Cybersecurity Foundations (Grades 6–8) · lesson 10 of 48 · 20 min
Lab Introduction — From Knowledge to Skill
You have spent three lessons learning about phishing: what it is, how it works, the variants, the red flags, and how to check links. Now it is time to test that knowledge under realistic conditions.
This lab presents you with a series of simulated emails, text messages, and web pages. Your job is to identify whether each is legitimate or a phishing attempt — and explain your reasoning. The goal is not just to get the right answer, but to build the habit of systematic analysis that will protect you for life.
Remember the 10-second check: sender address, domain match, link URL, urgency/threats, and whether you were expecting this contact.
Lab rules
Treat each scenario as if it is real. Do not just look for obvious mistakes — sophisticated phishing can be nearly perfect. Focus on the process: check every indicator, not just the ones that stand out. A single red flag is enough to warrant verification before acting.
The PhishingChallenge — Identify the Fakes
Work through each simulated email below. For each one, decide: legitimate or phishing? Then check your reasoning against the explanation.
Phishing detection challenge
Read this email carefully. Click on any part that looks suspicious. Find all the warning signs, then submit your analysis.
- <>
- 🔗
warning signs found
You found of warning signs (%)
Excellent analysis! You have a sharp eye for phishing. Good effort. Review the indicators below to sharpen your skills.
Submit my analysis
Advanced Analysis — Sophisticated Attacks
The PhishingChallenge above covers common patterns. Now consider more sophisticated scenarios where the obvious red flags are absent.
Advanced Phishing Analysis
Building Your Personal Phishing Defence Checklist
Based on everything you have learned, here is your personal checklist for any suspicious email or message. Print it, memorise it, or save it — and use it every time.
When in doubt, verify
The most important habit is this: when anything feels off — even slightly — verify through a separate channel before acting. A legitimate organisation will never be upset that you took 2 minutes to confirm a request is real. An attacker will try to pressure you out of doing exactly that.
Activity — Flashcard Final Review
Phishing Lab — Key Takeaways
Clone Phishing A sophisticated attack that copies a legitimate email you previously received, replacing links or attachments with malicious ones. Hard to spot because the content is familiar and the sender may appear correct.
- Advanced
- Account Compromise Phishing
Using a compromised legitimate account to send phishing messages. The email comes from a real address, making it extremely convincing. Verification through a separate channel is the only reliable defence.
- Advanced
- The 10-Second Check
Before clicking any link in an unexpected email: (1) Check sender address, (2) Check link URL, (3) Check greeting, (4) Note urgency/threats, (5) Ask if you were expecting this contact.
- Skill
- Gift Card Request = Scam
No legitimate teacher, employer, or government agency will ever ask you to buy gift cards and send the codes. This is a universal scam pattern. Always verify through a separate channel.
- Rule
- “Do Not Tell Anyone” = Red Flag
Requests to keep something secret before you have verified it are a social engineering tactic to prevent you from consulting others who might recognise the scam.
- Red Flag
- Separate Channel Verification
Contacting the sender through a different, independently verified method (in person, official phone number, new email to known address) to confirm a request is real. The ultimate defence against all phishing variants. Defence
Activity 2 — Phishing Lab: Spot All the Red Flags
This email contains multiple red flags. Read it carefully and identify every indicator that reveals it as a phishing attempt.
Phishing detection challenge
Read this email carefully. Click on any part that looks suspicious. Find all the warning signs, then submit your analysis.
- <>
- 🔗
warning signs found
You found of warning signs (%)
Excellent analysis! You have a sharp eye for phishing. Good effort. Review the indicators below to sharpen your skills.
Submit my analysis
Activity 3 — Advanced Phishing Scenarios
Advanced Phishing Lab Scenarios
Try it: Phishing challenge: what next?
Previous lesson: Social engineering tactics
Back to Cybersecurity Foundations (Grades 6–8)
Next lesson: What is a digital footprint?