. The useful action is a safe route to the right recipient and a respectful warning.

There is a difference between removing a message from a group and removing every copy. A recipient may already have saved or forwarded it. Similarly, withdrawing a teaching worksheet does not erase earlier downloads. The facilitator should correct misleading material promptly, explain the change to people who received it where appropriate, and avoid promising universal deletion. In this non-code course there is no remote revocation mechanism or record store. The lesson is a practical limit of information sharing, not a claim that Mickai or a community group can technically recall all distributed evidence.

A recovery offer can exploit shame as well as hope. Someone may prefer a quiet private promise to another difficult conversation with a bank or family member. The helper's response should make legitimate contact feel possible: 'You deserve support; we can use a route you choose and check its source together.' That sentence does not pressure disclosure or promise success. It gives the adult control over the next step and helps separate assistance from another demand. The course's support language is original facilitation guidance, not a tested therapeutic intervention or clinical service.

If a participant introduces a real incident during practice, stop the scripted exercise for that person and offer a private, appropriate support route according to the group's established procedures. Do not ask the group to diagnose it or replay the voice recording. Do not continue merely to complete the lesson. The facilitator should know who can help within the actual setting and check local arrangements before delivery. This draft names no appointed safeguarding lead, emergency responder, adviser or evidence custodian. It identifies the responsibility gap so an owner can address it.

The evidence exercise is successful when the learner can provide a relevant, scoped summary without turning claims into facts, exposing unrelated details or accepting an unverified recovery contact. A complete answer includes what remains unknown and who should receive any further real information. It does not require a technical explanation of the fraud. The distinction matters because a clear summary can support the next person while a confident but invented explanation can misdirect them. The course remains useful without becoming an investigator, detector or claims service.

Carry three boundaries into the capstone: originals differ from summaries, available records differ from appropriate sharing, and a new recovery promise differs from established authority. The learner should identify the fee and document hold in M05, maintain the original-event uncertainty in M04, and choose independent provider help rather than a claimant-supplied contact. These are decisions visible in a filled worksheet. They establish neither a live recovery outcome nor a legal conclusion, but they supply a concrete basis for supportive, careful next action.

1. Keep original card separate from summary.
2. Select relevant exposure and sequence facts.
3. Mark claims and interpretations.
4. Reject unverified recovery fee/document requests.
5. Use independently established appropriate services.
6. Keep real evidence out of group tools and record retention limits.

Scroll sideways to see every column.

ROLE: Learning evidence-summary helper.
CONSTRAINTS: M04/M05 fiction only; no real files, voices or identity documents.
PROCESS: Separate original words, recipient actions and interpretations.
VERIFICATION: Retain exposure and uncertainty, with original-card reference.
OUTPUT: chronology;sourceCard;unknown;independentSupport;sharingBoundary.
FAILURE MODES: No invented technical cause, case reference or recovery outcome.

Diagram text equivalent: Original card then Scoped summary then Sharing boundary then Recovery demand held then Verified service route. At Sharing boundary, missing or unusable evidence branches to Unknown authority. Keep the action held and seek an appropriate independent route; no actual contact or approval is recorded.

Learn in your browser · Chapter 08 of 08

Answer first: Stop exposure, verify independently, reach appropriate help, seek respectful support. Practise the complete fictional key after your own attempt.

The capstone joins the eight chapters into a response plan that an adult can explain and a facilitator can reuse. It is not a test of acting skill, technical voice detection or willingness to disclose a real loss. A participant works with six labelled fictional messages, a fictional preparation sheet, scripted outcome cards and a source-checked reporting sheet. Their deliverable is a set of filled decisions and a short teach-back. No money, credentials, account access, real voice or actual report is used. The whole activity can be completed in print with another adult reading aloud if requested.

Begin the session with choice and clarity. Explain the fictional scope, show the opt-out and observer alternatives, ask about format needs privately and give the pause instruction. Do not surprise participants with an urgent 'family' recording. A believable unannounced attack could distress someone and would not be the agreed learning exercise. The facilitator should check actual support arrangements before delivery and know how to stop the activity. A written proposal for those arrangements is not evidence that a venue has appointed staff, tested access or accepted safeguarding responsibilities.

Support without blame means focusing on the next useful step rather than judging the person. A helpful opening is 'Thank you for telling me. Let us work out what you need now and which contact route you want to use.' An unhelpful opening is 'Why did you fall for that?' The second sentence can make further disclosure feel unsafe and provides no route to action. The first respects the adult's control. It does not promise recovery or require them to share details with the group. The course teaches communication practice, not a clinical or specialist victim-support qualification.

The capstone starts with a source audit. Learners identify which contacts belong to the fictional preparation sheet and which official sources belong to the jurisdiction-specific contact sheet. They note the check date and any missing provider or access information. This step prevents a neat response plan from relying on an outdated reporting name or a fabricated bank contact. A facilitator preparing a real session must recheck the selected official routes immediately before delivery. The authored sheet reflects a dated read of guidance, not live service availability or a completed user acceptance test.

Next complete M01 and M02. For M01, hold the urgent transfer, reject the helper route, choose FAM-OLD-ROWAN, and if unanswered choose FAM-OLD-KIT while keeping the request unresolved. For M02, hold the invoice and contact change, check through the old family route and do not treat the familiar supper reference as authority. The supplied M01-A and M02-A outcomes do not corroborate the requests. The completed rows preserve that wording rather than pretending the learner has spoken to an actual relative. The model answer is a full paper key, not a record of performance.

Then complete M03 and M04. M03 holds the confidential supplier transfer and checks ORG-DIRECTORY-VALE, ORG-FINANCE-PROCESS and any changed supplier destination through SUPPLIER-OLD-CONTACT. The supplied lawyer route remains dependent on the suspicious claim. M04 holds the protection transfer and selects BANK-ESTABLISHED, with provider identity and access arrangements unresolved for real use. The scripted outcomes do not confirm the requested exception or transfer. If the after-payment branch is supplied, prompt independently sourced provider contact and the appropriate reporting route are added without claiming a cancellation or refund.

Finally complete M05 and M06. M05 holds the release fee and identity document, rejects the unexpected recovery agent's route and seeks established provider advice about the original loss. M06 holds the code, checks GROUP-OLD-ORGANISER and records the scripted organiser's denial. If a code was already disclosed, the next step is the relevant account provider's independently sourced recovery guidance, with the actual account still unknown. These rows demonstrate that protection concerns information as well as money, and that someone targeted once can receive a second persuasive demand.

A complete response plan has four practical parts: stop the requested exposure, check through an independent usable route, reach the relevant official or provider help if needed, and seek respectful support. It also records residual uncertainty. A number being correct is not the same as contact having occurred; a report being sent is not the same as an investigation or repayment; an authentic person is not always authorised for a payment. The teach-back should explain one of these distinctions in ordinary language to a partner who has not read the cards.

An average capstone response labels all six 'AI scams' and lists a single reporting website. The stronger response supplies six distinct rows, their source dependencies, different held actions, specific next checks and jurisdiction branches. It does not diagnose whether AI made the messages. It retains unanswered contact and provider gaps, as well as emergency and access alternatives. This comparison matters because a correct warning can still lead to an unusable response. The goal is a reviewable path that helps someone act while uncertain, rather than a confident label with no safe next step.

The six-component final paper request is a workshop plan reviewer. Role: adult facilitator. Constraints: six authored cards, no real calls, payments, voices, participant records or service claims. Process: audit contact sources, run attempts before keys, add scripted branches and debrief respectfully. Verification: check route independence, held actions, jurisdiction, access and uncertainty. Output: six completed rows, a four-purpose contact sheet, a support sentence and a maintenance plan. Failure handling: stop distressing practice, reject new claimant-supplied routes and leave missing facts visible. The complete request is supplied with the key for reusable preparation.

The tabletop is ungraded written practice. Its success criteria make the intended reasoning visible, but completing it does not establish live incident competence. The prospective knowledge assessment draws twenty questions from forty supplied items and uses a strict score above eighty percent: sixteen correct fails, seventeen correct passes. The eight written practices and capstone are not scored by that knowledge draw. The planned private exam route is not released or verified. Any future named educational certificate depends on the existing protected assessment process and its checks; it is not accreditation, identity proof or a fraud-response qualification.

Review questions are different from a surprise examination. Each chapter supplies six questions with a separate answer key so learners can attempt them before reading the answers. The quick check tests one local distinction and gives an explanation. A learner may repeat the practice, discuss a mistake and revise a row. Repetition improves the opportunity to learn but does not prove a measured reduction in fraud. This draft contains no participant scores, model accuracy, observed workshop success or controlled trial. The author validation concerns the supplied material and its internal mappings.

The reusable plan should include a maintenance date and owner. In the fictional capstone, 'facilitator before next delivery' owns the official-route recheck; 'participant privately' owns their established personal contacts; 'venue owner' must supply actual support and access arrangements. These are proposed responsibilities, not appointments. A changed reporting route triggers a correction to future copies, with a note of what changed. Earlier printed or downloaded copies may remain. The group should therefore avoid presenting the sheet as a permanently current emergency directory or a substitute for official guidance.

A good debrief asks what helped the learner pause, which route was independent and where the plan still failed to be usable. Do not ask participants to confess a past error or tell an entertaining victim story. A missed field becomes a revision task, such as identifying an accessible provider route before delivery. The facilitator can offer quiet reflection and repeat practice using a different card. This creates learning space without claiming that everyone has the same device, confidence, language, money or support network, and without making a phone callback the only acceptable mode.

The course's public-facing question is how a community workshop can help adults respond to AI-enabled impersonation. The actual delivered answer is substantial original teaching, six paper cases, filled response keys and source-linked contact planning. A possible future Mickai engagement could help a group prepare permitted records, accessible handouts and owner-controlled source updates. This draft establishes no deployed scam detector, verified caller service, bank intervention, emergency helpline or reimbursement capability. Its useful scope is education and accountable preparation, with qualified fraud-prevention and community-support review still required before actual workshop delivery.

Finish by writing a short response card in your own words: 'I will pause any unexpected money or code request, verify through an established independent route, contact the relevant provider promptly if something was exposed, and seek support without blame.' Add your privately chosen access alternative and the date for checking official routes. Do not include a password, safe word or account number. The result is a practical reminder tied to the course's four reserved outcomes. It remains a learning aid, with real-world decisions and service responses left to the affected adult and appropriate organisations.

1. State fictional scope and opt-out.
2. Audit contact sources/jurisdiction/access.
3. Complete six attempted rows.
4. Introduce only supplied scripted outcomes.
5. Prepare support and maintenance responsibilities.
6. Teach back boundaries; keep knowledge exam separate from practical competence.

Scroll sideways to see every column.

ROLE: Adult workshop plan reviewer.
CONSTRAINTS: Six authored cards only; no real calls, voices, payments, participant records or service claims.
PROCESS: Audit sources; attempt before keys; reveal branches; debrief respectfully.
VERIFICATION: Route independence, held actions, jurisdiction, access and uncertainty.
OUTPUT: six rows;four-purpose contact sheet;supportSentence;maintenanceOwner.
FAILURE MODES: Stop distressing practice; reject claimant-supplied routes; retain missing facts.

Diagram text equivalent: Six attempted rows then Independent checks then Scripted outcomes then Contact/support plan then Teach-back. At Scripted outcomes, missing or unusable evidence branches to Access or contact gap. Keep the action held and seek an appropriate independent route; no actual contact or approval is recorded.

Scroll sideways to see every column.