Third-party services training: Passed Along

Third-Party Services training in a 2:33 animated story. It covers Supplier impersonation; sharing data with vendors; approved services. In English and Arabic, with captions you can switch on or off, and a scenario quiz at the end.

What your team will learn

Identify a fake supplier request for data, access or remote help (not only money), including a lookalike supplier address.
State that a forward is not a check, and check a supplier's request with the person who owns the contract, on a number you already know.
State the supplier rules: no data or access before onboarding (a contract and a security check), only what the supplier needs, only through approved services, never a personal email or a free file site.
Report an odd supplier request (the Report button for email, or your security team), even after you've checked it.

The story

“Passed Along” is the story at the heart of this course. Faisal (operations director) is the lead character; the learner watches the situation unfold, spots the warning signs, and sees the right thing to do. Set in Nakhlora Group, a fictional Gulf company.

Sample quiz question

Khalid asks Faisal to approve sending the cleaning supplier every staff name, badge number and floor. Two colleagues forwarded it before him. What should Faisal do first?

Approve it: two colleagues have already looked at it.
Ask the colleague who owns the cleaning contract first.
Reply to the supplier's email and ask if it's real.
Approve it, but only for the floors the cleaners visit.

Correct answer: Ask the colleague who owns the cleaning contract first.

Why: The person who owns the contract knows what the supplier really asked for. Replying to the email only reaches whoever sent it, and the forwards before him checked nothing.

Full transcript

Transcript of the English video. The Arabic transcript is on the Arabic page.

Passed Along [0:01] Faisal: Our suppliers keep this tower running, from the lifts to the lunch. So, welcome, every one of you… [0:09] Narrator: Four supplier messages this morning. Which one doesn't belong? [0:17] Narrator: The fourth. Fake suppliers don't only ask for money. They ask for data, access or remote help, in a real supplier's name. [0:27] Narrator: At 07:58, 'Qamar Facilities', Nakhlora's cleaning supplier, asked for every staff name, badge number and floor, for new access cards. [0:38] Narrator: Yousef forwarded it: 'They're our cleaners.' Noura: 'Looks fine.' Khalid sent it up for approval. [0:46] Narrator: Each forward borrowed the last one's trust. Nobody asked the person who owns the contract. [0:53] Narrator: One tap on Approve, and 650 names, badge numbers and floors would leave the company. [1:00] Faisal: One moment, please. Mona, you own the cleaning contract. Did Qamar ask you for a staff list? [1:07] Mona: Never heard of it. I'd have asked them first, on the number in their supplier file. [1:13] Faisal: Lamis, did Qamar send this? [1:16] Supplier: We never asked for that. And our address has a hyphen. This one doesn't. [1:24] Faisal: Then it goes straight to the security team. [1:29] Faisal: A small lesson from my phone: a forward is not a check. Ask the person who owns the contract. [1:38] Faisal: And no supplier gets our data or access before onboarding: a contract and a security check first. [1:47] Narrator: Sharing with a supplier? Only what they need, only through approved services. Never a personal email or a free file site. [1:56] Narrator: An odd supplier request? Press the Report button, or report it to your security team, even after you've checked it. [2:06] Supplier: My card. Call me before anyone sends us anything. [2:10] Faisal: Thank you, Lamis. Now, where was I? Welcome to Supplier Day. [2:16] Narrator: A supplier asks for data or access? Check with the person who owns the contract, on a number you already know.

Key facts

Length (English)	2:33
Length (Arabic)	2:58
Languages	English · العربية
Captions	WebVTT
Quiz bank	14
Questions shown	10
Pass mark	80
Lead character	Faisal — operations director
LMS id	2049