Phishing Email Investigation | AP Cybersecurity

Group Name (required before export)

No group name saved yet

Briefing: Psychological Tactics in Social Engineering

Your group has been given five sample emails recovered from a corporate inbox at Meridian Financial Group. Attackers rarely rely on technical exploits alone — they exploit human behavior. For each email, inspect the sender headers, examine the domain for spelling or structural tricks, and check where any hyperlink actually leads before you decide whether the message is legitimate.

UrgencyPressures quick action before the target can think it through.

IntimidationUses fear of punishment or loss to force compliance.

TrustMimics a familiar brand, coworker, or process to lower suspicion.

CuriosityDangles unexpected or incomplete information to bait a click.

AuthorityImpersonates a boss, executive, or official department.

PretextA fabricated story used to justify the request.

CASE 2027-1B-01

Email 1 — "IT Support: Urgent Password Reset"

Recovered from: mgarza@meridianfinancial.com inbox

Low-Moderate Risk Read

From	IT Support Desk <itsupport@meridianfinancial-helpdesk.com>
Reply-To	noreply@secure-mailer-relay.ru
To	mgarza@meridianfinancial.com
Subject	URGENT: Your password expires in 2 hours — action required

Dear Employee, Our records show that your network password will EXPIRE in 2 hours. To avoid being locked out of your email and payroll systems, you must verify your credentials immediately using the secure link below. Failure to act within 2 hours will result in suspension of your account access. IT Support Desk Meridian Financial Group

Displayed link text:Reset Password Now

Actual destination URL:http://meridian-financia1support.net/reset-credentials

Q1Sender Address Analysis — What is suspicious or inconsistent about the From and Reply-To addresses?

Q2Domain Analysis — Compare the sending domain to Meridian Financial's real domain (meridianfinancial.com). What specifically was altered?

Q3Hyperlink Analysis — Does the displayed link text match its actual destination? What does the destination domain suggest?

Psychological tactics present (select all that apply)

Q4Justify your tactic selections using specific evidence from the message.

CASE 2027-1B-02

Email 2 — "Package Delivery Failed"

Recovered from: mgarza@meridianfinancial.com personal-forward inbox

Low Risk Read

From	USA Package Delivery <delivery@usppost-tracking.com>
Reply-To	delivery@usppost-tracking.com
To	mgarza@meridianfinancial.com
Subject	Delivery attempt failed — action required

We attempted to deliver your package today but were unable to complete delivery. Your item is being held at our facility. To reschedule delivery and avoid your package being returned to sender, please confirm your details using the link below within 24 hours. Thank you for choosing USA Package Delivery.

Displayed link text:Track & Reschedule My Package

Actual destination URL:http://tracking-usps-status.info/confirm?id=8841

Q1Sender Address Analysis — Does "USA Package Delivery" match any real carrier's known domain? What's missing (no specific carrier name, no tracking number)?

Q2Domain Analysis — What is unusual about the domain "usppost-tracking.com" and the link destination "tracking-usps-status.info"?

Q3Hyperlink Analysis — Why might an attacker use a generic, non-specific message like this instead of naming a real courier?

Psychological tactics present (select all that apply)

Q4Justify your tactic selections using specific evidence from the message.

CASE 2027-1B-03

Email 3 — "CEO Request: Need a Favor"

Recovered from: mgarza@meridianfinancial.com inbox

Moderate-High Risk Read

From	David Whitfield <dwhitfield.ceo@gmail.com>
Reply-To	dwhitfield.ceo@gmail.com
To	mgarza@meridianfinancial.com
Subject	Quick favor — need this handled today

Maria, I'm stuck in back-to-back board meetings and can't take calls right now. I need you to pick up 5 Amazon gift cards ($200 each) for a client appreciation gift before the meeting ends today. Send me the card codes as soon as you have them — I'll reimburse you Monday. Please keep this between us for now, I want it to be a surprise for the team. Thanks, David CEO, Meridian Financial Group

No hyperlinks are present in this message.

Q1Sender Address Analysis — David Whitfield is the real CEO of Meridian Financial. Does this address match what a CEO's real corporate account should look like?

Q2Domain Analysis — This email uses a free public email domain instead of @meridianfinancial.com. Why is that a major red flag for a message claiming to be from a company executive?

Q3No Hyperlink Present — This email has no link to inspect. Instead, analyze the request itself: what makes buying untraceable gift cards and reporting the codes by email a suspicious ask?

Psychological tactics present (select all that apply)

Q4Justify your tactic selections using specific evidence from the message.

CASE 2027-1B-04

Email 4 — "Your Benefits Enrollment is Ending"

Recovered from: mgarza@meridianfinancial.com inbox

High Risk Read

From	Meridian Benefits Team <benefits@meridianfinancial.com>
Reply-To	hr-support@meridianf1nancial-benefits.com
To	mgarza@meridianfinancial.com
Subject	Action needed: Benefits enrollment window closes Friday

Hello, This is a reminder that open enrollment for your 2027 health and retirement benefits closes this Friday at 5:00 PM. If you do not complete your enrollment, you may lose your current coverage or default to the lowest-tier plan. Please log in and confirm your selections before the deadline. Meridian Benefits Team Human Resources

Displayed link text:Enroll Now

Actual destination URL:https://benefits-enroll.meridianfinancial.co/login

Q1Sender Address Analysis — The From address looks correct. What's different about the Reply-To address, and why is checking Reply-To important even when From looks legitimate?

Q2Domain Analysis — Look closely at "meridianf1nancial-benefits.com." What character was swapped, and how does that trick the eye?

Q3Hyperlink Analysis — The link destination uses "meridianfinancial.co" instead of "meridianfinancial.com." Why is a single-letter top-level domain change like this effective and hard to notice on a phone?

Psychological tactics present (select all that apply)

Q4Justify your tactic selections using specific evidence from the message.

CASE 2027-1B-05

Email 5 — "Security Alert: Unusual Sign-in Attempt"

Recovered from: mgarza@meridianfinancial.com inbox

Highest Risk Read

From	Meridian Security <security-noreply@meridianfinancial.com>
Return-Path	bounce@mailrelay-xyz123.top
To	mgarza@meridianfinancial.com
Subject	Security Alert: We noticed an unusual sign-in attempt

We detected a sign-in attempt to your Meridian Financial account from an unrecognized device in a location that doesn't match your usual activity. If this wasn't you, your account may be compromised. Verify your identity immediately to secure your account and review recent activity. If you don't recognize this activity, please act now — delaying verification may allow the sign-in attempt to be automatically approved after 30 minutes. Meridian Security Team

Displayed link text:Verify My Account

Actual destination URL:https://meridianfinancial.account-verify-secure.com/login

Q1Sender Address Analysis — The From address appears to be a perfect match. What header field reveals a problem, and what does the Return-Path field actually tell you?

Q2Domain Analysis — In the link "meridianfinancial.account-verify-secure.com," which part is the actual domain being visited, and which part is just a subdomain made to look reassuring?

Q3Hyperlink Analysis — Why is this the most convincing email of the five, and what single habit would let someone catch it anyway?

Psychological tactics present (select all that apply)

Q4Justify your tactic selections using specific evidence from the message.

CASE 2027-1B-06

Group Ranking — Least to Most Convincing

As a group, rank all five emails using the evidence you gathered above.

Assign each email a unique rank from 1 (least convincing / easiest to catch) to 5 (most convincing / hardest to catch). Ranks must not repeat.

⚠ Two or more emails currently share the same rank. Each rank (1–5) must be used exactly once.

Email	Rank (1–5)
Email 1 — IT Support: Urgent Password Reset
Email 2 — Package Delivery Failed
Email 3 — CEO Request: Need a Favor
Email 4 — Benefits Enrollment is Ending
Email 5 — Security Alert: Unusual Sign-in Attempt

Q1Ranking Justification — Explain your group's ranking order. Cite specific evidence (headers, domain tricks, link destinations, tactics) from each email to support the placement.

CASE 2027-1B-07

Exit Ticket

Individual reflection — reproduced from the Day 2 lesson plan.

Complete individually, even though you worked in a group above.

1What is a credential?

2Why do attackers create urgency?

3Identify one indicator of a phishing email.

4Define authentication.

5What psychological tactic do you think is most effective and why?

Submit Your Group's Report

Make sure your Group Name is entered at the top of the page.
Confirm every case shows a green checkmark in the sidebar.
Click Export PDF below, then choose Save as PDF in the print dialog.
Upload the saved PDF to the assignment on Schoology.