Build Your Verification Habit

Knowing is not the same as doing

You now know more about fakes, scams, data and verification than most people in most offices. That knowledge will do very little for you on its own. Nobody is ever fooled because they did not know the theory. They are fooled because it was 4.50pm, the message felt urgent, and the check did not occur to them until afterwards.

The point of a checklist is that it does not depend on you being alert. Pilots and surgeons use them for exactly this reason: not because they forget how their job works, but because a written list works on the worst day as well as the best one.

In plain English

Checklist:: A short fixed list you run through every time, so you do not have to remember what to remember.
Friction:: A deliberate pause before an irreversible action. Two minutes is usually enough.
Out-of-band check:: Confirming something through a different channel you chose yourself, such as a number already in your contacts.
Prompt pack:: A small saved collection of prompts you reuse, so the good version is always to hand.

The two-minute check

Six questions. Not all six apply every time, and running the whole list still takes under two minutes.

1. Where did this come from? Can you name the original source, not just the person who forwarded it? An account you cannot identify is a reason to pause.

2. What is it asking me to do, and how fast? Urgency plus money plus secrecy is the shape of a scam, whatever the voice on the phone sounds like.

3. Can I confirm this through a channel I chose? Hang up and dial the number you already had. Type the website address yourself. Ask the person face to face. Never use the link, number or address supplied by the thing you are checking.

4. Would I be relaxed if this text were public? Ask it before you paste, every time. If the answer is no, anonymise. If it is still no, do not paste.

5. Can I open one source and find the claim inside it? One is enough for ordinary work. A perfectly formatted reference proves nothing until it opens.

6. Do I want this to be true? If yes, check twice. The answer you were hoping for is the one you will scrutinise least.

Checkpoint

Source, request, channel, exposure, evidence, and your own wish for it to be true. Six questions, under two minutes.

Build the artifact somewhere you will actually see it

LearnAI has no accounts and stores nothing about you, so this cannot live here waiting for you. That is deliberate, and it means the useful version of this lesson is the one you build on your own machine in the next ten minutes.

Copy the checklist into a note on your phone and pin it. Print it and put it near the desk of whoever handles your invoices, since payment redirection is where these losses concentrate. Paste it into your team wiki above the AI policy from lesson five. Then save the prompts below into a note called Prompt Pack, so the good version of each is always one paste away.

Two of these are worth doing today rather than adding to a list. Agree a code word with your family, and turn off training in the settings of any consumer AI tool you use for work-adjacent things. Both take about five minutes and neither needs anyone's permission.

❌ Weak prompt

Prompt

Reacting in the moment: the message says the invoice bank details have changed and payment is due today, so you update the record and pay.

Output

Payment sent to the new account. The supplier calls three weeks later asking where their money is.

Everything in the message was designed to make the check feel unnecessary. Nothing here was stupid. It was simply fast, and speed was the whole attack.

✅ Good prompt

Prompt

Running the check: pause, find the supplier's number in your own records rather than the email, call and ask whether their bank details changed, and pay afterwards.

Output

The supplier confirms nothing has changed. The email was spoofed. Payment stays where it belongs.

Ninety seconds, one phone call to a number you already had, and the entire attack collapses. This is what habit buys you.

Prompt pack 1: verify anything you are told

Answer the question below. Then:

List every factual claim a reader could check.
Give a working link for each, with publisher and date.
Mark anything you cannot source as UNVERIFIED and leave it out of the summary.
Say which parts you are least confident about.
Missing is better than invented. Do not fill gaps with plausible detail.
QUESTION:
[your question]

Prompt pack 2: pull apart a suspicious message

Here is a message I received. Do not tell me whether it is genuine, because you
cannot know that. Instead give me:

Every urgency, secrecy or authority tactic in it.
Every claim I could verify independently.
How to verify each one WITHOUT using any link, number or address in the message.
Then write one polite line I can send to buy myself time while I check.
MESSAGE:
[paste it]

Prompt pack 3: anonymise before you paste

I need help with a document containing confidential details. Do not ask me to
paste it yet. First list what I should replace: names, organisations, addresses,
account and reference numbers, dates that identify an event, and job titles unique
enough to identify someone. Give me a labelling scheme (Client A, Person B) and
remind me to keep the key in a file on my own computer.

Prompt pack 4: check my own thinking

You have just told me something I was hoping to hear, which is when I check least.

Make the strongest honest case against your answer.
List what would have to be true for you to be wrong.
Tell me the first two facts I should check to settle it.
Be genuinely critical rather than agreeable.

What to carry out of this course

Three things, if you remember nothing else.

The old visual tells for fakes are fading, so trust context over pixels: source, motive, and whether anyone credible reports it. A code word and a call back on a number you already have will defeat almost every impersonation, of a relative or of your finance director. And confident writing is a house style, not evidence, so a claim you have not opened a source for is a claim you do not yet have.

None of this makes you paranoid. It makes you slightly slower at exactly the six or seven moments in a year when slowness is worth a great deal. And if something has already gone wrong, for you or for someone you care about, the honest last word is this: it happened because these things are engineered by people who test what works. Report it, tell someone, and carry on.

Finishing this lesson earns you the Sharp Eye badge. Then send this course to the person in your life who is most likely to get the phone call. That costs nothing, and it is the most useful thing you can do with the next two minutes.

📝 Quiz

Question 1 of 4

Why is a written checklist more useful than simply knowing the risks?