---
title: "Spot the phish"
subtitle: "Cyber safety and privacy · Protect your accounts · Lesson 3"
---

# Spot the phish

**Name:** {{field-24}} **Date:** {{field-15}} **Class:** {{field-15}}

> **Key question:** The email says it's from school IT, and the link says school.example/login. Would you click?


:::teacher-note

**In one sentence:** Students sort an inbox into safe and phishing messages by checking senders, requests and where links really go, then fix the club's own newsletter so it can't be mistaken for a phish (AC9TDI8P13 node 3). A 5E mission lesson.

**Students should be able to say:** I can spot the signs of a phishing message. I can check where a link really goes. I can say what to do when I'm not sure.

**Width:** the unmarked parts are the floor every student does (Engage, Explore, Explain, Evaluate). Typical and Wider sections add contexts, not difficulty. Students work in the online tutorial alongside this sheet.

:::


## Engage


:::keep-together

**An email's link says school.example/login. Where will clicking it take you?**

☐ Nowhere until you type your password

☐ Always to school.example/login: that's what it says

☐ Wherever the link really points, which might not be school.example

☐ To your email inbox

My prediction, and why:

{{lines-3}}

:::


:::teacher-note

**What happens:** Wherever it really points. The words of a link can say anything; check where it goes before you trust it.

:::


## Explore

Try it on the board in the tutorial. Was your prediction right? What was different?

{{lines-2}}

## Explain: the signs

**Phishing** is a message pretending to be someone you trust, to get something from you.

1. $\text{who sent it?}$ — Look at the address, not just the name. A lookalike (schooI with a capital I) is a warning.
2. $\text{pressure?}$ — Deadlines, threats and prizes are there to make you act before you think.
3. $\text{what does it want?}$ — A password, a code, money or gift cards: real organisations don't ask for these by message.
4. $\text{where does the link go?}$ — Check it. If the text and the destination differ, don't click.
5. $\text{unsure?}$ — Go to the site or person yourself (type the address, use the app, ask in person).

### Find the mistake

:::keep-together

**Sam gets an email. Click the line where it first goes wrong.**

```
 1  The email says it is from Ms Lee.
 2  Ms Lee is Sam's teacher.
 3  So the email really is from Ms Lee.
 4  So Sam buys the gift cards she asked for.
```

Line: {{field-15}}

Why is it wrong?

{{lines-2}}

:::


:::teacher-note

**Answer:** line 3

Line 3: anyone can type any name. Check the address it really came from, and whether a teacher would ever ask for gift cards (never).

:::


:::typical

## Elaborate: trickier messages

:::


## Make: Elaborate: the club's own email


Work in the tutorial. Plan first: what will you change, and how will you test it?

{{box-4}}

## Exit ticket

:::keep-together

**Give three signs that a message might be phishing, and what to do if you're not sure.**

{{lines-3}}

:::


:::teacher-note

**Answer:** A wrong or lookalike address, pressure or a deadline, asking for a password, code or money, a link that goes somewhere else. Go to the site or person yourself; report it.

:::