Lesson 11 of 12 · About 4 minutes
Spot the impostor behind the request
Learn the concept.
A pizza box. An IT badge. A familiar face. The Day 12 Short changes the disguise three times. The useful question stays the same: what is this person asking you to do?
From a disguise to a better decision
Follow the sequence, or move one step at a time.
Reduced motion is on. Use Next step to explore without animation.
Read all 4 steps
- A convincing introduction
A costume or job title creates a claim. It does not verify the requester.
- The real ask appears
Read what the code does. This one signs in to your account.
- Keep the secret
Pause the exchange without sending a password, account login code, or recovery code.
- Check separately
Open your saved contact or known support portal yourself. Verify the request through that separate route.
Three disguises. One secret to protect.
The fictional Day 12 story changes the costume, not the warning sign.
- 01Pizza delivery
An account password is not a delivery instruction.
- 02IT support
A claimed support role does not justify sharing your login code.
- 03A familiar face
An unexpected request still needs an independent check.
Read the visualIf the costume changes but the request is still for your login code, should your decision change?
No. Keep that secret private and verify the request through a separate trusted contact.
Look at the request
A convincing introduction does not establish permission to use your account. Notice requests for a password, login code, recovery code, or remote access, even when the person sounds helpful.
Read what the code is for
Account login and recovery codes can help someone get into your account. Keep them private. A delivery handoff code serves a different purpose; read the message instead of assuming every code does the same job.
Verify through a separate route
Pause the exchange. Use a saved contact, your organization’s known support portal, or the service’s official app. Asking “is this really you?” in the same chat lets the same unverified person answer. A verified contact still does not need your password.
Act if a secret was shared
Open the real service yourself to secure or recover the account. Change a compromised password and review signed-in devices. For a work account, report the request through your organization’s usual support process.
Put it in context
In the fictional Short, a pizza delivery disguise, an IT badge, and a fake Leo all lead to the same suspicious ask. Imagine the “IT helper” says, “Read me the account login code so I can fix this.” Leo keeps the code private and opens the support portal he already knows. The claimed job title does not decide who gets the secret.
Make a decision.
Use what you just learned. A correct answer lets you save this lesson to your progress.
Take this with you.
New costume. Same scam. Keep passwords and account login codes private, and verify unexpected requests through a separate trusted channel.
Next lesson: The raise is automaticSam’s familiar-looking chat asks for a sign-in code. Choose what Leo does next.
Try the login-code chat challengeGo deeper with passwords and multifactor authentication or caller ID and phone scams.
See it in a Short.
Optional video companions from MyCyberTutor. Your lesson progress stays here.