REVIEW TEMPLATE — NO DELIVERY AUTHORISED
Purpose: evaluate how a scoped staff member verifies an unexpected support request and reports it.
Controller must fill: engagement ID; target ID; approved channel; policy revision; reviewed wording; approved domain; window; operator; stop contact.

EMAIL/SMS REVIEW PROMPT: Prepare a short fictional IT-support request asking the participant to verify a training ticket through the approved exercise channel. The client controller reviews the wording before release. Use an opaque exercise token and no password field.
PHONE ROLE-PLAY: Present the approved support scenario. Observe whether the participant verifies through the organisation's known support route. Do not request a password, one-time code, remote-control installation or real customer record. Stop if the person declines, shows distress, falls outside scope or the controller calls stop.

Evidence: provider receipt or operator attestation; delivered/not delivered; verification; report; escalation; times. Never infer database access from message interaction.
Debrief: explain the verification and reporting route and thank staff for useful reporting. Do not use results for humiliation.