Presenter Notes

BEFORE

Checklist

Deck: notes.kadi.uno/slides/ in Chrome on the laptop. Press P for presenter view, then Open audience window, drag it to the projector, press F in it. → next, ← back, from either window.
Quiz host open: quiz.kadi.uno/host (key: secret get quiz_kadi_host_key). Press New game after any rehearsal.
Ask Cocoa Marketing IT: reporting contact for slide 10, and whether guest Wi-Fi works for 100+ phones.
Confirm the CSA licence number on slide 8 (old certificate ran to 9 July 2026).
Know your Proofpoint offer before slide 12 (pilot length, price, who to contact).

Three messages if you remember nothing else: Hackers log in, they don't break in · Verify on a number you already have · Report early, nobody gets in trouble for reporting.

Cybersecurity starts with you

1 min · 0:00

Good morning. I'm Elom Kutsienyo from Apotica. No jargon, no IT lecture. In 45 minutes you'll know how criminals trick people like us, and what to do about it.

And there's a quiz at the end with a leaderboard, so keep your phones charged. This is the one meeting where I'm asking you to take your phone out.

Remember: October is Cybersecurity Awareness Month. Land the line: "Hackers don't break in. They log in."

Monday, 8:02 am (Ama's story)

3 min · 1:00

Tell it as a story, click by click. Pause before Friday.

Mon 08:02: "buyer" in Amsterdam emails new bank details, quotes the real contract
Mon 08:15: Ama checks, all looks right, passes to Payments
Wed 14:30: GHS 7.8 million leaves the account
Fri 10:00: real buyer calls, "Where is our money?"

Ask: "Hands up, who would have caught it?"

Ask: "What happens if your department loses email and files for two days?"

Remember: "Nobody hacked a server. Somebody sent an email." The criminal had been reading the buyer's mailbox for weeks. Promise: "We'll give Ama a better ending later."

More examples

Real2024, Hong Kong: a finance worker at the engineering firm Arup paid out about US$25 million after a video call where every "colleague", including the CFO, was a deepfake.
Why us: Cocoa Marketing moves cocoa, contracts and money to buyers in the Netherlands, the US, Japan, Malaysia and beyond. Big, regular international payments are exactly what criminals look for.

Hackers don't break in. They log in.

2 min · 4:00

Four doors, one click each: Email · WhatsApp & SMS · Phone calls · Devices. Then the MoMo joke.

Remember the 4 threats in one breath: phishing (fake messages), account takeover (someone logs in as you), ransomware (files locked, money demanded), payment fraud (money sent to the wrong place).

Joke: "Chale, I sent GHS 500 to your MoMo by mistake, please send it back." Check your balance first. It's never there.

More examples

Real2021, Colonial Pipeline (USA): one leaked password on an old VPN account with no MFA led to ransomware, a fuel shortage across the US East Coast, and a ransom of about US$4.4 million.
GhanaSIM swap: a criminal convinces the network to move your number to their SIM, then receives your MoMo and bank codes.
GhanaFake "GRA tax refund" or "Ghana Card update" SMS with a link.
QR code phishing: a fake QR sticker on a poster or invoice that opens a login page.

Spot the fake

4 min · 6:00

Ask: "Who would click?" Then: "Find me one thing wrong." Reveal each flag as the room finds it.

Look-alike sender: cocoamarketlng (an L, not an I). Read it slowly.
Panic + deadline: 2 hours, GHS 45,000 a day
.pdf.html is not a PDF
Asks for your password: documents never need your login

Remember: a correct logo, a real vessel name and a real port prove nothing. Verify on a number you already have, never the one in the email.

Joke: A look-alike domain costs about the price of a plate of waakye a month.

More examples

Hover (or long-press on a phone) over a link to see where it really goes before you tap.
"Your mailbox is 98% full, click to keep your emails." Classic. Real IT doesn't email you a login link.
Fake DHL / FedEx "parcel held at customs, pay GHS 35 fee".

"Hi, it's your MD."

4 min · 10:00

Read the WhatsApp chat aloud in a "boss voice".

New number + real photo (copied from LinkedIn)
"In a meeting, can't talk" (so you can't check)
GHS 3,000 MTN airtime + samples by DHL to Houston
"Keep it between us" (secrecy is the giveaway)

Ask: "The voice note sounds exactly like him. Is it him?" → You can't know. AI can copy a voice from a short clip.

Remember: STOP → VERIFY → ACT. No real MD is upset that you checked. A real criminal is very upset.

More examples

Real2023, MGM Resorts (Las Vegas): attackers found an employee on LinkedIn, called the IT help desk pretending to be them, got access. Casinos and hotels were disrupted for days; MGM put the cost at around US$100 million.
"I've changed my number, save this one" from a "relative", followed a day later by a money request.
Fake "bank" call: "We've blocked a suspicious transaction, read me the code to reverse it."

Passwords & MFA

3 min · 14:00

Your password is a toothbrush: don't share it, change it when IT asks, and don't leave it lying around.

GodIsGood1: God is good. This password is not.
Cocoa2026!: first thing a criminal tries here
kente-trotro-mango-rain: long, odd, easy to remember

Remember: the 2 am MFA trap. If you didn't try to log in: Deny and report. Real IT never asks for your password or your code. Never reuse your work password on other sites.

More examples

Why reuse matters: a shop or social site gets breached, criminals try the same email + password on work email. One leak opens every door.
Sticky note under the keyboard: "the first place a thief looks, right after the drawer."
If asked "how often should I change it?": length, uniqueness and MFA matter more than changing every month. Change it immediately if it might be exposed, or when IT asks.

What are we protecting?

3 min · 17:00

Click through: People · Contracts · Money · Operations, then the law, then the AI joke.

Ask: "Which of these would hurt most on a WhatsApp group?" (Salaries usually wins.)

Remember: Data Protection Act, 2012 (Act 843), enforced by the Data Protection Commission: collect for a real purpose, keep it secure, share only with authorised people. Golden rule: only access and share what your job needs.

Joke: Pasting a contract into a public AI chatbot is like reading it aloud in the arrivals hall at Kotoka.

More examples

Staff list with Ghana Card numbers forwarded to a personal Gmail "to work on at home".
Pricing spreadsheet shared with "anyone with the link" by mistake.
Don't go deep into law. Staff need the habit, not the section numbers.

The CSA: Ghana's cyber regulator

3 min · 20:00

Cybersecurity in Ghana is now regulated, not optional.

Cyber Security Authority, set up by the Cybersecurity Act, 2020 (Act 1038)
Strict enforcement of licensing and accreditation since 31 January 2026
Providers licensed: Apotica is a CSA-licensed Cybersecurity Service Provider (Managed Cybersecurity Services)
IT teams accredited: Cybersecurity Establishments + Cybersecurity Professionals. Cocoa Marketing's IT team is part of this national framework.
Incidents reported: critical infrastructure within 24 hours

Remember: staff report work incidents to Cocoa Marketing IT, who handle the regulator. Personal fraud (MoMo, social media): CSA 292 (call/text, toll-free) · WhatsApp 0501603111.

Only state accreditation facts about their IT team that they've confirmed.

Small habits, big difference

3 min · 23:00

One line per card, one laugh per card. Go quickly.

Lock your screen (Windows + L) or a colleague sends "Lunch is on me today!" to all staff
Car-park USB "Staff Salaries 2026": curiosity infects the network. Hand it to IT.
No personal Gmail for work files
Approved tools only: "free" often means you are the product
Public Wi-Fi: VPN or phone hotspot
Clear the printer: contracts left there have legs

Remember: where the company has a specific rule (USB, personal phones, remote access), their policy wins. Hand policy questions to Cocoa Marketing IT.

"Oops, I clicked." Now what?

3 min · 26:00

Recognise → Stop → Report → Keep evidence → Follow IT

Ask: "You typed your password into a page and one second later realised it was fake. What do you do?" → Call IT now, not Monday.

Remember: "The first 15 minutes matter more than the next 15 days." "Nobody gets in trouble for reporting. Hiding it is the only mistake." Say the IT contact out loud.

IT would rather get 100 false alarms than miss one real fire.

Back to Ama

3 min · 29:00

Let the room shout A, B or C.

A Pay: no
B Reply to confirm: no, it goes straight back to the criminal
C Call the buyer on the number already on file + follow approvals

Remember: "That call costs GHS 0. Not making it cost GHS 7.8 million." This is called Business Email Compromise (BEC). The email can come from the buyer's real address if their mailbox was hacked, so checking the address isn't enough.

Controls that save Ama

Call back on a known number
Two people approve any bank-detail change
Extra suspicion when "urgent" meets "new account"

Habits need practice (Proofpoint)

3 min · 32:00

Today you learned the tricks. Will you remember them on a busy Tuesday in March? You don't learn evacuation from one fire-drill talk.

Safe phishing drills: click one, get a 2-minute lesson, not a penalty
Built from real attacks (Proofpoint calls it ThreatFlip)
Short, by role: finance, shipping, executives
Measured: click and report rates per department

Remember: keep it human, not salesy. The offer: baseline phishing test → training → re-test, so they see the improvement in numbers. Details through their IT after the session.

Protect the C.O.C.O.A.

2 min · 35:00

C	Check before you click
O	One password per account, plus MFA
C	Confirm unusual requests on a known number
O	Only share with authorised people
A	Alert IT immediately

Do: call out the letter, the room shouts the word ("C?" "CHECK!"). Close: "Cocoa Marketing protects Ghana's cocoa. Today, you protect Cocoa Marketing's C.O.C.O.A." Then: "Let's see who was listening."

Live quiz

7 min · 37:00

Switch the projector to quiz.kadi.uno/host. Give 60 seconds to join. Space / Next moves everything on.

1	2 am MFA prompt → A · Deny and report
2	Amsterdam bank change → D · Call on the number on file
3	cocoamarketlng → C · Look-alike domain
4	Strongest password → B · kente-trotro-mango-rain
5	"MD" airtime → C · Call the MD on the known number
6	Car-park USB → A · Hand it to IT unplugged
7	"IT" asks for the code → B · Hang up, call IT
8	Typed password on fake page → D · Report to IT immediately
9	Contract into public AI → B · Only approved AI tools
10	Ghana's cyber regulator → B · CSA

Remember: after each answer, read the one-line "why" on screen. If the Wi-Fi fails, run the same questions as a show of hands.

Thank you → Questions

1 min · 44:00

What have you seen? A strange email, a WhatsApp from "the MD", a call from "IT"? Let's talk about it.

If the room is quiet: "If you get a WhatsApp from someone claiming to be your manager, how would you check it's really them?"

Q&A

Likely questions

Can I use WhatsApp for work?

Follow company policy. Never put confidential documents in personal groups, and verify any request that arrives there.

Can I read work email on my personal phone?

Only if the company allows it. Lock the phone, keep it updated, don't share it. Policy question → Cocoa Marketing IT.

I clicked a link but nothing happened. Do I still report?

Yes. "Nothing happened" is often exactly what malware looks like.

How do I know a link is safe?

Hover or long-press to see the real address. When in doubt, don't click: type the site's address yourself.

Is ChatGPT banned?

That's company policy, ask IT. Either way: never paste confidential or personal data into a public AI tool.

Doesn't antivirus protect us?

It helps, but it can't stop you from willingly typing your password or sending money. That's why people matter.

How often should I change my password?

Make it long and unique, turn on MFA, and change it right away if it may be exposed or IT asks.

My personal MoMo was scammed. What do I do?

Call your network immediately to block the transaction, then report to the CSA on 292 or WhatsApp 0501603111, and the police.

Is Apotica allowed to do this work?

Yes: Apotica is licensed by the Cyber Security Authority as a Cybersecurity Service Provider.