Imagine you’re a social media manager for a major airline. You’re scanning your @-mentions to respond to angry customers, help potential passengers book their tickets with you, and thank users for compliments.

Then you see this:

@AmericanAir hello my name's Ibrahim and I'm from Afghanistan. I'm part of Al Qaida and on June 1st I'm gonna do something really big bye

It actually happened this weekend. A teenage girl, apparently in need of something to do, Tweeted the message at the airline. In a reply that has since been deleted, American replied and said the girl’s IP address and “details” would be forwarded to the FBI. Cue a panicked response from the girl, who feared her parents would take away her Twitter account if the feds showed up. Let’s hope they do.

But what about American Airlines’ response on social media? What did it do right, and what could the company have done better?

Done right: Reply quickly.
According to the screengrabs, American replied less than 10 minutes after the original message was sent. Being active and ready to respond is important.

Could do better: Be accurate.
The only problem with American’s speedy response? It’s inaccurate. A Twitter spokesperson told the New York Post that only the federal government can request data for individual Twitter users.

Done right: Show your customers you’re paying attention.
Replying publicly to the threat was a smart strategy for American Airlines. While many people likely didn’t see the original message, having the company reply in public with a promise to get to the bottom of the message makes customers feel like safety is a priority for the airline.

Could do better: Plan for the worst.
While Tweeting authoritatively when threatened may reassure customers, seeing the Tweet deleted because your brand can’t actually do what it claimed undoes all that goodwill. American Airlines should use this opportunity to create messaging for its social channels so managers are ready to reply to threats or ominous messages.

It’s likely American could alert the authorities to pull the data it said it was forwarding, which is a small difference in language that makes a huge difference in meaning. American Airlines should take this opportunity to pull together a crisis plan around social media threats—from the language it uses to reply to a procedure for sharing that information with the relevant authorities—in case the next time it’s not a drill.