Facilitator Notes & Model Answers — Lesson 09
For instructors and self-study · Model rule, PACE plan, and rationale
Model verification rule
"For any urgent request to move money or share sensitive data, I do not act on the channel it arrived on. I call back on a number I already hold, confirm our pre-agreed code word, and only then proceed. If I cannot verify, the answer is no."
Model PACE plan (principal ↔ CFO)
| Rung | Example |
|---|---|
| Primary | The organisation's normal secure messaging/voice channel |
| Alternate | A direct mobile call to a pre-saved, known-good number |
| Contingency | A second trusted contact (e.g., the CFO's chief of staff) who can reach them |
| Emergency | A pre-agreed last-resort method and code phrase, used only in genuine crisis |
Why the poll answer is C (independent callback + code word)
- A — a question only the CFO would know: a prepared adversary may know it, and a live clone can improvise or deflect.
- B — caller-ID match: numbers are spoofable; "sounded like them" is not evidence.
- C — hang up, call a trusted number, confirm a code word: moves to a channel the attacker does not control and demands a secret they were never given. The only reliable defeat of a live voice-clone.
- D — reply to their confirmation email: still inside the attacker-controlled thread.
Teaching point: A, B, and D all verify using something the attacker can fake or influence. Only an independent channel plus a pre-shared secret escapes the attacker's control.
Homework — what good looks like
Task 1
Strong rules refuse the arrival channel, specify an independent callback and a code word, and set a safe default of "no" when verification fails.
Task 2
The best PACE plans include at least one genuinely independent channel and a challenge phrase the other person truly knows and can produce under stress.
Task 3
Good wording, e.g.: "If you ever get an urgent request that looks like it's from me, please stop and verify on our agreed channel first — you'll never be in trouble for checking." Fear of the boss is the vulnerability being closed.