M Meridian Logistics · workspace

Seven conversations are waiting in your workspace, and not all of them are what they seem.

You’re back at your desk after lunch. A shipment slipped, someone shared a doc, IT posted something. Ordinary — except a couple of these aren’t from who they appear to be.

Open each thread, read it the way you normally would, and decide: a normal message, or someone fishing. You’ll see the reasoning after every call.

Pick a conversation on the left to begin

🛡️

—

01

A login or code request is the tell

Being asked to re-log-in, "re-authenticate", verify an account, approve a push or hand over a 2FA code through a chat link is almost always the attack — in any channel, from any name.

02

A name is not proof

Display names, "CFO", even accounts with no external badge can be spoofed or compromised. Trust the request, not the label. Urgent + secret + skip-the-process is a pattern, not a coincidence.

03

Verify on a second channel

Anything unusual — money, data, access — gets confirmed through something you already control: a known number, a ticket you open, the IT channel you already use. Never the link in front of you.