(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
Identifies a spoofed sender name
Reports a suspicious text message
Identifies suspicious activity on their account
Employee uses the “Report Phish” button
Avoids sharing credentials with anyone
Avoids sending sensitive info unencrypted
Shared credentials discovered
Updates software when prompted
Deletes data they’re no longer authorized to retain
Suspicious login alert
Someone mentions “Zero trust.”
Mentions “Think before you click”
Double-checks external recipients before sending
Excessive permissions (over‑privileged access)
Recognizes a suspicious QR code
Recognizes a scam or fake offer
Quarterly access review completed
Someone says “Let’s take that offline.”
Unpatched system identified
Knows not to plug unknown USBs into devices
Firewall rule allows “ANY/ANY” traffic
Strong passphrase used (not just complex password)
Free!
Shreds documents with personal or client info
“This looks like a phishing attempt”
Pet appears on camera
Forwards unusual emails to the security team
“Shadow IT” app found
“Sorry, I was on another call.”
High-risk vendor flagged
Uses multi‑factor authentication
Uses company‑approved cloud storage
Verifies sender email address
Data not classified correctly
Someone says, “That’s a great question.”
Double-checking an external email recipient
Phishing email reported
Uses approved systems for work files
Default password still in use
“If it seems too good to be true, it probably is”
Avoids downloading unknown applications
Avoids taking photos/screenshots of client data
Sensitive data sent via unencrypted email
Reports a suspicious email
Uses secure file transfer instead of email attachment
Recognizes an “urgent” or “act now” red flag
Verifying a payment/change request via phone
Someone’s connection freezes mid‑sentence
No documented incident response plan
Vendor without recent SOC 2 report
Recognizes when someone asks for too much information
Knows the organization’s security policies exist
Using secure file transfer instead of email
Notices spelling/grammar errors in a suspicious email
“We’ll accept the risk” (without documentation 😉)
“Can you see my screen?”
“You’re on mute.”
Locks computer when stepping away
Validates payment or change requests through a second channel
Updating software when prompted
Attending a security awareness training session
Hovering over links before clicking
Slide with a lot of tiny text
Someone mentions “AI” or “Copilot.”
Public link sharing disabled on a file
Creates a strong passphrase (not just a password)
Recognizes a fake login page
Saying “If it seems too good to be true, it probably is”
