Carl is a financial assistant in a small business. He receives an unexpected email from the owner of the business. It reads:

How should Carl respond?

He should reply and ask the sender for more information.

Incorrect. He shouldn’t reply, because if the email is fraudulent, he will be replying to the criminal. He should phone Martin to check the email is real, using the contact details he has on file.

Phone to verify the email is real using a contact number for Martin that he has on file.

Correct. Always phone to check an email like this is legitimate, and make sure you use the contact details you have on file, not the ones in the email itself, which will most likely be fake.