Authentication training: Their Move

Secure Passwords & Authentication training in a 2:27 animated story. It covers MFA and passkeys; never share a one-time code; repeated login prompts. In English and Arabic, with captions you can switch on or off, and a scenario quiz at the end.

What your team will learn

State what multi-factor authentication (MFA) adds after your password, and what many sign-in prompts in a row mean.
Respond to a sign-in request you didn't start: deny it, report it, then change your password; report a mistaken Approve at once.
Refuse to give a password or code to any caller, even one who says they are IT Support or the security team.
State what a passkey removes (a prompt to approve by mistake, a code to read out), and use passkeys where your company offers them.

The story

“Their Move” is the story at the heart of this course. Faisal (operations director) is the lead character; the learner watches the situation unfold, spots the warning signs, and sees the right thing to do. Set in Nakhlora Group, a fictional Gulf company.

Sample quiz question

At 23:18, at a fuel station, Faisal's phone asks him to approve a sign-in from a new device. He isn't signing in to anything. What should he do?

Approve it, since it's probably his laptop signing in again.
Deny it, report it, then change his password right away.
Ignore it and let it time out, as nothing happens without a tap.
Deny it and drive home; a denied request needs nothing more.

Correct answer: Deny it, report it, then change his password right away.

Why: A sign-in request you didn't start means someone may have your password. Deny it, report it, then change your password: denying alone leaves them with the password, and the prompts came back.

Full transcript

Transcript of the English video. The Arabic transcript is on the Arabic page.

Their Move [0:02] Faisal: At this hour? I'm not signing in to anything. Deny. [0:07] Faisal: Again. Deny. And again... Fine. Just to make it stop. [0:14] Faisal: Wait. That wasn't me. I've just let someone in. [0:18] Narrator: Multi-factor authentication asks for a second proof after the password, so a stolen password alone isn't enough. His tap was that proof. [0:30] Faisal: Layla, it's Faisal. I've had nine sign-in prompts, and I approved the last one. It wasn't me. [0:37] Layla: Thanks for calling at once. We've ended that session. Now change your password. [0:43] Layla: Nine prompts in three minutes most likely means someone has your password. They hoped you'd tap Approve just to make it stop. [0:51] Narrator: A sign-in request you didn't start? Deny it, report it, then change your password. [0:58] Narrator: Approved one by mistake? Report it at once. Your security team can end that session. Then change your password. [1:07] Narrator: They've lost the session, and his password has changed. If you were them, what would you try next? [1:22] Intruder: Mr Al Harthy? Nakhlora IT. Read me the code we just texted you, so I can stop the prompts. [1:30] Faisal: I don't give codes to callers. I'll call security myself. [1:35] Narrator: Never give a password or code to a caller, even one who says they're IT Support or the security team. [1:44] Layla: You hung up? Good. That code would have let them reset your password and lock you out. [1:51] Layla: Passkeys sign you in with your own device and its screen lock. Nothing to approve by mistake, no code to read out. [2:00] Narrator: Where your company offers passkeys, set one up and use it. [2:05] Faisal: Then that's my next move. Thank you, Layla. [2:13] Narrator: One habit: a sign-in request you didn't start? Deny it, report it, then change your password. Never give a code to anyone.

Key facts

Length (English)	2:27
Length (Arabic)	2:49
Languages	English · العربية
Captions	WebVTT
Quiz bank	14
Questions shown	10
Pass mark	80
Lead character	Faisal — operations director
LMS id	2067