General Security Awareness - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.

1. Avoids taking photos/screenshots of client data
2. Unpatched system identified
3. Saying “If it seems too good to be true, it probably is”
4. Someone says “Let’s take that offline.”
5. Uses multi‑factor authentication
6. Knows not to plug unknown USBs into devices
7. Locks computer when stepping away
8. Knows how to report an incident
9. Using secure file transfer instead of email
10. High-risk vendor flagged
11. Completes annual security training
12. Verifies sender email address
13. Someone mentions “AI” or “Copilot.”
14. Public link sharing disabled on a file
15. Creates a strong passphrase (not just a password)
16. Forwards unusual emails to the security team
17. Excessive permissions (over‑privileged access)
18. Avoids downloading unknown applications
19. Data not classified correctly
20. Recognizes an “urgent” or “act now” red flag
21. Shreds documents with personal or client info
22. Free!
23. Double-checks external recipients before sending
24. “This looks like a phishing attempt”
25. Identifies suspicious activity on their account
26. Strong passphrase used (not just complex password)
27. Uses only approved tools for work
28. Attending a security awareness training session
29. Deletes unexpected attachments
30. Double-checking an external email recipient
31. Multi-factor authentication (MFA) enabled
32. Shared credentials discovered
33. Notices spelling/grammar errors in a suspicious email
34. Recognizes when someone asks for too much information
35. Someone says, “That’s a great question.”
36. Validates payment or change requests through a second channel
37. Phishing email reported
38. Recognizes a suspicious QR code
39. No documented incident response plan
40. Firewall rule allows “ANY/ANY” traffic
41. Reports a suspicious text message
42. Stores sensitive files securely
43. “If it seems too good to be true, it probably is”
44. Employee uses the “Report Phish” button
45. Missing BAA for a PHI‑handling vendor
46. Computer screen locked when away
47. “You’re on mute.”
48. Uses secure file transfer instead of email attachment
49. Updating software when prompted
50. Recognizes a scam or fake offer
51. Suspicious login alert
52. Deletes data they’re no longer authorized to retain
53. Reports a suspicious email
54. Knows the organization’s security policies exist
55. Vendor without recent SOC 2 report
56. Uses company‑approved cloud storage
57. Quarterly access review completed
58. USB stick plugged into a corporate laptop
59. Reporting a lost or stolen device
60. Hovering over links before clicking
61. Pet appears on camera
62. Someone mentions “Zero trust.”
63. Avoids sending sensitive info unencrypted
64. Recognizes a fake login page
65. Verifying a payment/change request via phone
66. Avoids public Wi‑Fi for work tasks
67. Uses approved systems for work files
68. “We’ll accept the risk” (without documentation 😉)
69. Missing evidence for an audit test
70. Identifies a spoofed sender name
71. Sensitive data sent via unencrypted email
72. “Shadow IT” app found
73. Slide with a lot of tiny text
74. Mentions “Think before you click”
75. Avoids sharing credentials with anyone
76. “Sorry, I was on another call.”
77. Someone’s connection freezes mid‑sentence
78. Default password still in use
79. “Can you see my screen?”
80. Updates software when prompted
81. Declines to share information over the phone