Phishing messages are designed to make you act before you have time to think.
In this lesson you will inspect fictional messages, identify warning signs and decide how to verify a suspicious request without using the link, attachment or contact information supplied in the message.
Important: every message in this lesson is fictional. Do not use real passwords, personal information or active suspicious links while practising.
What you will learn
By the end of this lesson, you should be able to identify several common phishing warning signs and explain what you would do before trusting an unexpected email.
Before you start
Read How to Recognize Phishing Messages first.
You do not need access to a real email account for this lesson.
One warning sign is not always proof
A strange message may be suspicious, but one unusual feature does not automatically prove that a message is fake.
The useful skill is to notice several clues, understand what the message wants you to do and verify important requests independently.
Warning sign 1: The message was unexpected
Start with the situation.
Were you expecting this message?
Did you recently request a password reset, place an order or contact the organization?
An unexpected message deserves more attention when it asks you to click, sign in, download something, send money or provide information.
Warning sign 2: It creates sudden urgency
Phishing messages often try to shorten the time you have to think.
Examples include claims that:
- Your account will be closed immediately.
- A payment must be made today.
- You have only a few minutes to respond.
- You will lose access unless you act now.
Urgency is a reason to slow down rather than speed up.
Warning sign 3: It uses authority to gain trust
A message may claim to come from a school, bank, government office, delivery company, game service or another organization you recognize.
A familiar name or logo does not by itself prove who sent the message.
Ask whether the request makes sense and verify it through a route you already know.
Warning sign 4: It tries to trigger a strong emotion
Some scams try to make you frightened, excited, curious or worried.
Examples include:
- A frightening security warning.
- An unexpected prize.
- A message claiming someone needs urgent help.
- A surprising refund or reward.
Strong emotion can make it harder to think carefully about the request.
Warning sign 5: It asks for sensitive information
Be cautious when an unexpected message asks for information such as:
- A password.
- A verification code.
- Payment information.
- Bank details.
- Personal identification information.
Do not provide sensitive information simply because a message claims that the request is urgent.
Warning sign 6: It wants you to use a link or attachment
Phishing messages often try to move you from the message to another action.
You may be asked to:
- Open a link.
- Open an attachment.
- Scan a QR code.
- Call a number supplied in the message.
- Sign in through a page opened from the message.
If the request matters, independently open the real service or use contact information you already trust.
Warning sign 7: The identity does not quite make sense
Look at who the message claims to represent and compare that claim with the request.
A message may use a familiar display name while asking you to do something unusual.
Do not decide that a message is genuine only because the name, logo or design looks professional.
Do not depend on spelling mistakes
Older advice sometimes suggested that scam messages were easy to identify because they contained obvious spelling or grammar mistakes.
Those mistakes can still be clues, but modern scam messages may look polished and professional.
A well written message can still be fraudulent.
Practice message 1
Subject: Your school account will be deleted today
Message: We detected a serious problem with your student account. Confirm your password immediately using the button below or your account will be deleted within 20 minutes.
What warning signs can you identify?
Possible observations:
- The message creates strong urgency.
- It threatens account loss.
- It asks you to confirm a password.
- It wants you to use a button inside the message.
A safer response is to avoid the button and independently visit the real school service or contact the school through a known route.
Practice message 2
Subject: You won a new phone
Message: Congratulations. You have been selected as today's winner. Claim your phone now. You only have ten minutes. Enter your personal information and payment details to arrange delivery.
What warning signs can you identify?
Possible observations:
- The prize was unexpected.
- The message creates urgency.
- It tries to create excitement.
- It asks for personal and payment information.
The combination of several warning signs should make you highly suspicious.
Practice message 3
Subject: New sign in detected
Message: We noticed a new sign in to your account. If this was not you, review your security immediately.
This example is more difficult because a real service could send a security warning.
Do not assume it is genuine and do not assume it is fake based only on the wording.
Instead, independently open the service using its normal app or website and check the account there.
A simple inspection routine
When an email seems important, use this routine.
- Pause before clicking or replying.
- Ask whether the message was expected.
- Look for urgency, authority or emotional pressure.
- Identify exactly what the message wants you to do.
- Notice requests for passwords, codes, money or personal information.
- Avoid unexpected links, attachments and QR codes while checking.
- Open the legitimate service independently.
- Contact the organization through information you already trust if necessary.
Activity: count the warning signs
Imagine this fictional message:
Subject: Final notice for your gaming account
Message: Your account has violated our security rules. You must verify your identity in the next 30 minutes. Open the attached document, sign in and enter the verification code sent to your phone. Failure to complete verification will permanently close your account.
Write down every warning sign you notice before reading the suggested answer.
Suggested answer
Possible warning signs include:
- The message is unexpected.
- It claims authority over the account.
- It creates a short deadline.
- It threatens permanent account loss.
- It asks you to open an attachment.
- It asks you to sign in.
- It asks for a verification code.
The safer action is to stop interacting with the message and check the gaming account through the normal app or website.
What if the message is genuine?
Independent verification should still work.
If a real account has a problem, you should normally be able to open the legitimate service yourself and check the account without depending on an unexpected message.
That means slowing down does not prevent you from responding to a genuine problem.
What if you already clicked?
Stop interacting with the suspicious page or message.
If you entered account information, use the legitimate service directly and follow its official security or recovery process.
Tell a trusted adult if you need help responding, especially when financial information, school accounts or important personal information may be involved.
Self check
- Why can urgency be a phishing warning sign?
- Does a professional logo prove that an email is genuine?
- What should you do when an unexpected message tells you to sign in through a link?
- Why are strong emotions useful to scammers?
- What is independent verification?
Suggested answers
- Urgency can pressure you into acting before checking the request.
- No. A professional appearance alone does not prove who sent the message.
- Avoid the supplied link and open the legitimate service independently.
- Strong emotions can make people react quickly instead of examining the request carefully.
- It means checking a request using a route you already know rather than depending on information supplied by the suspicious message.
Lesson summary
You do not need to prove that an email is phishing before becoming cautious.
Look for combinations of warning signs such as unexpected contact, urgency, authority, emotional pressure, sensitive information requests and instructions to open links or attachments.
When an important message seems suspicious, pause and verify it independently.
Continue learning
Review How to Recognize Phishing Messages for the full explanation behind these warning signs.
You can also review Complete Guide to Staying Safe Online for the wider Digital Safety framework.