← Years 7–8 Digital Systems

Spotting the signs of a phishing message

Warning signs that a message is a scam: an odd sender address, urgent or threatening tone, a generic greeting like 'Dear user', spelling errors, or requests for your details.

Part of: 7-8 Digital Technologies Vic Curric - Digital Systems and Security — Module 63, 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 56, IGCSE Computer Science 0478 — 5.3 Cyber Security — Module 37, ACARA Digital Technologies Years 5–6 — Staying Safe Online — Module 23, ACARA Digital Technologies Years 7–8 — Networks and Cyber Threats — Module 12, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 68

Understanding Spotting the signs of a phishing message in Years 7–8 Digital Systems

What it does: This address does not match any real company. Spotting an odd sender address is the first sign to check. Pressure, threats and deadlines are red flags. Scammers want you to panic and act before you check if the message is real. Scammers rush you so you do not stop and think. Urgent or threatening wording is a red flag. Real companies often use your name. A generic greeting such as 'Dear user' or 'Dear customer' can be a phishing warning sign. Surprise prizes are a classic bait. If it sounds too good to be true, it is probably a scam.

Common mistakes: Each warning sign should add one to the flag count, so it should be flags ← flags + 1. Subtracting makes a suspicious sender look safer.}. An odd sender address is the red flag. The test should be if sender domain is odd then. Testing for a known domain would flag the wrong messages.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Spotting the signs of a phishing message to a class →

This module's key terms are also in a printable crossword (Modules 26–74) and word search (Modules 4–74).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
An email says it is from your bank, but the sender address is support@bank-secure-login.xyz. What should you think?
The email must be real because it mentions a bankThe odd sender address is a phishing red flag
Matches
Dear Customer, you have won a free phone! Reply with your password to claim it.
↓
Trusting a message with a generic greeting, a prize offer and a request for your details. These are phishing red flags and you should not reply.
Applying
Meanings
Term
phishing red flags
Meaning
Warning signs that a message is a scam: an odd sender address, urgent or threatening tone, a generic greeting like 'Dear user', spelling errors, or requests for your details.
Practice
From: support@paypa1-security.com
Testing
Gaps
Red flag: odd address
Check Answer
Spots
2if sender is odd then
3 flags ← flags - 1

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Moon Jellyfish' badge — Orbital Streak, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. An email says it is from your bank, but the sender address is support@bank-secure-login.xyz. What should you think?
A. The email must be real because it mentions a bank
B. The odd sender address is a phishing red flag ✓
Scammers use addresses that look close to real ones. Always check the sender address carefully before you trust a message.
2. Which message shows an urgent tone, a common phishing sign?
A. "Act NOW or your account will be deleted in 1 hour!" ✓
B. "Your library book is due back next week."
Scammers rush you so you do not stop and think. Urgent or threatening wording is a red flag.
3. An email starts with 'Dear user' instead of your name. What does this suggest?
A. It proves the email is private and safe
B. It may be a generic message sent to many people, so be suspicious ✓
Real companies often use your name. A generic greeting such as 'Dear user' or 'Dear customer' can be a phishing warning sign.
4. You get a message saying 'You have won a free phone! Click here to claim.' What is the best response?
A. Treat the prize offer as a red flag and do not click ✓
B. Click quickly before the prize runs out
Surprise prizes are a classic bait. If it sounds too good to be true, it is probably a scam.
5. Which sender address is more likely to be a phishing attempt pretending to be Netflix?
A. service@netfliix-accounts.com ✓
B. info@netflix.com
The extra 'i' and added words are tricks to look real. Checking the sender address is a key way to spot phishing.

Match the Pairs

From: support@paypa1-security.net → An odd sender address: the name is misspelled (paypa1 with a number 1) and the domain is not the real company's
Dear user, your account will be closed in 1 hour! → A generic greeting plus an urgent, threatening tone, which are both phishing warning signs
A sender address check: look closely at who the message really came from before trusting it → From: prize-team@free-gifts123.biz
An urgent tone tries to rush you into clicking without thinking → ACT NOW or lose your account forever!!!
Dear Customer, you have won a free phone! Reply with your password to claim it. → Trusting a message with a generic greeting, a prize offer and a request for your details. These are phishing red flags and you should not reply.
From: security@bank-verify-login.info - 'Pleese confirm your detials today or be blocked.' → Ignoring the odd sender address, the spelling errors and the threat. Each one is a sign the message is a scam.

Key Term

phishing red flags
Warning signs that a message is a scam: an odd sender address, urgent or threatening tone, a generic greeting like 'Dear user', spelling errors, or requests for your details.

Fill in the Blanks

1. From: support@paypa1-help.com Red flag: odd sender address
Hint: Type the word for who the message comes from, which is the address you should check first.
2. Subject: Act NOW or account closed! Red flag: urgent tone
Hint: Type the word that describes a message trying to rush you into acting quickly.
3. Dear user, Red flag: generic greeting
Hint: Type the word meaning not personal, because the message does not use your real name.
4. Your acount has been sucpended Red flag: spelling errors
Hint: Type the word for mistakes in how words are written.
5. Send your password to claim your prize! Red flag: request for your details
Hint: Type the word for personal information, such as a password, that scammers ask you to hand over.

Spot the Error

Question 1
A flags ← 0
B if sender is odd then
C flags ← flags - 1
D if tone is urgent then
E flags ← flags + 1
Line C — Each warning sign should add one to the flag count, so it should be flags ← flags + 1. Subtracting makes a suspicious sender look safer.}
Question 2
A if sender domain is known then
B print("Suspicious sender")
C else
D print("Check other signs")
Line A — An odd sender address is the red flag. The test should be if sender domain is odd then. Testing for a known domain would flag the wrong messages.
Question 3
A greeting ← "Dear user"
B if greeting is generic then
C print("Message is safe")
Line C — A generic greeting like Dear user is a phishing warning sign. The program should print Possible phishing, not say the message is safe.
Question 4
A msg ← "You won a free phone!"
B if msg offers a prize then
C print("Lucky you, click it")
D end if
Line C — Surprise prizes are a phishing red flag. The program should warn that the offer is too good to be true, not tell the user to click.
Question 5
A if msg has no typos then
B flags ← flags + 1
C print(flags)
Line A — Spelling errors are a red flag, so the check should be if msg has typos then. Checking for no typos adds a flag at the wrong time.

Student with a class code? Join your class →