Case report
Answer in your head or on paper first, then open “Check”.
1. Which tricks did the billing notice use? (choose all that apply)
- No link: it tells you to search for yourself
- Claims you are already being charged, to rush you
- Uses her real name, phone and sleep data to win trust
- Forged to come from beatbird.app
- Carries malware in an attachment
Check
No link, a claim that she was already being charged (to rush her), and her real name, phone and sleep data (to win trust). It was not forged to come from beatbird.app: the sending domain is plainly kq3fz.idv.tw, and authentication passed for that domain. There was no attachment either.
2. What did the QR code the fake agent asked Chih-ning to scan do?
- Linked her Ripple account to the scammer’s computer
- Installed spyware on her phone
- Authorised automatic card payments
- Gave the site her Ripple password
Check
It linked her Ripple account to the scammer’s computer. The QR code decodes to ripple://link-device, Ripple’s “link a new device”. They never got her password, and nothing was installed on her phone.
3. Which two files were combined to make the scammers’ list? (choose all that apply)
- F-01 (Hengzhun Actuarial)
- F-02 (Langhua Marketing)
- F-03 (Yunshan Data)
- The 2024 GoodDeals group-buying breach
Check
F-02 (names, emails, phones) and F-03 (avg_sleep_30d). Both use the same user_hash, so joining them gives what the scam email knew. The group-buying breach leaked Chih-ning’s main address, but the scam went to an alias only BeatBird had.
4. Who leaked the data?
When you’re sure, click a name. If you’re wrong, the data protection officer will tell you.