Cybersecurity Foundations (Grades 6–8) · lesson 8 of 48 · 12 min
From Theory to Practice — Learning to See the Signs
Knowing that phishing exists is not enough. You need to be able to spot it in the wild — quickly, reliably, even when the attack is sophisticated. This lesson is a practical training session. You will learn the specific red flags that appear in phishing emails, practise applying them to real examples, and build the habit of verification before action.
The goal is not to make you paranoid about every email. It is to give you a fast, reliable checklist that takes about 10 seconds to run through — and that will protect you for the rest of your life.
The 10-second check
Before clicking any link or opening any attachment in an unexpected email, run through five questions: (1) Do I recognise the sender? (2) Does the sender’s email address match the organisation? (3) Does the link URL match the organisation? (4) Is there urgency or a threat? (5) Was I expecting this? If any answer raises doubt — verify before acting.
The 8 Red Flags of Phishing Emails
These are the specific indicators that security professionals look for. Learn them until they are automatic.
Important caveat: sophisticated phishing attacks may have none of these obvious red flags. Spear phishing emails can be grammatically perfect, use the correct sender domain (via email spoofing), and reference real personal details. This is why the final defence is always verification through a separate channel — not just checking for red flags.
Activity 1 — Red Flag Identification
Match each phishing red flag to the specific example that demonstrates it.
Red Flag Matching
How to Check a Link Before Clicking
One of the most important skills is checking where a link actually goes before you click it. Here is how to do it on different devices:
The URL anatomy lesson
A URL has a specific structure: https://subdomain.domain.tld/path. The domain is the part immediately before the first single slash. In “https://login.paypal.com/verify“, the domain is “paypal.com” — legitimate. In “https://paypal.com.verify-account.net/login“, the domain is “verify-account.net” — a phishing site. Attackers put the real brand name as a subdomain to confuse you. Always read the domain, not the subdomain.
Activity 2 — Phishing Email Analysis Lab
Analyse each email scenario and identify all the red flags present, then choose the correct response.
Email Analysis Lab
The PhishingChallenge — Spot the Fake
Now put everything together. In this challenge, you will see simulated emails and must identify whether each is legitimate or a phishing attempt — and explain why.
Phishing detection challenge
Read this email carefully. Click on any part that looks suspicious. Find all the warning signs, then submit your analysis.
- <>
- 🔗
warning signs found
You found of warning signs (%)
Excellent analysis! You have a sharp eye for phishing. Good effort. Review the indicators below to sharpen your skills.
Submit my analysis
Activity 4 — Flashcard Review
Spotting Phishing — Key Skills
Sender Address Check Look at the actual email address, not just the display name. “PayPal Security” can be set as the display name for any email address. The domain after @ must match the real organisation.
- Skill
- URL Inspection
Hover over links before clicking to see the actual destination URL. The domain is the part immediately before the first single slash. Subdomains can be anything — only the domain matters.
- Skill
- Domain vs. Subdomain
In “https://paypal.com.verify.net/login“, the domain is “verify.net” — a phishing site. In “https://login.paypal.com“, the domain is “paypal.com” — legitimate. Read right-to-left from the first slash.
- Skill
- Urgency as a Red Flag
Legitimate organisations do not threaten to delete your account in 24 hours or demand immediate action. Urgency is a manipulation tactic designed to prevent you from thinking critically.
- Red Flag
- Generic Greeting
“Dear Customer”, “Dear User”, “Dear Account Holder” — real organisations know your name. Generic greetings suggest a mass phishing campaign where the attacker does not know who they are emailing.
- Red Flag
- Verification Through Separate Channel
The ultimate defence: if an email asks you to take action, go directly to the organisation’s website by typing the URL, or call their official number. Never use contact information from the suspicious email.
- Defence
- Email Spoofing
Attackers can forge the “From” field to show any email address. A sophisticated phishing email may appear to come from a legitimate address. URL inspection and separate-channel verification remain essential. Technique
Activity 5 — Phishing or Legitimate? Sorting Challenge
Sort each email characteristic into “Phishing Red Flag” or “Legitimate Signal”. Some characteristics can appear in both — think carefully about which category is more accurate.
Phishing vs. Legitimate Email Signals
- Email from “support@paypa1.com” (number 1 instead of letter l)
- redflag
Lookalike domain — the number 1 replaces the letter l. This is a classic phishing domain trick.
- Email addresses you by your full name as it appears in your account
- legit
Legitimate organisations know your name. Generic greetings are a red flag; personalised ones are a positive signal (though not foolproof).
- “Your account will be deleted in 24 hours unless you act now”
- redflag
Artificial urgency is a manipulation tactic. Legitimate organisations give reasonable notice and do not threaten immediate deletion.
- Link destination matches the sender’s official domain when you hover over it
- legit
When the hover URL matches the sender’s real domain, that is a positive signal. Always verify before clicking.
- Asks you to enter your Social Security Number to verify your identity
- redflag
No legitimate organisation asks for your SSN via email. This is a credential harvesting attempt.
- Email comes from a domain you recognise and have received legitimate emails from before
- legit
A familiar, correct domain is a positive signal — though note that email spoofing can forge display names. Always check the actual domain.
- Multiple spelling and grammar errors throughout the email
- redflag
Poor writing quality is a red flag, though sophisticated phishing emails are now often well-written. Absence of errors does not mean an email is safe. The email asks you to verify by going to the official website yourself (not clicking a link) legit Legitimate security alerts often tell you to log in directly rather than clicking a link. This is actually a sign of good security practice.
Final Quiz — Phishing Detection Mastery
Spotting Phishing — Final Check
In the URL “https://paypal.com.verify-account.net/login“, what is the actual domain?
- paypal.com
- verify-account.net
- paypal.com.verify-account.net
- login
Answer: verify-account.net
The domain is the part immediately before the first single slash, reading from right to left. “paypal.com” here is a subdomain of “verify-account.net” — a phishing site. The attacker put “paypal.com” at the start to make it look legitimate at a glance.
You receive an email from “security@google.com” saying your account was accessed from Russia. The email looks perfect. What should you do?
- Click the link in the email to secure your account immediately
- Open a new browser tab and go directly to myaccount.google.com to check your security activity
- Reply to the email asking for more information
- Forward the email to a friend to check if it looks real
Answer: Open a new browser tab and go directly to myaccount.google.com to check your security activity
Even if the email looks perfect and the sender address appears correct (email spoofing can fake this), always verify by going directly to the official site in a new tab. Google’s security activity page will show you any real login attempts. Never click links in security alert emails.
If an email has no spelling mistakes and uses professional formatting, it cannot be a phishing email.
- True
- False
Answer: False
Modern phishing kits include professionally designed email templates that are indistinguishable from real company emails. Sophisticated attackers hire copywriters. Spelling errors were once a reliable red flag, but they are no longer a dependable indicator. Always check the sender domain and link destinations.
Previous lesson: What is phishing?
Back to Cybersecurity Foundations (Grades 6–8)
Next lesson: Social engineering tactics