Spot the phish

Classroom resources

Load these into Waypoints Prepare: choose Load URL and paste the copied address, or download the file and import it. In Prepare, the worksheet's Teacher edition shows the answers; the student copy hides them.

• Slides Download Copy address for Prepare Present from the browser, or export to PowerPoint or PDF.
• Worksheet Download Copy address for Prepare Print the student copy; the Teacher edition has the answers.

Students will be able to

• I can spot the signs of a phishing message.
• I can check where a link really goes.
• I can say what to do when I'm not sure.

Timing

Engage and Explore 12 min · Explain 8 min · Elaborate 14 min · Evaluate 6 min

Before class

Try the board yourself. All senders and addresses are made up (example domains).

The one idea: phishing pretends to be someone trusted; the request and the details give it away, not the look. On real devices, pressing and holding (or hovering over) a link shows where it goes.

Unplugged: read two messages aloud, one real, one phish, and vote before revealing the address.

Running the lesson

1. Engage: ask who has seen a link that went somewhere unexpected.
2. Explore: ask which sign gave each phish away.
3. Explain: model checking one message aloud with the five questions.
4. Elaborate: ask why the parcel tracking email is safe but the fee one isn't.
5. Evaluate: discuss what 'go there yourself' means on a phone.

The hard part (on purpose)

Students mark everything Report to be safe. Ask them to justify each Safe too: real messages exist, and ignoring them has costs.

When students get stuck

Answers to the checks

1. Engage: where does it go?: An email's link says school.example/login. Where will clicking it take you?
   Wherever it really points. The words of a link can say anything; check where it goes before you trust it.
2. Explore: sort the inbox: Mark every message Safe or Report. Check the links before you decide.
   
   Two are phishing: a prize with a countdown and a password request, and a lookalike "School IT" whose link goes somewhere else.
3. Explain: the signs: Sam gets an email. Click the line where it first goes wrong.
   line 3
   Line 3: anyone can type any name. Check the address it really came from, and whether a teacher would ever ask for gift cards (never).
4. Elaborate: trickier messages: A harder inbox. Mark all five correctly.
   
   The gift-card favour, the delivery fee and the "reply with your password" are phish; the parcel tracking and the library are real. The request, not the look, gives it away.
5. Elaborate: the club's own email: The club's newsletter looks like a phish, so members ignore it. Fix every feature.
   
   The real address, a calm subject, a link that shows where it goes, and no requests: the opposite of every phishing sign.
6. The bank text: A text from "your bank" says your card is locked and gives a link to unlock it. What's the safest move?
   Open the bank's own app or type its address yourself and check there
   Go to the real place yourself; never through the message's link.

Solutions

One possible solution for each task. Other correct programs are fine.

Elaborate: trickier messages

Open task: any program that does what the step asks.

Elaborate: the club's own email

Open task: any program that does what the step asks.

Stretch and support

Stretch: Find a real scam warning on the Scamwatch site (scamwatch.gov.au) and list which signs it shows.

Support: The five questions on a card: who, pressure, wants what, where does the link go, go there yourself.

Exit ticket

Give three signs that a message might be phishing, and what to do if you're not sure.

A wrong or lookalike address, pressure or a deadline, asking for a password, code or money, a link that goes somewhere else. Go to the site or person yourself; report it.

What each step is for

• Engage: where does it go?: Committing to where a link goes tests the new move: the words of a link and where it really goes can differ.
• Explore: sort the inbox: Students sort real-looking messages, checking links, and find the signs by getting some wrong first.
• Explain: the signs: The teacher models checking one message live, naming each sign. Sam trusts the display name, the misconception planted after the method.
• Elaborate: trickier messages: One change: trickier messages, including a real one that looks like a phish and a phish from the right-looking address.
• Elaborate: the club's own email: Reversing the process: students make a real message that can't be mistaken for a phish, using every sign in reverse.

Where it leads

Next: Your digital footprint.