NewThe ManyPI MCP Server is now live
ManyPI
ManyPI
LoginSign up

Spot the phishing email

Six short emails, some genuine and some fake, and the five checks that tell them apart. A worksheet for media literacy lessons, answers included.

Worksheet45 minAdult education +2CC BY 4.0

What you will learn

  • Check the real sender address behind a display name
  • Recognise pressure, unusual requests and odd links
  • Decide what to do with a suspicious message instead of clicking

Five checks

  1. Who really sent it? Look at the address, not the name.

  2. Does the link go where it says? Hover over it, or press and hold on a phone.

  3. Is there pressure? "Within 24 hours" and "account blocked" are there to stop you thinking.

  4. Is the request normal? No bank, school or delivery service asks for a password by email.

  5. Did you expect it? An invoice for something you never ordered is a reason to check.

The emails

All companies and addresses are made up. .example addresses cannot exist.

Student Services

it-support@schoo1-portal.example

Your mailbox is full

Your mailbox is full. Log in within 24 hours at the link below or your account will be deleted.

Library

library@yourschool.example

Your reserved book is ready

The book you reserved is ready for collection at the front desk until Friday.

ParcelFast

notice@parcelfast-delivery.example

Delivery failed

We could not deliver your parcel. Pay a 1.99 redelivery fee here to book a new slot.

Ms Novak

j.novak@yourschool.example

Class trip form

Reminder: the class trip form is due on Monday. You will find it on the school website as usual.

Principal

principal.office@gmail.example

Quick favour

I'm in a meeting. Buy four gift cards and send me the codes. Keep it between us for now.

Streamly

billing@streamly.example

Your monthly receipt

Your monthly receipt is attached as a PDF. Thank you for watching with Streamly.

Tasks

  1. For each email, write "genuine", "phishing" or "check first", and name the check that decided it.

  2. Email 1 has a small trick in the sender address. Find it.

  3. Email 5 comes from a real-looking name. What makes it suspicious anyway?

  4. Write down three safe ways to check a message without using its links.

Answers for teachers

  1. Phishing. "schoo1" uses the digit 1, the deadline creates pressure, and it asks you to log in through a link.

  2. Genuine. Expected, from the school's own domain, asks for nothing.

  3. Phishing. You expected no parcel, the small fee is there to get card details, and the domain is not the carrier's usual one.

  4. Genuine. School domain, a normal request, and it points to the usual website.

  5. Phishing. A free-mail address for an official role, secrecy and gift cards are the classic signs of "CEO fraud".

  6. Check first. Probably genuine if you have the account, but open it through the app or the address you usually type.

Safe ways to check: type the website address yourself, call a number you already know, or ask the person through another channel.

Reuse this material

CC BY 4.0

You may copy, adapt and share it, also commercially, as long as you credit ManyPI and link back.

"Spot the phishing email" by ManyPI (https://manypi.com/edu/spot-the-phishing-email), licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)

Related