You shape the lure as a committee calendar pre-read, the sort of thing a senior risk director opens because ignoring it only makes more work later. ![[fake-committee-invite.svg|EX-05, committee pre-read invite]] The invitation is boring by design: a neutral subject line, a time window that looks like every other time window, a location that is not a location but a video link nobody really wants to click. You sweat the small details, because small details are where paranoia lives. A misplaced capital can scream fake. A too-perfect signature can scream fake. You are imitating the texture of institutional life, the way urgency hides inside politeness, the way meetings breed. People trust boredom. It rarely looks like a weapon. That is why it works. The invite is ready. Now draft the risk attestation to complete the lure: [[Risk Attestation Draft|Draft the risk attestation]]. <details> <summary>🔎 Behind the curtain: the meeting-invite lure</summary> <p>Calendar invites and "pre-read" documents are a favourite wrapper because they arrive inside tools people already trust and carry built-in pressure: a meeting you ignore becomes a problem later. The malicious part is usually a link or attachment ("agenda", "pre-read") leading to a fake login page or a booby-trapped file. It is a close cousin of business email compromise, where an attacker impersonates a trusted internal voice to make a routine-looking request.</p> <p><b>Defender's lesson:</b> hover before you click, even inside a calendar invite, and confirm unusual pre-reads through a second channel.</p> </details>