Spot and stop phishing
Want more background?
The idea in everyday life
Treat urgency, secrecy, unexpected attachments, payment changes, login prompts, and unusual sender details as reasons to verify. Do not use the message's link or contact information; navigate independently or contact a known person through a separate channel.
Treat unexpected requests as claims to verify through a separate trusted channel.
One step at a time.
Use the sample or information you have permission to use. Keep your work as you go. You can pause between steps.
- 1
Pause on urgency, secrecy, payment changes, login warnings, unusual attachments, and requests to bypass process.
- 2
Open the known app or type the official site yourself instead of using the message link.
- 3
Verify money, credential, and sensitive-data requests through a second channel you already trust.
- 4
Report suspicious messages, block the sender, and warn affected contacts without forwarding active links.
See how it works.
A payroll email says direct-deposit access expires today. Sam does not click. The display name is familiar but the domain is altered by one letter. Sam opens the employer portal from a bookmark and reports the message through the official process.
Did you cover these?
- The request is verified using a channel not supplied by the message.
- Links are inspected without entering credentials on an unexpected page.
- Suspicious messages are reported before deletion when an organization can investigate.
What to finish
A four-step verification rule posted where household or team members can use it.
Watch for this
Deciding a message is safe because the logo, sender name, or writing style looks familiar.
How can I tell I understand it?
You can verify a request without using any contact information contained in the suspicious message.
Quick knowledge check
Answer all 3 questions. Get at least 2 right and the lesson completes automatically.
You’ll get an explanation for each answer. Signed in? Your results save to your account.
Pass the check. We’ll save the progress.
Answer all 3 questions above and get at least 2 right. You can review the explanations and try again.
Go to the knowledge checkOptional course overview video · same video as Lesson 1
Secure Our World
From Cybersecurity and Infrastructure Security Agency. Watch here or open it on YouTube .
Pause on each phishing example in the playlist and name the emotional trigger, technical clue, and independent verification path.Tools, templates, and lesson sources
Tools and templates
Tools open in a new tab so you can keep your place here.
Sources and further reading
Explore the references behind this lesson.
Report a problem with this lesson
Tell us what went wrong. Please leave out personal information and private project contents.