SYNTHETIC EXAMPLE — no real person, service or incident

Approximate time/timezone: Monday 09:15, local time (timezone not recorded)
Affected service: Delivery-notice page claiming a sign-in was needed
Device/context: Work laptop

Observed:
- Opened page: yes
- Entered password/information: no, according to Sam
- Approved unexpected MFA: no, according to Sam
- Downloaded file: unsure; Sam did not notice one
- Ran file/installed software: no, according to Sam
- Shared payment details/sent money: no, according to Sam

Facts: Sam opened a delivery link, saw a login form and closed the tab without typing. Sam did not notice a download. This does not establish whether the page was malicious or the laptop is clean.

Uncertainty: No technical device examination has happened. A download not being noticed is not the same as confirming none occurred.

Actions: Closed the page. Reported promptly through the employer's usual IT channel. Awaiting IT instructions; no cleaner from the message installed.

Later facts: If Sam remembers an installation or unexpected MFA approval, add it with the time and tell IT promptly. Do not silently replace the earlier note.

Use incident-note-template.txt for your own LOCAL copy. Do not publish a completed incident report. For money/payment exposure, contact your provider promptly using an official channel; do not delay recovery to finish a note.