Fictional exercise
A profile claims a role at a real company
Is the account contacting you authorised to represent the company? Finding a person with the same name does not attribute the account.
Method: Verify an online identity
Practice library
24 cases to practise careful verification
Practise distinguishing observation, inference and uncertainty with 24 fictional cases. Read the method and compare the documented observations.
Every case is fictional. These are teaching exercises, not client investigations, product tests or evidence about real people. The conclusion may remain unresolved: the useful output is a justified next decision.
Choose a situation and test your reasoning
Results: 24
Fictional exercise
A cropped screenshot circulates without the original message
Which material permits context review without altering the available original?
Method: Preserve digital evidence
Fictional exercise
An old subdomain appears in a public inventory
Does the organisation still own the asset, and which action follows?
Method: Audit digital exposure
Fictional exercise
A partnership file is complete except for a decisive point
Which unknown could change the decision despite many available documents?
Method: Due diligence checklist
Fictional exercise
Two detectors disagree about the same video
Does the content document the claimed event independently of detector verdicts?
Method: Verify synthetic media
Fictional exercise
An account copies an identity and contacts customers
Which actions are observed, and which recipients should be warned?
Method: Respond to online impersonation
Fictional exercise
A shop displays HTTPS and a real company’s details
Do the visible details connect this shop to the company it claims to represent?
Fictional exercise
Several articles repeat an allegation without new material
Are there independent confirmations or repetitions of one origin?
Fictional exercise
An authenticated-looking message requests an unusual document
Is the request authorised even if it appears to come from the usual account?
Method: Analyse a suspicious message
Fictional exercise
A sensitive document is accessible through a public link
What minimum evidence permits an owner alert without increasing exposure?
Method: Document a public data exposure
Fictional exercise
Two companies have similar names and share an address
Which entity contracts, and which mandate is confirmed?
Fictional exercise
Two posts appear to reverse the order of events
Do their timestamps establish the sequence of actual events?
Method: Build an OSINT timeline
Fictional exercise
Two domains use the same hosting IP
Does this technical relationship establish a shared operator?
Fictional exercise
A recruiter copies a real vacancy but requests payment
Does the recruiter have a mandate for this vacancy and request?
Method: Verify a job offer and recruiter
Fictional exercise
A review surge follows a public controversy
Which evidence supports coordination, and which competing explanations remain possible?
Method: Assess a surge of online reviews
Fictional exercise
An old PDF exposes a personal contact detail
Which exposure reduction is useful without republishing sensitive information?
Fictional exercise
A fundraising appeal reuses a recognised organisation’s photo
Did the named organisation authorise this appeal and payment route?
Fictional exercise
A supplier requests new payment details
Did the known supplier authorise the request? The company’s existence and authorisation of the change are separate questions.
Fictional exercise
A pop-up claims immediate technical support is required
Does the solicitation correspond to support actually requested by the user?
Fictional exercise
The password changed, but a forwarding rule remains active
Did recovery address the persistent access and changes actually identified?
Method: Recover a compromised account
Fictional exercise
An AI answer turns a narrow indicator into a population-wide claim
Does the citation establish that “40% of all companies experienced an intrusion in 2025”? The report and numbers below are invented for this exercise.
Fictional exercise
An archived capture displays an address and a missing document
What can be concluded about published details and the linked material?
Fictional exercise
A sanctions search returns a namesake
Does the name match identify the examined entity, and which regime is relevant?
Method: Check sanctions lists
Fictional exercise
A severe vulnerability does not match the installed product
Which priority follows from actual applicability beyond the displayed score?
Method: Prioritise a CVE vulnerability
No matching case. Use fewer words or another family.
How to use a case
- Read the question before the conclusion. Write what each observation establishes and what it leaves unknown.
- Compare your reasoning with the three evidence rows in the guide. Identify the exact unsupported inference.
- Use the source log to record your own observations and remaining questions.
Separate observation from interpretation
Match each conclusion’s certainty to the evidence available.
Scroll horizontally to read all columns.
| Criterion | What to check | Practical implication |
|---|---|---|
| Observation | Describe exactly what the source shows without assigning intent. | A link alone does not establish a contractual relationship. |
| Confidence | State unknowns and checks that would change the conclusion. | Information not found should remain unknown rather than become proof of absence. |