Spotting the signs of a phishing message

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. An email says it is from your bank, but the sender address is support@bank-secure-login.xyz. What should you think?

A The email must be real because it mentions a bank

B The odd sender address is a phishing red flag

2. Which message shows an urgent tone, a common phishing sign?

A "Act NOW or your account will be deleted in 1 hour!"

B "Your library book is due back next week."

3. An email starts with 'Dear user' instead of your name. What does this suggest?

A It proves the email is private and safe

B It may be a generic message sent to many people, so be suspicious

4. You get a message saying 'You have won a free phone! Click here to claim.' What is the best response?

A Treat the prize offer as a red flag and do not click

B Click quickly before the prize runs out

5. Which sender address is more likely to be a phishing attempt pretending to be Netflix?

A service@netfliix-accounts.com

B info@netflix.com

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1From: support@paypa1-security.net		AACT NOW or lose your account forever!!!
2Dear user, your account will be closed in 1 hour!		BFrom: prize-team@free-gifts123.biz
3A sender address check: look closely at who the message really came from before trusting it		CTrusting a message with a generic greeting, a prize offer and a request for your details. These are phishing red flags and you should not reply.
4An urgent tone tries to rush you into clicking without thinking		DIgnoring the odd sender address, the spelling errors and the threat. Each one is a sign the message is a scam.
5Dear Customer, you have won a free phone! Reply with your password to claim it.		EAn odd sender address: the name is misspelled (paypa1 with a number 1) and the domain is not the real company's
6From: security@bank-verify-login.info - 'Pleese confirm your detials today or be blocked.'		FA generic greeting plus an urgent, threatening tone, which are both phishing warning signs

Definitions

phishing red flags

Fill in the Blanks

Complete each line of code by filling in the missing parts.

From: support@paypa1-help.com Red flag: odd ______ address

Subject: Act NOW or account closed! Red flag: ______ tone

Dear user, Red flag: _______ greeting

Your acount has been sucpended Red flag: ________ errors

Send your password to claim your prize! Red flag: request for your _______

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A flags ← 0

B if sender is odd then

C flags ← flags - 1

D if tone is urgent then

E flags ← flags + 1

Question 2

A if sender domain is known then

B print("Suspicious sender")

C else

D print("Check other signs")

Question 3

A greeting ← "Dear user"

B if greeting is generic then

C print("Message is safe")

Question 4

A msg ← "You won a free phone!"

B if msg offers a prize then

C print("Lucky you, click it")

D end if

Question 5

A if msg has no typos then

B flags ← flags + 1

C print(flags)

Answer Key

Spotting the signs of a phishing message

Section A: Quick Questions

B — The odd sender address is a phishing red flag

A — "Act NOW or your account will be deleted in 1 hour!"

B — It may be a generic message sent to many people, so be suspicious

A — Treat the prize offer as a red flag and do not click

A — service@netfliix-accounts.com

Section B: Match the Pairs

From: support@paypa1-security.net → An odd sender address: the name is misspelled (paypa1 with a number 1) and the domain is not the real company's

Dear user, your account will be closed in 1 hour! → A generic greeting plus an urgent, threatening tone, which are both phishing warning signs

A sender address check: look closely at who the message really came from before trusting it → From: prize-team@free-gifts123.biz

An urgent tone tries to rush you into clicking without thinking → ACT NOW or lose your account forever!!!

Dear Customer, you have won a free phone! Reply with your password to claim it. → Trusting a message with a generic greeting, a prize offer and a request for your details. These are phishing red flags and you should not reply.

From: security@bank-verify-login.info - 'Pleese confirm your detials today or be blocked.' → Ignoring the odd sender address, the spelling errors and the threat. Each one is a sign the message is a scam.

Section C: Definitions

phishing red flags — Warning signs that a message is a scam: an odd sender address, urgent or threatening tone, a generic greeting like 'Dear user', spelling errors, or requests for your details.

Section D: Fill in the Blanks

From: support@paypa1-help.com
Red flag: odd sender address

Subject: Act NOW or account closed!
Red flag: urgent tone

Dear user,
Red flag: generic greeting

Your acount has been sucpended
Red flag: spelling errors

Send your password to claim your prize!
Red flag: request for your details

Section E: Spot the Error

C — Each warning sign should add one to the flag count, so it should be flags ← flags + 1. Subtracting makes a suspicious sender look safer.}

A — An odd sender address is the red flag. The test should be if sender domain is odd then. Testing for a known domain would flag the wrong messages.

C — A generic greeting like Dear user is a phishing warning sign. The program should print Possible phishing, not say the message is safe.

C — Surprise prizes are a phishing red flag. The program should warn that the offer is too good to be true, not tell the user to click.

A — Spelling errors are a red flag, so the check should be if msg has typos then. Checking for no typos adds a flag at the wrong time.