---
marp: true
theme: default
html: true
---

# Spot the phish

Cyber safety and privacy · Protect your accounts

<!-- Speaker note: Students sort an inbox into safe and phishing messages by checking senders, requests and where links really go, then fix the club's own newsletter so it can't be mistaken for a phish (AC9TDI8P13 node 3). A 5E mission lesson. About 40 minutes (Engage and Explore 12 min · Explain 8 min · Elaborate 14 min · Evaluate 6 min). -->

---

## Today

**We are learning to** phishing messages pretend to be someone you trust to get a password, money or a click. The signs: a sender address that isn't quite right, pressure or a deadline, a request for a password or payment, and a link that goes somewhere other than its text. When unsure, go to the site or person yourself.

- I can spot the signs of a phishing message.
- I can check where a link really goes.
- I can say what to do when I'm not sure.

<!-- Speaker note: Before class: Try the board yourself. All senders and addresses are made up (example domains). The one idea: phishing pretends to be someone trusted; the request and the details give it away, not the look. On real devices, pressing and holding (or hovering over) a link shows where it goes. Unplugged: read two messages aloud, one real, one phish, and vote before revealing the address. Teacher: Evaluate: discuss what 'go there yourself' means on a phone. -->

---

## Why it matters

> The email says it's from school IT, and the link says school.example/login. Would you click?

<!-- Speaker note: **Your mission:** members are getting suspicious messages. Sort Ava's inbox, then make sure the club's own emails can't be mistaken for a trick. -->

---

<span style="background:#dbeafe; color:#1a1a1a; border:1.5px solid #3b82f6; padding:6px 18px; border-radius:8px; font-size:1em; font-weight:500;">💬 Discussion</span>

## Engage: predict

**An email's link says school.example/login. Where will clicking it take you?**

- Nowhere until you type your password
- Always to school.example/login: that's what it says
- Wherever the link really points, which might not be school.example
- To your email inbox

<!-- Speaker note: What happens: Wherever it really points. The words of a link can say anything; check where it goes before you trust it. Take two or three predictions before anyone runs it. -->

<!-- Speaker note: Teacher: ask who has seen a link that went somewhere unexpected. -->

---

<span style="background:#fef3c7; color:#1a1a1a; border:1.5px solid #f59e0b; padding:6px 18px; border-radius:8px; font-size:1em; font-weight:500;">✍️ Activity</span>

## Try it

{{embed: https://studio.learningwaypoints.com/tutorials/_playground-board/index.html?id=deck%2Fsystems%2Fcyber%2Fphishing%2Fstep-2&code=widget%3A+cyber%0Amode%3A+inbox%0Aset%3A+easy%0A&fresh=1}}

[Open this step in the tutorial](https://studio.learningwaypoints.com/tutorials/systems/cyber/phishing/?full=step-2#step-2)

<!-- Speaker note: Was your prediction right? -->

<!-- Speaker note: Teacher: ask which sign gave each phish away. -->

<style scoped>pre, marp-pre { font-size: 0.5em; line-height: 1.25; } section { font-size: 25px; }</style>

---

<span style="background:#dcfce7; color:#1a1a1a; border:1.5px solid #22c55e; padding:6px 18px; border-radius:8px; font-size:1em; font-weight:500;">✅ Check</span>

## What happened?

* Wherever it really points. The words of a link can say anything; check where it goes before you trust it.

<!-- Speaker note: Reveal after running. Ask who predicted it, and what made them think so. -->

---

<span style="background:#dcfce7; color:#1a1a1a; border:1.5px solid #22c55e; padding:6px 18px; border-radius:8px; font-size:1em; font-weight:500;">✅ Check</span>

## Explain: the signs

**Sam gets an email. Click the line where it first goes wrong.**

```
 1  The email says it is from Ms Lee.
 2  Ms Lee is Sam's teacher.
 3  So the email really is from Ms Lee.
 4  So Sam buys the gift cards she asked for.
```

* Answer: line 3

<!-- Speaker note: Line 3: anyone can type any name. Check the address it really came from, and whether a teacher would ever ask for gift cards (never). What this step is for: The teacher models checking one message live, naming each sign. Sam trusts the display name, the misconception planted after the method. -->

<!-- Speaker note: Teacher: model checking one message aloud with the five questions. -->

---

<span style="background:#fef3c7; color:#1a1a1a; border:1.5px solid #f59e0b; padding:6px 18px; border-radius:8px; font-size:1em; font-weight:500;">✍️ Activity</span>

## Elaborate: trickier messages

{{embed: https://studio.learningwaypoints.com/tutorials/_playground-board/index.html?id=deck%2Fsystems%2Fcyber%2Fphishing%2Fstep-4&code=widget%3A+cyber%0Amode%3A+inbox%0Aset%3A+tricky%0A&fresh=1}}

[Open this step in the tutorial](https://studio.learningwaypoints.com/tutorials/systems/cyber/phishing/?full=step-4#step-4)

<!-- Speaker note: What this step is for: One change: trickier messages, including a real one that looks like a phish and a phish from the right-looking address. -->

<!-- Speaker note: Teacher: ask why the parcel tracking email is safe but the fee one isn't. -->

<style scoped>pre, marp-pre { font-size: 0.5em; line-height: 1.25; } section { font-size: 25px; }</style>

---

<span style="background:#fef3c7; color:#1a1a1a; border:1.5px solid #f59e0b; padding:6px 18px; border-radius:8px; font-size:1em; font-weight:500;">✍️ Activity</span>

## Make: Elaborate: the club's own email



[Open this step](https://studio.learningwaypoints.com/tutorials/systems/cyber/phishing/?full=step-5#step-5)

<!-- Speaker note: What this step is for: Reversing the process: students make a real message that can't be mistaken for a phish, using every sign in reverse. Hints, in order: Read each feature of the newsletter as if it were in Ava's inbox. / Fix the sender, the subject, the link text and what it asks for. For students who need more support: The five questions on a card: who, pressure, wants what, where does the link go, go there yourself. For early finishers: Find a real scam warning on the Scamwatch site (scamwatch.gov.au) and list which signs it shows. The hard part, on purpose: Students mark everything Report to be safe. Ask them to justify each Safe too: real messages exist, and ignoring them has costs. When students get stuck: A student trusts the display name (Sam's mistake). Ask: What's the address in the angle brackets? Fix: Names can be faked; check the address and the request. / A student marks every message Report. Ask: What would happen if Ava ignored the library or her parcel? Fix: Judge each one by the signs. -->

---

<span style="background:#dcfce7; color:#1a1a1a; border:1.5px solid #22c55e; padding:6px 18px; border-radius:8px; font-size:1em; font-weight:500;">✅ Check</span>

## Exit ticket

**Give three signs that a message might be phishing, and what to do if you're not sure.**

* A wrong or lookalike address, pressure or a deadline, asking for a password, code or money, a link that goes somewhere else. Go to the site or person yourself; report it.

<!-- Speaker note: Students answer on paper or a mini whiteboard before the reveal. Anyone who cannot answer needs the main idea again next lesson. Where this leads: Next: Your digital footprint. -->