All tabletop exercises
Crisis·Starter·Mixed audience
Your brand’s social account starts promoting a crypto scam
The prompt — read this to the room
At 19:45 on a Friday your company’s main social media account, with 450,000 followers, posts a video of your CEO announcing a giveaway: send cryptocurrency and receive double back. The video is a deepfake. Three more posts follow in ten minutes, and replies show customers who have already sent money. The social media manager is locked out because the account’s email and phone number have been changed. Nobody else knows who holds the recovery codes. The platform’s support form promises a reply within 48 hours. What do you do now?
Total duration
1 h
People to involve
5
Best fit
Retail
Who to involve
Most important first.
- Communications / PR
- CISO / Head of security
- IT operations
- Legal counsel
- Customer support
What it tests
- Warn customers through channels you still control within minutes.
- Use every escalation route to recover the account, not only the public support form.
- Decide what the company owes customers who were scammed.
- Put social accounts under the same identity controls as other critical systems.
Outline of activities
- 1The scam posts go live
- 2Warning customers through other channels
- 3Getting the account back
- 4Victims, refunds and law enforcement
- 5Ownership, MFA and recovery codes
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…