The scenario library

The seven single-call scenarios and the three help desk cover stories, with what each one tests and what counts as a failure.

A scenario is the story the caller tells and the thing it tries to get. You pick one on the Who calls step of the wizard. The attacker you created supplies the voice, the name and the opening line; the scenario supplies the rest.

A person fails when they give the caller what the scenario is after. A person passes when they refuse, verify through a channel they already trust, or end the call. Reporting the call through your report link is the best outcome of all.

​

The seven single-call scenarios

Scenario	Category	Difficulty	What it tests	What counts as a failure
Bank fraud department	Finance	Medium	Whether the person verifies their identity to a caller claiming to be the bank’s fraud team	Shared a one-time passcode; confirmed a card or account number; answered a security question
IT helpdesk password reset	IT	Easy	Whether the person trusts a “mandatory password reset” from someone claiming to be internal IT	Read back a verification code; approved an MFA prompt; disclosed their password
MFA verification / re-enrolment	IT	Hard	Whether the person reads a code to a caller running an MFA “re-enrolment”	Read back an authentication code; completed the “re-enrolment” steps
Delivery / courier re-confirmation	Logistics	Easy	Whether the person confirms personal details or pays a fee to release a held parcel	Confirmed personal details; agreed to pay a redelivery fee
Executive urgent request	Executive	Hard	Whether authority and urgency from an executive’s office push the person past their normal checks	Acted without verifying the request; shared confidential information; agreed to change a payment detail
CEO phone stolen	Executive	Hard	Whether IT wipes a phone and resets a password for a shaken, non-technical CEO calling from a borrowed phone, then offers to get past multi-factor	Agreed to wipe or lock the phone; reset the password without verifying the caller; offered to get past multi-factor; put the caller through to the CFO
CEO phone stolen (original)	Executive	Hard	The earlier version of the same story, where the CEO raises multi-factor as a worried question. Kept as a fallback	Reset the password without verifying the caller; offered to turn off multi-factor; agreed to wipe the phone; put the caller through to the CFO

What counts as a pass is the mirror image: refusing to share details, offering to call back on a known number, verifying through a known IT channel, following the escalation process, or ending the call.

A new workspace is shown three of these first: CEO phone stolen, IT helpdesk password reset and Bank fraud department.

​

The three help desk cover stories

A help desk test does not use the scenarios above. The caller rings your help desk pretending to be one of your employees, using three cover stories in turn. Each one is described in one sentence on the wizard card and in the report. The difficulty says how hard it is for a help desk agent to say no.

Cover story	Difficulty	The situation	What the caller asks for
Locked out before a client meeting	Easy	An employee is locked out of their account twenty minutes before a client meeting	A password reset; a temporary password read out over the phone; an account unlock without a callback
New phone and lost MFA	Medium	An employee has a new phone, lost the authenticator app, and cannot get past the code screen	A new device enrolled for MFA; MFA switched off; a bypass code read out over the phone
Travelling and cannot receive codes	Hard	An employee is abroad with no mobile signal for text codes and has a deadline tonight	A temporary password read out over the phone; a one-time code read out instead of texted; the second factor moved to email

The caller uses the real employee’s name, department and manager, and nothing else. It never invents personal details and never gives a real password. Each help desk call is scored on whether the agent verified the caller (callback, manager approval, ticket, identity questions, or nothing) and whether a reset was granted or a code read out. See Run a help desk test.

​

Difficulty, in plain words

Level	What it means
Easy	A common, everyday pretext. Most trained staff should catch it
Medium	Plausible and a little pressured. A good test of whether checks are followed under mild stress
Hard	Authority, urgency or a believable emergency. Tests whether checks hold when saying no feels rude

Hear a scenario before you use it. Take a test call in your browser puts you on the receiving end with nobody else called.