21:I[702454,["/_next/static/immutable/chunks/3fhcxj9zqhc73.js","/_next/static/immutable/chunks/0_b8fx_t52fg2.js","/_next/static/immutable/chunks/0ll8kzjunmex-.js","/_next/static/immutable/chunks/2bim9-3dsniwv.js","/_next/static/immutable/chunks/0vs-ypdq9t5l1.js","/_next/static/immutable/chunks/3mvws5jbuibzv.js","/_next/static/immutable/chunks/181z7f_1svv7z.js","/_next/static/immutable/chunks/0v_ohb1uwrtn-.js","/_next/static/immutable/chunks/230g6czeidmd1.js","/_next/static/immutable/chunks/3vddxkt_6yxv7.js","/_next/static/immutable/chunks/2sclxp840mdso.js","/_next/static/immutable/chunks/2gxp864netdu6.js","/_next/static/immutable/chunks/3k38m3418g5s4.js","/_next/static/immutable/chunks/1imwh2zezh79x.js","/_next/static/immutable/chunks/11t_6dvuhpqqs.js","/_next/static/immutable/chunks/2nx5_d7myyfv2.js","/_next/static/immutable/chunks/2nako0qsny0ux.js","/_next/static/immutable/chunks/24h8wnxeqz0qp.js","/_next/static/immutable/chunks/3-15ikk8fa680.js","/_next/static/immutable/chunks/2_udiw3e83nia.js","/_next/static/immutable/chunks/2n0dbm48nlgy8.js","/_next/static/immutable/chunks/2_g7748w2-o-8.js","/_next/static/immutable/chunks/1hgaz6x18w5zl.js","/_next/static/immutable/chunks/1s5qese6yrc_4.js","/_next/static/immutable/chunks/3a8jhn_2nw1o8.js","/_next/static/immutable/chunks/11o7oj9o45p28.js"],"ReportPageReady"] 22:I[881013,["/_next/static/immutable/chunks/3fhcxj9zqhc73.js","/_next/static/immutable/chunks/0_b8fx_t52fg2.js","/_next/static/immutable/chunks/0ll8kzjunmex-.js","/_next/static/immutable/chunks/2bim9-3dsniwv.js","/_next/static/immutable/chunks/0vs-ypdq9t5l1.js","/_next/static/immutable/chunks/3mvws5jbuibzv.js","/_next/static/immutable/chunks/181z7f_1svv7z.js","/_next/static/immutable/chunks/0v_ohb1uwrtn-.js","/_next/static/immutable/chunks/230g6czeidmd1.js","/_next/static/immutable/chunks/3vddxkt_6yxv7.js","/_next/static/immutable/chunks/2sclxp840mdso.js","/_next/static/immutable/chunks/2gxp864netdu6.js","/_next/static/immutable/chunks/3k38m3418g5s4.js","/_next/static/immutable/chunks/1imwh2zezh79x.js","/_next/static/immutable/chunks/11t_6dvuhpqqs.js","/_next/static/immutable/chunks/2nx5_d7myyfv2.js","/_next/static/immutable/chunks/2nako0qsny0ux.js","/_next/static/immutable/chunks/24h8wnxeqz0qp.js","/_next/static/immutable/chunks/3-15ikk8fa680.js","/_next/static/immutable/chunks/2_udiw3e83nia.js","/_next/static/immutable/chunks/2n0dbm48nlgy8.js","/_next/static/immutable/chunks/2_g7748w2-o-8.js","/_next/static/immutable/chunks/1hgaz6x18w5zl.js","/_next/static/immutable/chunks/1s5qese6yrc_4.js","/_next/static/immutable/chunks/3a8jhn_2nw1o8.js","/_next/static/immutable/chunks/11o7oj9o45p28.js"],"HostedTrainingView"] 2c:I[865300,["/_next/static/immutable/chunks/3fhcxj9zqhc73.js","/_next/static/immutable/chunks/0_b8fx_t52fg2.js","/_next/static/immutable/chunks/0ll8kzjunmex-.js","/_next/static/immutable/chunks/2bim9-3dsniwv.js","/_next/static/immutable/chunks/0vs-ypdq9t5l1.js","/_next/static/immutable/chunks/3mvws5jbuibzv.js"],"IconMark"] 23:T668,## Check the site before entering a password A page can copy a logo. Read the site name, also called the host, in the browser's address bar. In `https://help.example.com/login`, the host is `help.example.com`, after `https://` and before the path `/login`. On a phone, tap the address bar to see the full address. The host identifies the site you opened. It does not guarantee that every form on that site is safe or sends information only there. Even a real site can contain an altered sign-in form. ### Start through a known route If a message or search result asks you to sign in, open the app, a saved bookmark or an address you knew before the message. Do not use the suspect page to tell you which address to trust. At work, several apps may use one sign-in service, called single sign-on. Learn its address from your IT team through your usual contact route. Compare any password request with that known sign-in process. A parcel text might link to `parcelpost-redelivery.example` when your courier uses `parcelpost.example`. The added word makes a different site. Check the delivery in the app you already use. ### If you already typed a password Treat a password entered on an untrusted page as exposed, even if you did not press Submit. Through the real service, change it and replace it on any other account where you reused it. A signed-in session is access that can continue without entering the password again. Use the service's security settings to end other sessions and review recent activity. A password change alone may not end existing access. Report a work-account incident through your usual IT contact route. 24:T78c,Lumen Exchange · Reset password

LLumen Exchange

Reset your password

We blocked a sign-in from a new device. Confirm your details and choose a new password to keep your account active.

Case 48213 · Security team

25:Taf4,Travel policy · Fernway

FFernway · Document library

Travel policy

Public document · Updated 12 September 2026

Book flights and hotels through the travel desk at least 14 days before departure. Economy class applies to flights under six hours.

Daily meal allowances depend on the destination and are listed in the per diem table. Keep receipts for every expense over 25 EUR.

Sign in to view this document

Use your Fernway email and password.

Work emailPassword

26:T136c,fernway travel policy - Seekr

Seekr.

fernway travel policy

About 18,400 results (0.31 seconds)

Fernway

https://docs.fernway.example › policies › travel

Travel policy | Fernway document library

12 Sept 2026 — Booking rules, per diem rates and approval steps for Fernway business travel, including the travel desk and expense limits.

Fernway

https://www.fernway.example › about

Fernway | Freight and logistics for growing businesses

Fernway moves freight across Europe and the Americas, with offices in Rotterdam, Lisbon and Montevideo.

News Daily

https://news.example › business

Fernway opens a second office in Lisbon

3 Aug 2026 — The logistics company says the new office will support its growing European customer base.

Travel Guide

https://travelguide.example › corporate

How to write a company travel policy (with template)

A template and checklist for small and medium businesses: booking rules, per diem, approvals and reimbursements.

27:T600,Fernway sign-in

Fernway sign-in

Continue to Document library

Work emailPassword

28:T563,## A genuine prompt can be for someone else's sign-in Multifactor authentication, or MFA, uses more than one kind of proof of identity. A password plus approval in an authenticator app is one example. Some authenticator requests instead start a passwordless sign-in. An unexpected prompt alone does not prove that someone knows your password. Approve only a sign-in you just started through a trusted app or site. Check that the account, app and time match. An approximate location can help you investigate, but it is not proof of who is signing in. ### Number matching Some sign-ins show a number and ask you to enter it in the authenticator. Use only the number from the trusted sign-in you started. Someone can copy or relay a number through a message or a fake page. A matching number does not make that page trustworthy. ### When you did not start it While you are cooking dinner, your bank app asks whether you are signing in. You are not, so deny the request. Repeated prompts are a reason to keep refusing, not to give in. Then open the bank app independently and check security activity or contact its support. For work, report the request through your usual IT route. Your password may be compromised, but the prompt alone cannot settle that. Denying one request does not investigate earlier access. Follow the service's recovery guidance if it finds a problem. 29:T838,## A sign-in can pass through a phishing site A relay site passes sign-in information between you and the real service. It can capture a password and relay a code or approval request. If authentication finishes, it may also steal the signed-in session, the access that keeps you logged in. Entering a password alone does not prove that MFA finished or a session was stolen. Passkeys and security keys work differently. They use site-bound authentication that resists ordinary relay through a lookalike address. A passkey lets you sign in without giving the site a reusable password. A PIN or fingerprint may unlock it locally. That does not make every page mentioning passkeys safe. ### Check who is asking for a PIN A password manager stores passwords and may store passkeys. A device-unlock PIN unlocks the manager or device locally. Do not type it into an unrelated website's form. Some managers also have their own web vaults, so follow your provider's documented sign-in process rather than assuming all PIN prompts work alike. A page can imitate a browser or device dialog. Its position, logo and colors do not prove who created it. If unsure, close the request and open your password manager yourself through its installed app or browser controls. For example, a shopping page asking you to send your phone's unlock PIN to its checkout service is no place to unlock your phone. ### Match recovery to what happened If you entered a password on the wrong site, change it through a known route, replace reused passwords, review activity and end other sessions. Report work-account exposure to IT. Do this even if you are unsure whether anyone signed in. If you completed a code or approval step there, tell IT that too, because a session may have been captured. If trusted account settings show an unfamiliar passkey or sign-in method, remove it with IT or provider guidance. Changing a password and ending sessions do not necessarily remove it. If you exposed a manager PIN, follow that provider's recovery guidance. A stolen PIN alone is not a universal way to use someone else's passkeys. 2a:T65f,Sign in - Kestrel Accounts

Kestrel

Sign in

to continue to Fernway Expenses

you@fernway.exampleEnter your password

2b:T8a4,Kestrel Accounts

Kestrel

Additional verification

Continue to Fernway Expenses

you@fernway.example

Kestrel Password Manager

Enter your password manager PIN

Send your device-unlock PIN to this page to keep your saved passkeys available.

11:["$","div",null,{"className":"flex min-h-0 flex-1 flex-col overflow-hidden","children":[["$","$L21",null,{"route":"/trainings/[slug]","context":{"trainingId":"6a3bd87e-f052-4e31-9df1-2ad7a87b0b90","trainingSlug":"account-sign-ins-and-mfa"}}],["$","div",null,{"className":"shrink-0 border-b border-ds-line bg-ds-surface py-1","children":["$","div",null,{"className":"container mx-auto px-4 text-center","children":["$","p",null,{"className":"font-copy text-type-caption text-ds-body","children":[["$","span",null,{"className":"mr-2 inline-flex items-center rounded-control border border-ds-accent-ink py-0.5 pl-1.5 pr-1 align-middle","children":["$","span",null,{"className":"font-heading uppercase text-type-eyebrow text-ds-accent-ink","children":"Beta"}]}],"This is a beta version of the platform. Features may change as we collect"," ",["$","a",null,{"href":"mailto:hello@theredguild.org","className":"font-copy text-type-caption text-ds-body underline underline-offset-2 hover:text-ds-accent-ink transition-colors","children":"your feedback"}]," ","and improve it."]}]}]}],["$","$L22",null,{"training":{"id":"6a3bd87e-f052-4e31-9df1-2ad7a87b0b90","title":"Account Sign-ins and MFA","description":"Four short scenes about where you type your password and which sign-ins you approve: a support text, a public document page, an approval request and a returned expense report.","slug":"account-sign-ins-and-mfa","category":"general-security","created_at":"2026-10-07T17:23:14.202252+00:00","created_by":"3424d5b9-9e06-45ee-9650-3e43d28084fb","updated_at":"2026-10-07T17:27:39.174559+00:00","scope":"all","tier":"free","isOpenToVisitors":true,"status":"published","allow_retake":true,"estimated_time":20,"level":"beginner","deleted_at":null,"modules":[{"id":"88d47751-1a7b-4bcb-bab1-3dd8c98797e3","title":"Where you type your password","position":0,"created_at":"2026-10-07T17:23:14.202252+00:00","updated_at":"2026-10-07T17:23:14.202252+00:00","description":"Check both the address and the expected sign-in process.","training_id":"6a3bd87e-f052-4e31-9df1-2ad7a87b0b90","sections":[{"id":"3f5ed7c1-33a4-45fb-b10f-b7e5420e4915","position":0,"module_id":"88d47751-1a7b-4bcb-bab1-3dd8c98797e3","created_at":"2026-10-07T17:23:14.202252+00:00","updated_at":"2026-10-07T17:23:14.202252+00:00","lessonId":"1c7ae5f0-f02f-42fd-8187-de851c28ef1d","quizId":null,"type":"lesson","content":{"id":"1c7ae5f0-f02f-42fd-8187-de851c28ef1d","slug":"sign-in-check-the-address","type":"text","title":"Check the address before you sign in","status":"draft","content":"$23","pdf_url":null,"category":null,"questions":[],"video_url":null,"created_at":"2026-10-07T17:22:32.708578+00:00","created_by":"3424d5b9-9e06-45ee-9650-3e43d28084fb","slides_url":null,"updated_at":"2026-10-07T17:22:32.708578+00:00","visibility":"private","description":"Check the sign-in address and use a route you already trust.","featured_image":null}},{"id":"09c46624-6814-4609-a225-c8bb2dd133e5","position":1,"module_id":"88d47751-1a7b-4bcb-bab1-3dd8c98797e3","created_at":"2026-10-07T17:23:14.202252+00:00","updated_at":"2026-10-07T17:23:14.202252+00:00","lessonId":null,"quizId":"5dce54db-1ea0-496e-ba24-a9c912dd177a","type":"quiz","content":{"id":"5dce54db-1ea0-496e-ba24-a9c912dd177a","slug":"exchange-reset-text","type":"smartphone","title":"A text from exchange support","status":"draft","content":{"scenario":{"rules":[{"id":"reset-link-opens-safari","on":"sms.link_clicked","actions":[{"type":"emit_intent","intent":"open_app","payload":{"instanceId":"safari"}},{"type":"emit_intent","intent":"focus_instance","payload":{"instanceId":"safari"}},{"type":"emit_intent","intent":"open_tab","payload":{"app":"site","url":"https://lumenexchange-secure.example/reset?case=48213","html":"$24","tabId":"reset","title":"Lumen Exchange · Reset password"}}],"condition":{"linkId":"reset-link"}},{"id":"reset-submitted","on":"messenger.link_clicked","actions":[{"type":"emit_intent","intent":"show_debrief","delayMs":500,"payload":{"body":"The simulated reset form was submitted. The page stayed open.","title":"Reset form submitted"}}],"condition":{"linkId":"reset-submit"}}],"version":1,"surfaces":[{"id":"phone","kind":"phone"}],"instances":[{"id":"sms1","app":"sms","mode":"phone-app","open":true,"config":{"sms":{"peer":{"displayName":"Lumen Exchange","phoneNumber":"+1 555 0142"},"theme":"ios","messages":[{"id":"m1","body":"Lumen Exchange: we blocked a sign-in to your account from a new device. If this was not you, reset your password within 30 minutes to keep your account active.","sentAt":"2026-10-05T08:41:00-03:00","direction":"inbound"},{"id":"m2","body":"Reset here:","links":[{"id":"reset-link","href":"https://lumenexchange-secure.example/reset?case=48213","label":"lumenexchange-secure.example/reset"}],"sentAt":"2026-10-05T08:41:00-03:00","delayMs":700,"direction":"inbound"}],"allowThemeSwitch":false}},"surfaceId":"phone"},{"id":"safari","app":"browser","dock":false,"mode":"phone-app","open":false,"config":{"browser":{"tabs":[{"id":"home","app":"site","url":"https://start.example/","html":"Start

Start page

","title":"Start"}],"theme":"ios","extensions":[],"activeTabId":"home","allowThemeSwitch":false}},"surfaceId":"phone"}]},"questions":[{"prompt":"Which site is the reset page on?","answers":[{"text":"secure.lumenexchange.example, a part of Lumen's site","isCorrect":false},{"text":"lumenexchange-secure.example, a separate site","isCorrect":false},{"text":"lumenexchange.example, the exchange's own site","isCorrect":false},{"text":"The Lumen Exchange app, opened from the text","isCorrect":false}],"explanation":"","is_multiple_choice":false},{"prompt":"Which of these would let you check the warning safely? Select all that apply.","answers":[{"text":"Open the Lumen app and look at recent sign-ins","isCorrect":false},{"text":"Reply to the text and ask for a case number","isCorrect":false},{"text":"Use the link, but look for the padlock first","isCorrect":false},{"text":"Type lumenexchange.example into the browser","isCorrect":false},{"text":"Call the number the text came from to confirm","isCorrect":false}],"explanation":"","is_multiple_choice":true},{"prompt":"Suppose this happened outside the simulator: you typed your current password into the page before noticing the address. What should you do first?","answers":[{"text":"Wait for Lumen to email you if anything changes","isCorrect":false},{"text":"Go back and enter a different new password","isCorrect":false},{"text":"Change it in the Lumen app and wherever you reuse it","isCorrect":false},{"text":"Delete the text so the link cannot be opened again","isCorrect":false}],"explanation":"","is_multiple_choice":false}]},"created_at":"2026-10-07T17:21:37.414552+00:00","updated_at":"2026-10-07T17:21:37.414552+00:00","visibility":"private","description":"A support text asks you to reset your exchange password through its link.","instructions":"You use the Lumen Exchange app on this phone, and you already know its website is lumenexchange.example. Read the text and open its link inside the simulator, then answer the questions. Do not enter real account details. To try the simulated form, leave it empty or use learner@example.invalid, DemoCurrent42! and DemoNew73!. This exercise does not reset any account."}},{"id":"b285eee2-787f-473a-a751-21168060aea0","position":2,"module_id":"88d47751-1a7b-4bcb-bab1-3dd8c98797e3","created_at":"2026-10-07T17:23:14.202252+00:00","updated_at":"2026-10-07T17:23:14.202252+00:00","lessonId":null,"quizId":"59282cef-1131-40ea-96d2-32b2bfeb86e2","type":"quiz","content":{"id":"59282cef-1131-40ea-96d2-32b2bfeb86e2","slug":"document-page-sign-in","type":"workstation","title":"A sign-in box on a public page","status":"draft","content":{"scenario":{"rules":[{"id":"result-opens-docs","on":"messenger.link_clicked","actions":[{"type":"emit_intent","intent":"open_tab","payload":{"app":"site","url":"https://docs.fernway.example/policies/travel","html":"$25","tabId":"main","title":"Travel policy · Fernway"}}],"condition":{"linkId":"result-docs"}},{"id":"docs-box-submitted","on":"messenger.link_clicked","actions":[{"type":"emit_intent","intent":"show_debrief","delayMs":500,"payload":{"body":"The simulated document-page form was submitted. The page stayed open.","title":"Sign-in box submitted"}}],"condition":{"linkId":"docs-signin"}},{"id":"sso-submitted","on":"messenger.link_clicked","actions":[{"type":"emit_intent","intent":"show_debrief","delayMs":500,"payload":{"body":"The simulated sign-in form was submitted. No account authentication was performed.","title":"Sign-in form submitted"}}],"condition":{"linkId":"sso-signin"}}],"shell":"desktop","version":1,"surfaces":[{"id":"desktop","kind":"desktop"}],"instances":[{"id":"b1","app":"browser","mode":"window","open":true,"theme":"chrome","config":{"browser":{"tabs":[{"id":"main","app":"site","url":"https://search.example/?q=fernway+travel+policy","html":"$26","title":"fernway travel policy - Seekr"},{"id":"trusted","app":"site","url":"https://login.fernway.example/?app=docs","html":"$27","title":"Saved staff sign-in"}],"theme":"chrome","extensions":[],"activeTabId":"main","allowThemeSwitch":false}},"surfaceId":"desktop"}]},"questions":[{"prompt":"Which site is the travel policy page on?","answers":[{"text":"A copy of Fernway's site on a lookalike address","isCorrect":false},{"text":"The search engine's saved preview of the page","isCorrect":false},{"text":"Fernway's sign-in site, login.fernway.example","isCorrect":false},{"text":"Fernway's own site, docs.fernway.example","isCorrect":false}],"explanation":"","is_multiple_choice":false},{"prompt":"Why should you leave the document page's password box unused?","answers":[{"text":"Search results cannot lead to pages that require staff access","isCorrect":false},{"text":"It differs from the sign-in process IT established during onboarding","isCorrect":false},{"text":"A password box must open in a separate browser window","isCorrect":false},{"text":"Public document sites cannot share a domain with company accounts","isCorrect":false}],"explanation":"","is_multiple_choice":false},{"prompt":"You leave the box unused and contact IT through your usual helpdesk. Which report gives useful evidence without exposing a secret?","answers":[{"text":"The page URL and a screenshot of its empty password box","isCorrect":false},{"text":"Your work password so IT can try the same sign-in","isCorrect":false},{"text":"Only the page title, without its address or unexpected request","isCorrect":false},{"text":"A screenshot after filling the box with your real account details","isCorrect":false}],"explanation":"","is_multiple_choice":false}]},"created_at":"2026-10-07T17:21:37.414552+00:00","updated_at":"2026-10-07T17:21:37.414552+00:00","visibility":"private","description":"A search result opens your company's public document library, which asks you to sign in.","instructions":"You work at Fernway and need the travel policy. During onboarding, IT gave you login.fernway.example as the only site where you enter your Fernway work password. The browser's Saved staff sign-in tab was opened from your established bookmark before this search. Open the first search result and inspect the page. You can leave its form untouched and switch to that saved tab. Never enter real credentials here. Optional form inputs are learner@fernway.example and DemoOnly42!."}}]},{"id":"a6b05f4d-5dfc-489d-91de-9311344bfcfb","title":"What you approve","position":1,"created_at":"2026-10-07T17:23:14.202252+00:00","updated_at":"2026-10-07T17:23:14.202252+00:00","description":"Approve only a request that matches your own trusted sign-in.","training_id":"6a3bd87e-f052-4e31-9df1-2ad7a87b0b90","sections":[{"id":"e576aa3a-2354-494b-b0ea-490f72e2061b","position":0,"module_id":"a6b05f4d-5dfc-489d-91de-9311344bfcfb","created_at":"2026-10-07T17:23:14.202252+00:00","updated_at":"2026-10-07T17:23:14.202252+00:00","lessonId":"8f83e524-7943-410d-8f9a-5e269cb0edeb","quizId":null,"type":"lesson","content":{"id":"8f83e524-7943-410d-8f9a-5e269cb0edeb","slug":"sign-in-approvals","type":"text","title":"Check the sign-in before approving","status":"draft","content":"$28","pdf_url":null,"category":null,"questions":[],"video_url":null,"created_at":"2026-10-07T17:22:32.708578+00:00","created_by":"3424d5b9-9e06-45ee-9650-3e43d28084fb","slides_url":null,"updated_at":"2026-10-07T17:22:32.708578+00:00","visibility":"private","description":"What a multifactor prompt asks, and when it is safe to say yes.","featured_image":null}},{"id":"9647abad-418c-49cd-8f4e-0996b1548740","position":1,"module_id":"a6b05f4d-5dfc-489d-91de-9311344bfcfb","created_at":"2026-10-07T17:23:14.202252+00:00","updated_at":"2026-10-07T17:23:14.202252+00:00","lessonId":null,"quizId":"40c83e02-e53a-4fd0-a157-eac2239d2d9a","type":"quiz","content":{"id":"40c83e02-e53a-4fd0-a157-eac2239d2d9a","slug":"unexpected-approval-request","type":"smartphone","title":"An approval you did not ask for","status":"draft","content":{"scenario":{"rules":[{"id":"boot-request-banner","on":"scenario.booted","actions":[{"type":"emit_intent","intent":"show_notification","payload":{"body":"Approve sign-in? Fernway · you@fernway.example","title":"Authenticator","instanceId":"auth1"}}],"delayMs":1200},{"id":"request-approved","on":"authenticator.approved","actions":[{"type":"emit_intent","intent":"show_debrief","delayMs":500,"payload":{"body":"The authenticator recorded an approval for this request.","title":"Sign-in approved"}}],"condition":{"requestId":"req-1"}},{"id":"request-denied","on":"authenticator.denied","actions":[{"type":"emit_intent","intent":"show_debrief","delayMs":500,"payload":{"body":"The authenticator recorded a denial for this request.","title":"Sign-in denied"}}],"condition":{"requestId":"req-1"}}],"version":1,"surfaces":[{"id":"phone","kind":"phone"}],"instances":[{"id":"auth1","app":"authenticator","mode":"phone-app","open":false,"config":{"authenticator":{"brand":"generic","title":"Authenticator","accounts":[{"id":"fernway","code":"204 518","issuer":"Fernway","account":"you@fernway.example","periodSec":30},{"id":"personal","code":"771 093","issuer":"Mailbox","account":"you@mailbox.example","periodSec":30}],"pendingRequest":{"id":"req-1","app":"Fernway Mail","issuer":"Fernway","account":"you@fernway.example","location":"Rotterdam, Netherlands (approximate)","requestedAt":"Just now"}}},"surfaceId":"phone"}]},"questions":[{"prompt":"Which account is the request trying to sign in to?","answers":[{"text":"Your authenticator app's own settings","isCorrect":false},{"text":"A colleague's Fernway account","isCorrect":false},{"text":"Your Fernway work account, for Fernway Mail","isCorrect":false},{"text":"A new account opened in your name","isCorrect":false}],"explanation":"","is_multiple_choice":false},{"prompt":"Which fact matters most when deciding whether to approve this request?","answers":[{"text":"You have not started any sign-in this morning","isCorrect":false},{"text":"It comes from your real authenticator app","isCorrect":false},{"text":"The request lists a location in the Netherlands","isCorrect":false},{"text":"It names your own work email address","isCorrect":false}],"explanation":"","is_multiple_choice":false},{"prompt":"Suppose you denied the request. What is the best next step?","answers":[{"text":"Report it through your usual IT route and review account activity","isCorrect":false},{"text":"Wait for another prompt before deciding whether to investigate","isCorrect":false},{"text":"Disable authenticator notifications so more requests cannot arrive","isCorrect":false},{"text":"Change your phone PIN because the request proves phone access","isCorrect":false}],"explanation":"","is_multiple_choice":false}]},"created_at":"2026-10-07T17:21:37.414552+00:00","updated_at":"2026-10-07T17:21:37.414552+00:00","visibility":"private","description":"Your authenticator asks you to approve a sign-in.","instructions":"It is Saturday morning. You are at home and have not opened your laptop or any work app today. Read the request in your authenticator, then choose Approve or Deny."}}]},{"id":"0a58696f-27d1-4205-9d61-1910043b5585","title":"When the page passes your login on","position":2,"created_at":"2026-10-07T17:23:14.202252+00:00","updated_at":"2026-10-07T17:23:14.202252+00:00","description":"Relay risks, site-bound passkeys and unexpected PIN requests.","training_id":"6a3bd87e-f052-4e31-9df1-2ad7a87b0b90","sections":[{"id":"452abb56-7d84-4584-bc7e-fe83487d1b5c","position":0,"module_id":"0a58696f-27d1-4205-9d61-1910043b5585","created_at":"2026-10-07T17:23:14.202252+00:00","updated_at":"2026-10-07T17:23:14.202252+00:00","lessonId":"973ba8f4-8ede-4e47-ab3d-0c5a7e1e1e11","quizId":null,"type":"lesson","content":{"id":"973ba8f4-8ede-4e47-ab3d-0c5a7e1e1e11","slug":"sign-in-relay-pages","type":"text","title":"When a page passes your login on","status":"draft","content":"$29","pdf_url":null,"category":null,"questions":[],"video_url":null,"created_at":"2026-10-07T17:22:32.708578+00:00","created_by":"3424d5b9-9e06-45ee-9650-3e43d28084fb","slides_url":null,"updated_at":"2026-10-07T17:22:32.708578+00:00","visibility":"private","description":"What relay sites can capture, and how to check a PIN request.","featured_image":null}},{"id":"922ba7e0-1653-4364-a0e8-3a4e1c8f418a","position":1,"module_id":"0a58696f-27d1-4205-9d61-1910043b5585","created_at":"2026-10-07T17:23:14.202252+00:00","updated_at":"2026-10-07T17:23:14.202252+00:00","lessonId":null,"quizId":"c526abdb-5f3a-4740-a992-3c85e01b5541","type":"quiz","content":{"id":"c526abdb-5f3a-4740-a992-3c85e01b5541","slug":"expense-link-pin-prompt","type":"workstation","title":"A returned expense report","status":"draft","content":{"scenario":{"rules":[{"id":"expense-link-opens-signin","on":"messenger.link_clicked","actions":[{"type":"emit_intent","intent":"open_app","payload":{"instanceId":"b1"}},{"type":"emit_intent","intent":"focus_instance","payload":{"instanceId":"b1"}},{"type":"emit_intent","intent":"open_tab","payload":{"app":"site","url":"https://expenses-fernway.example/sso/kestrel?continue=reports%2F2026-09","html":"$2a","tabId":"exp","title":"Sign in - Kestrel Accounts"}}],"condition":{"linkId":"expense-link"}},{"id":"password-opens-pin","on":"messenger.link_clicked","actions":[{"type":"emit_intent","intent":"open_tab","payload":{"app":"site","url":"https://expenses-fernway.example/sso/kestrel/verify","html":"$2b","tabId":"exp","title":"Kestrel Accounts"}}],"condition":{"linkId":"pw-next"}},{"id":"pin-submitted","on":"messenger.link_clicked","actions":[{"type":"emit_intent","intent":"show_debrief","delayMs":500,"payload":{"body":"The simulated PIN form was submitted. The page stayed open.","title":"Continue selected"}}],"condition":{"linkId":"pin-continue"}}],"shell":"desktop","version":1,"surfaces":[{"id":"desktop","kind":"desktop"}],"instances":[{"id":"chat1","app":"chat","mode":"window","open":true,"theme":"teamchat","config":{"chat":{"theme":"teamchat","channels":["general","announcements","finance-help","travel"],"messages":[{"id":"m1","body":"Hi! Your September expense report was returned because one receipt is missing. Please upload it today so the report is paid this month.","links":[{"id":"expense-link","href":"https://expenses-fernway.example/reports/2026-09","label":"expenses-fernway.example/reports/2026-09"}],"fromId":"finance","sentAt":"2026-10-05T10:05:00-03:00"}],"participants":[{"id":"self","displayName":"You"},{"id":"finance","displayName":"Fernway Finance"}],"workspaceName":"Fernway","allowThemeSwitch":false,"selfParticipantId":"self"}},"surfaceId":"desktop"},{"id":"b1","app":"browser","mode":"window","open":false,"theme":"chrome","config":{"browser":{"tabs":[{"id":"newtab","app":"site","url":"chrome://newtab","html":"New Tab","title":"New Tab"}],"theme":"chrome","extensions":[],"activeTabId":"newtab","allowThemeSwitch":false}},"surfaceId":"desktop"}]},"questions":[{"prompt":"Which site is showing the Kestrel sign-in page?","answers":[{"text":"expenses.fernway.example, your usual expense app","isCorrect":false},{"text":"accounts.kestrel.example, your known sign-in service","isCorrect":false},{"text":"expenses-fernway.example, a different site","isCorrect":false},{"text":"The Finance team's chat workspace, in a new tab","isCorrect":false}],"explanation":"","is_multiple_choice":false},{"prompt":"The next screen asks for your password manager PIN. Which check helps establish whether a prompt really comes from your manager?","answers":[{"text":"Compare its logo with the logo on the sign-in page","isCorrect":false},{"text":"Open the manager yourself through its app or browser controls","isCorrect":false},{"text":"Check that its PIN field accepts the expected number of digits","isCorrect":false},{"text":"Check whether the expense page uses an encrypted HTTPS connection","isCorrect":false}],"explanation":"","is_multiple_choice":false},{"prompt":"Suppose this happened outside the simulator: you entered your password, but no code, approval or PIN. Which response fits what you know?","answers":[{"text":"Assume a passkey was stolen and replace your phone before reporting","isCorrect":false},{"text":"Finish the PIN step so Kestrel can close the session properly","isCorrect":false},{"text":"Keep the password unchanged because no MFA approval has been given","isCorrect":false},{"text":"Use trusted settings to replace the password, end sessions and contact IT","isCorrect":false}],"explanation":"","is_multiple_choice":false}]},"created_at":"2026-10-07T17:21:37.414552+00:00","updated_at":"2026-10-07T17:21:37.414552+00:00","visibility":"private","description":"A link about your expense report leads to a sign-in, then a PIN request.","instructions":"You work at Fernway. Before this message, IT established expenses.fernway.example as your expense app and accounts.kestrel.example as its sign-in service. Read the Finance message and open its link inside the simulator. Simulator-only inspection: leave the password empty and click Next to view the PIN request. No password is required to inspect it here. Do not enter real secrets. Optional dummy inputs are DemoOnly42! for the password and 246810 for the PIN. Outside this exercise, stop rather than proceed through an untrusted sign-in."}}]}]},"backLink":{"href":"/trainings","label":"Back to Trainings"},"isPreviewMode":false,"tutorEnabled":false,"canReportProblem":false}]]}] 14:null 18:[["$","title","0",{"children":"Account Sign-ins and MFA • Phishing Dojo"}],["$","meta","1",{"name":"description","content":"Learn to identify and protect yourself from phishing attacks"}],["$","link","2",{"rel":"icon","href":"/favicon.ico?favicon.3adr5hz73_o_x.ico","sizes":"64x64","type":"image/x-icon"}],["$","link","3",{"rel":"icon","href":"/icon.png?icon.3adr5hz73_o_x.png","sizes":"64x64","type":"image/png"}],["$","link","4",{"rel":"apple-touch-icon","href":"/apple-icon.png?apple-icon.3ed4naihy3sg8.png","sizes":"180x180","type":"image/png"}],["$","$L2c","5",{}]]