You work the after-hours desk at a small nonprofit, from 11 PM to 7 AM. Emails, texts and sign-in prompts keep arriving, and a crew of scammers is trying to slip in among the real ones. Read each message, check where its links really go, open the headers, and verify by phone before you decide: report it, or trust it.
Four shifts teach the tricks attackers actually use: lookalike domains, fake invoices and bank changes, gift card requests, QR codes, callback scams and push bombing. The advice follows public guidance from CISA, the FTC and the FBI. Every company, person, address and phone number in the game is fictional.