English:Recognising Scams and Phishing
Recognising Scams and Phishing
Introduction
Scams are tricks designed to make people give away money, information, passwords, access to an account, or something else of value. A scammer may pretend to be a person, company, game, school, bank, delivery service, or website that you know.
Phishing is a type of scam that uses messages or websites to "fish" for information. A phishing message may arrive by email, text message, chat, social media, or another digital service. It often tries to make you click a link, open a file, send money, or share private information.
You do not need to become a computer expert to protect yourself. A strong first response is simple: stop, check, ask, and report.
The image above is a fictional phishing email made to show common warning signs. When you study a suspicious message, look at the whole message rather than just one clue.
This Google for Education video introduces ways students can recognise phishing and scams.
Learning Goals
By the end of this aiMOOC, you should be able to:
- Phishing: Explain what phishing is and how it is different from an ordinary message.
- Online safety: Recognise common warning signs in emails, texts, chats, websites, and online offers.
- Personal information: Identify information that should be protected.
- Critical thinking: Pause and check a surprising or urgent message before acting.
- Cybersecurity: Use safe actions such as reporting suspicious messages and protecting accounts.
- Digital citizenship: Help classmates and family members respond calmly and safely to possible scams.
What Is a Scam?
A scam is a dishonest plan that tries to trick someone. The story may change, but the scammer usually wants you to do something that benefits the scammer.
For example, a message might claim that you have won a prize, that your game account will be closed, that a parcel cannot be delivered, or that a friend needs emergency help. The message may look exciting, frightening, or urgent on purpose. Strong feelings can make people act quickly.
A useful question is: What is this message trying to make me do?
Scammers may try to get:
- Passwords: Secret words or phrases used to enter accounts.
- Personal information: Your full name, home address, birthday, school details, phone number, or other identifying information.
- Financial information: Card details, bank details, gift-card codes, or payment information.
- Account access: Login codes, verification codes, or permission to control a device.
- Money: Payments for fake prizes, fake fees, fake emergencies, or fake products.
A scam can target anyone. Being careful is a skill, not a test of intelligence.
Spam Is Not Always a Scam
Spam means unwanted messages, often sent to many people. Some spam is only advertising. Some spam contains scams or phishing links. That means not every unwanted message is phishing, but unwanted messages should still be treated carefully.
If you are unsure, do not click a link just to investigate. Use a safer way to check.
What Is Phishing?
Phishing is a scam in which someone pretends to be trustworthy so that you will reveal information, open a harmful file, visit a fake website, or take another unsafe action.
The pretend identity is called impersonation. A scammer may copy a logo, profile picture, colour scheme, or writing style. These details can make a fake message look real at first glance.
A polished message can still be fake. A badly written message can be fake too. Spelling mistakes are one possible warning sign, but they are not a perfect test.
This CISA animation shows a simple way to think about recognising and reporting phishing.
Phishing Can Arrive in Different Ways
Phishing does not happen only through email.
Email phishing uses an email message. It may pretend to come from a school, game company, shop, streaming service, or other organisation.
Smishing is phishing by text message or SMS. A common example is a fake parcel message that asks you to follow a link.
Vishing is voice phishing. A caller may pretend to be from a company or may claim that something terrible will happen unless you act immediately.
Social media and game scams can appear in direct messages, comments, group chats, fake giveaways, or offers for free items, coins, skins, or upgrades.
Fake websites may copy the look of a real login page. Their goal may be to collect your username and password.
QR-code scams can use a printed or digital QR code that leads to an unsafe website. A QR code is only another way of opening a link, so you should still check where it leads.
The Main Warning Signs
No single warning sign proves that a message is a scam. Instead, look for several clues together.
Urgency and Pressure
Scammers often want you to act before you think. Watch for messages such as:
"Act now."
"Your account will be deleted today."
"Pay immediately."
"Do not tell anyone."
"You have only ten minutes."
A real organisation may sometimes have deadlines, but you can still stop and check the request through a trusted route.
Surprising Rewards or Threats
Be careful when a message promises something amazing or threatens something frightening.
Examples include a prize you did not enter, free game currency, a new phone for a tiny fee, a sudden account problem, or a message saying you are in trouble.
Ask yourself: Was I expecting this? Does the story make sense?
Requests for Secrets
Passwords and login codes are important secrets. You should not send them through a message because someone asks.
A verification code is especially important. If a code was sent to prove that you are you, giving it to another person can help that person enter your account.
When an adult or organisation truly needs information, use the official method you already know rather than a link from a surprising message.
Suspicious Sender Details
A display name can be copied. A profile picture can be copied too. Check the actual address or username when possible.
For example, a message may say it is from "Game Support", but the sender address may use a strange spelling or an unrelated domain.
Small changes can be easy to miss. A scammer might replace one letter, add a word, or use a name that only looks similar.
Links and Attachments
Unexpected links and files deserve caution.
A link can show friendly words while leading somewhere else. On devices that allow it, you can preview a link without opening it. If you are not sure how to do that safely, ask a trusted adult or teacher.
Do not open an unexpected attachment just because the message says it contains a prize, photo, invoice, game cheat, or important document.
Messages That Try to Isolate You
A scammer may tell you to keep the conversation secret. This is a major warning sign.
Safe people and real organisations should not need to stop you from asking a parent, guardian, teacher, school staff member, or another trusted adult for help.
The Stop-Check-Ask-Report Method
A simple four-step routine can help when something feels wrong.
Stop
Do not click, reply, pay, download, scan, or share information yet.
Taking a short pause makes it easier to notice clues.
Check
Check the sender, the request, and the story.
Ask:
- Sender: Who really sent this?
- URL: Where does the link really go?
- Context: Was I expecting this message?
- Privacy: Is it asking for a password, code, money, or private information?
- Urgency: Is it trying to rush or frighten me?
Ask
If you are unsure, show the message to a trusted adult.
If the message claims to come from your school, a company, a game, or another service, contact that organisation using an app, website, phone number, or account page that you already know is real. Do not use contact details supplied only by the suspicious message.
Report
Use the service's report phishing, report spam, or report scam feature when available.
At school, you may also need to tell a teacher or the person responsible for school technology. Reporting can help protect other people from the same message.
After reporting, follow the service's guidance about blocking or deleting the message.
A Safe Way to Verify a Message
Imagine you receive a text that says your game account will be locked unless you sign in through a link.
A safer check is:
- Pause: Do not use the link in the text.
- Official website: Open the game's official app or type the known website address yourself.
- Account notification: Look for a warning inside the real account.
- Trusted adult: Ask for help if the request is confusing.
- Reporting: Report the original text if it appears to be phishing.
This is called using a separate trusted route. You are checking the story without relying on the suspicious message.
Protecting Your Accounts
Good account security reduces the damage a scammer can cause.
Use Strong, Unique Passwords
A strong password should be hard for another person to guess. Using a different password for important accounts helps stop one stolen password from opening several accounts.
A password manager can help people create and store different passwords. If you use one, set it up with a trusted adult and follow your school or family's rules.
Never share a password because a message asks for it.
Use a Second Sign-In Step
Two-step verification, also called two-factor authentication, adds another check when someone signs in.
This extra step can make an account safer even if a password is stolen. Different services may use an authenticator app, a security key, a device prompt, a passkey, or another method.
Do not approve a sign-in request that you did not start.
Keep Devices and Apps Updated
Updates often fix security problems. Use automatic updates when your family or school allows them.
Only install apps, games, browser extensions, or files from trusted sources. "Free" cheats, cracked software, or mystery downloads may carry risks.
If You Clicked or Shared Something
People sometimes click before they notice a scam. The important next step is to act quickly and get help.
Tell a trusted adult right away. If it happened on a school device or school account, tell a teacher or school technology staff member too.
If you entered a password on a suspicious page, use the real service to change that password. If the same password was used on another account, that account may also need a new password.
If you approved a sign-in request you did not start, shared a verification code, installed a file, or gave payment information, tell a trusted adult exactly what happened. The correct next steps depend on the account and device.
Do not keep a scam secret because you feel embarrassed. Fast reporting can help protect you and other people.
Scams in Games and Social Media
Games and social platforms are places where people communicate, trade, share links, and buy digital items. Scammers may use those features too.
Watch out for:
- Giveaway: "You won" messages from accounts you do not know.
- Virtual currency: Offers of free coins, points, skins, or upgrades that require a login.
- Account recovery: People asking for your password because they claim they can "fix" or "upgrade" your account.
- Impersonation: A fake account pretending to be a friend, creator, moderator, or support worker.
- Advance-fee scam: A request to pay first before receiving a prize or reward.
- Social engineering: A story designed to make you trust, fear, hurry, or feel sorry for the sender.
This child-focused video introduces online scams and why cybercriminals create them.
Can You Trust What You See?
A logo does not prove that a message is real. A familiar name does not prove that a message is real. Even a message that appears to come from someone you know should be checked if the request is unusual.
Scammers can copy text and pictures. They may also use stolen accounts. New technologies can create convincing pictures, voices, and videos.
This makes one rule especially useful: verify the request, not just the appearance.
If a friend suddenly asks for money, a code, or a password, contact the friend in another way that you already trust.
Practise With Examples
Read each situation and think before deciding.
Example A: You receive an email from a classmate you know. It says, "Look at this funny photo!" and includes an unexpected attachment. The message could be real, but the attachment is unexpected. Check with your classmate through another route before opening it.
Example B: A text says your parcel cannot be delivered until you pay a small fee through a link. You were not expecting a parcel. Do not use the link. Show the text to a trusted adult and report it.
Example C: A game chat account says it can give you free items if you share your login code. Do not share the code. Report and block the account using the game's safety tools.
Example D: A message from your school says there is a timetable change. It does not ask you to click, pay, or give information. You can still verify it using your school's normal communication system if anything seems unusual.
Example E: A friend messages you from a familiar account and asks for a gift-card code because of an emergency. The request is unusual. Contact your friend or a trusted adult separately before doing anything.
This CYBER.ORG video explains phishing and gives simple protection tips.
Trusted Advice and Further Reading
For current safety advice, you can explore these reliable sources with a teacher or trusted adult:
- CISA: Recognize and Report Phishing: Common phishing warning signs and reporting advice.
- U.S. Federal Trade Commission: How To Recognize and Avoid Phishing Scams: Practical advice about suspicious emails and text messages.
- Gmail Help: Avoid and report phishing emails: An example of how one email service lets users report phishing.
- Google Account Help: Turn on 2-Step Verification: Information about adding an extra sign-in step.
Your country, school, and online services may have their own reporting systems. Follow the rules that apply where you live and learn.
Interactive Tasks
Quiz: Test Your Knowledge
What is phishing? (A scam that tries to steal information or trigger an unsafe action) (!A safe way to back up schoolwork) (!A tool for drawing pictures online) (!A type of computer keyboard)
What should you do first when a message feels suspicious? (Stop before clicking or replying) (!Send your password to check the sender) (!Forward it to everyone in your class) (!Open every link to see what happens)
Which request is a strong warning sign? (Share your verification code now) (!Read the school timetable) (!Save your homework file) (!Ask a teacher about a lesson)
What is smishing? (Phishing by text message) (!Phishing by printed newspaper) (!A safe password method) (!A school computer update)
Why do scammers often use urgent language? (To make people act before thinking) (!To improve spelling skills) (!To make a device charge faster) (!To help websites load quickly)
What is a safe way to check a surprising company message? (Use a website or app you already know is real) (!Use only the link inside the message) (!Reply with your password) (!Send the message your login code)
What can two step verification do? (Add an extra check when you sign in) (!Make every message on the internet true) (!Remove the need to protect passwords) (!Stop all unwanted advertising)
What should you do with an unexpected attachment? (Check with the sender through a trusted route before opening it) (!Open it immediately) (!Upload it to every class device) (!Rename it and then open it)
What should you do if you entered a password on a suspicious page? (Tell a trusted adult and change it using the real service) (!Keep it secret and hope nothing happens) (!Send the same password to the suspicious page again) (!Post the password in a group chat)
Which statement is safest? (A familiar logo alone does not prove a message is real) (!Every message with a logo is real) (!Every spelling mistake proves a crime) (!Every unknown message should be answered)
Memory Game
| Phishing | A scam that uses messages or websites to trick people |
| Smishing | Phishing sent by text message |
| Impersonation | Pretending to be a trusted person or organisation |
| Urgency | Pressure that tries to make you act quickly |
| Verification | Checking whether a message or request is genuine |
| Password | A secret used to help protect an account |
| Attachment | A file sent with a digital message |
| Report | Tell a service or trusted person about suspicious activity |
Drag and Drop
| Match the correct terms. | Topic |
|---|---|
| Stop | Pause before you click reply pay or download |
| Check | Look at the sender request and link |
| Ask | Get help from a trusted adult when unsure |
| Verify | Use a separate trusted route to test the story |
| Report | Use the service safety tool or tell responsible staff |
Crossword Puzzle
| Phishing | What scam uses fake messages or websites to steal information? |
| Urgency | What kind of pressure tries to make you act too quickly? |
| Sender | What person or account should you check in a suspicious message? |
| Attachment | What file included with a message should you treat carefully when unexpected? |
| Password | What account secret should you never send because a message asks? |
| Report | What action tells a platform or trusted person about a suspicious message? |
LearningApps
Cloze Text
Open-Ended Tasks
Easy
- Scam Warning Poster: Create a one-page poster that teaches younger pupils the Stop-Check-Ask-Report method. Include four short instructions and one safe example.
- Phishing Clue Hunt: Draw a fictional suspicious message and label at least five clues that would make you stop and check it.
- Safe Reply Discussion: With a partner, choose three suspicious-message examples and explain why not replying may be safer than starting a conversation with the sender.
- Online Safety Interview: Interview a trusted adult about one scam they have seen and write a short summary without including private information.
Standard
- Message Makeover: Rewrite a fictional phishing message as a normal, safe school announcement and explain which features you changed.
- Verification Flowchart: Create a flowchart showing how to verify a surprising message without using its link or contact details.
- Scam Role Play: In a small group, act out a safe response to a fake prize message, a fake parcel text, and an unusual request from a friend's account.
- Cyber Safety Video: Produce a one-minute video that teaches classmates how to protect passwords and verification codes.
Advanced
- Scam Comparison Project: Compare email phishing, smishing, vishing, and social-media scams. Explain what they share and what makes each one different.
- School Safety Survey: Design an anonymous class survey about which phishing warning signs pupils recognise, collect the answers with teacher approval, and present the results without collecting personal data.
- Phishing Awareness Campaign: Plan a mini campaign for your school using a poster, announcement, and short presentation. Explain how each part helps a different audience.
- Incident Response Plan: Write a step-by-step plan for what a pupil should do after clicking a suspicious link, sharing a password, or installing an unexpected file. Explain why the steps are in that order.
Learning Assessment
- Evidence-Based Message Analysis: Analyse a fictional message, identify at least four clues, and decide whether to trust, verify, report, or ignore it. Justify every decision.
- Safe Verification Challenge: Given three surprising online requests, describe a separate trusted route for checking each one without using the message's own link.
- Account Protection Plan: Design a simple protection plan for a school or game account that includes password habits, an extra sign-in step, updates, and reporting.
- Compare Scam Techniques: Explain how urgency, impersonation, rewards, threats, and secrecy can influence a person's choices, and give one safe response to each technique.
- Teach Another Learner: Create a short explanation for a younger pupil that clearly distinguishes spam, scams, and phishing while using age-appropriate examples.
- Transfer Scenario: Imagine a new kind of message appears on a platform you have never used before. Apply the Stop-Check-Ask-Report method and explain how it still helps even when the technology changes.
Evidence of Learning
Strong evidence of learning can include:
- Knowledge: You can explain scams, phishing, smishing, impersonation, urgency, verification, and account protection in your own words.
- Recognition Skills: You can identify warning signs without relying on only one clue.
- Decision-Making Skills: You can pause, check context, and choose a safer route before acting.
- Verification Skills: You can explain how to contact a person or organisation separately from a suspicious message.
- Reporting Skills: You know when to use reporting tools and when to involve a trusted adult, teacher, or school technology staff member.
- Digital Products: Your poster, flowchart, video, survey, campaign, or response plan communicates safe choices clearly.
- Reasoning: You can justify why a message is suspicious and why a particular response is safer.
- Transfer: You can apply the same safety ideas to new apps, games, messages, websites, and future scam techniques.
OERs on the Topic
Linked Learning Areas