Phishing messages pretend to be someone you trust to get a password, money or a click. The signs: a sender address that isn't quite right, pressure or a deadline, a request for a password or payment, and a link that goes somewhere other than its text. When unsure, go to the site or person yourself.
The email says it's from school IT, and the link says school.example/login. Would you click?
Your mission: members are getting suspicious messages. Sort Ava's inbox, then make sure the club's own emails can't be mistaken for a trick.
Engage: Commit to a prediction before you test anything. A wrong guess is fine: it shows you what to look for.
Explore: Try it on the board and compare what happens with your prediction.
Explain: Put a name to what you saw, and why it works.
Elaborate: Use the idea in a new situation.
Evaluate: Look back at your first ideas and what changed.
Make your prediction first. Help opens once you've locked it in.
EngageCommit to a prediction before you test anything. A wrong guess is fine: it shows you what to look for.
Engage: where does it go?
ExploreTry it on the board and compare what happens with your prediction.
Explore: sort the inbox
Was your prediction right?
Try it yourselfYour edits are saved in this browser.
Mark every message Safe or Report. Check the links before you decide.
Use the board. This ticks when you get there.
ExplainPut a name to what you saw, and why it works.
Explain: the signs
Phishing is a message pretending to be someone you trust, to get something from you.
Worked exampleBefore each step, say what you think comes next.
who sent it?Look at the address, not just the name. A lookalike (schooI with a capital I) is a warning.
pressure?Deadlines, threats and prizes are there to make you act before you think.
what does it want?A password, a code, money or gift cards: real organisations don't ask for these by message.
where does the link go?Check it. If the text and the destination differ, don't click.
unsure?Go to the site or person yourself (type the address, use the app, ask in person).
Find the mistake
Sam gets an email. Click the line where it first goes wrong.
ElaborateUse the idea in a new situation.
Elaborate: trickier messages
Try it yourselfYour edits are saved in this browser.
A harder inbox. Mark all five correctly.
Use the board. This ticks when you get there.
ElaborateUse the idea in a new situation.
Elaborate: the club's own email
Try it yourselfYour edits are saved in this browser.
Need a hint?
Read each feature of the newsletter as if it were in Ava's inbox.
Another hint
Fix the sender, the subject, the link text and what it asks for.
The club's newsletter looks like a phish, so members ignore it. Fix every feature.
Use the board. This ticks when you get there.
EvaluateLook back at your first ideas and what changed.
Evaluate: look back
For teachers
Students sort an inbox into safe and phishing messages by checking senders, requests and where links really go, then fix the club's own newsletter so it can't be mistaken for a phish (AC9TDI8P13 node 3). A 5E mission lesson. About 40 minutes.
Try the board yourself. All senders and addresses are made up (example domains).
The one idea: phishing pretends to be someone trusted; the request and the details give it away, not the look. On real devices, pressing and holding (or hovering over) a link shows where it goes.
Unplugged: read two messages aloud, one real, one phish, and vote before revealing the address.
Running the lesson
Engage: ask who has seen a link that went somewhere unexpected.
Explore: ask which sign gave each phish away.
Explain: model checking one message aloud with the five questions.
Elaborate: ask why the parcel tracking email is safe but the fee one isn't.
Evaluate: discuss what 'go there yourself' means on a phone.
The hard part (on purpose)
Students mark everything Report to be safe. Ask them to justify each Safe too: real messages exist, and ignoring them has costs.
When students get stuck
A student trusts the display name (Sam's mistake). Ask: What's the address in the angle brackets? Fix: Names can be faked; check the address and the request.
A student marks every message Report. Ask: What would happen if Ava ignored the library or her parcel? Fix: Judge each one by the signs.
Stretch and support
Stretch: Find a real scam warning on the Scamwatch site (scamwatch.gov.au) and list which signs it shows.
Support: The five questions on a card: who, pressure, wants what, where does the link go, go there yourself.
Where it leads
Next: Your digital footprint.
What each step is for
Engage: where does it go?: Committing to where a link goes tests the new move: the words of a link and where it really goes can differ.
Explore: sort the inbox: Students sort real-looking messages, checking links, and find the signs by getting some wrong first.
Explain: the signs: The teacher models checking one message live, naming each sign. Sam trusts the display name, the misconception planted after the method.
Elaborate: trickier messages: One change: trickier messages, including a real one that looks like a phish and a phish from the right-looking address.
Elaborate: the club's own email: Reversing the process: students make a real message that can't be mistaken for a phish, using every sign in reverse.