Detect a payment-change fraud from context, and sort misinformation from disinformation

applied · 80 min · Objective 3.2

Task

Apply the whole of the content-threat lesson without generating any content. Build behaviour-based detection over a synthetic finance and identity event log and find the fraud chains the lesson describes. Write the bank-change procedure whose numbers your detector uses. Classify eleven incidents by intent and route each one, and catch your own lab chatbot producing misinformation.

Steps

  1. Write lab/make_events.py, seeded with 23, which writes lab/events.csv with header event_id,ts,actor,event_type,target,amount,detail,planted. It covers 60 days and about 3,000 events of ordinary activity across 30 invented staff and 15 invented suppliers, with event types login, invoice_paid, payee_added, bank_detail_change, mfa_reset, device_enrolled and mail_forward_rule.
  2. Plant three bec chains, each a supplier's bank details changed followed within five days by an invoice over 20,000 paid to that supplier. Plant two ato chains, each an MFA reset, then a device enrolment, then a mail forwarding rule to an external address, for one user within 24 hours. Plant one benign-change: a bank detail change whose detail records a verified call-back, paid 40 days later. Label every event in a chain in planted, and leave it empty everywhere else.
  3. Write lab/bank-change-procedure.md with the sections ## Trigger, ## Call-back, ## Waiting period, ## Dual authorisation and ## Record change control. State the waiting period in days and the payment threshold as numbers, because your detector will use the same ones.
  4. Write lab/detect_events.py, which must never read planted, with two rules from the lesson. The first flags a bank detail change followed by a payment above your threshold within your waiting period. The second flags an MFA reset followed by a device enrolment and a forwarding rule within 24 hours. Write one alert per chain to lab/event-alerts.csv with header rule,event_id,actor,target,reason, where event_id is the chain's last event.
  5. Write lab/intent-classification.csv with header id,description,class,cue,response_route and ten synthetic incidents. class is misinformation, disinformation or malinformation; response_route is correct-and-brief, incident or legal-and-comms; cue is the word in the description that decided it. Include the lesson's four examples: the forwarded fake breach notice, the chatbot that invented a refund policy, the fabricated recall video timed to move a share price, and the genuine email leaked selectively.
  6. Ask your RAG app three questions whose answers are not in your documents, through the gateway as user misinfo-test, such as the refund window for a product your FAQ does not cover. Record in lab/misinfo-test.md whether it invented an answer, and add it as the eleventh row of the classification file.
  7. Write lab/disinfo-playbook.md with the sections ## Group, ## Verified channel, ## Evidence, ## Takedown and ## Published statement, taken from the lesson's response list.

Verify

cd ~/secai-lab
python - <<'EOF'
import csv
planted = {r['event_id']: r['planted'] for r in csv.DictReader(open('lab/events.csv'))}
caught = {}
for a in csv.DictReader(open('lab/event-alerts.csv')):
    caught.setdefault(planted.get(a['event_id'], ''), []).append(a['rule'])
for p in ('bec', 'ato', 'benign-change'):
    print(p, len(caught.get(p, [])), 'alert(s)')
print('alerts on unplanted events:', len(caught.get('', [])))
classes = [r['class'] for r in csv.DictReader(open('lab/intent-classification.csv'))]
print(len(classes), 'incidents:', {c: classes.count(c) for c in sorted(set(classes))})
EOF
grep -c planted lab/detect_events.py
grep -c '^## ' lab/bank-change-procedure.md lab/disinfo-playbook.md
python -c "import json; print(sum(json.loads(l)['user'] == 'misinfo-test' for l in open('logs/gateway.jsonl')), 'misinfo-test request(s)')"

Three alerts for bec, two for ato, none for benign-change, and no alerts on unplanted events. There are eleven incidents covering all three classes, the detector does not mention planted (0), each document has five sections, and the gateway log shows at least three misinfo-test requests. An alert on benign-change means your rule ignores the verified call-back and waiting period, which is the procedure your own document just set out.

Notes

The detector saw nothing of the original request: no email, no call, no media. It found the fraud where the lesson says the harm lands, in the finance system and the identity provider. That is why this kind of detection survives better deepfakes. Your own chatbot's invented answer is a reminder that misinformation needs no attacker at all.

This is an independent study companion for CompTIA SecAI+ CY0-001 and is not produced by or endorsed by CompTIA.