Learning Center

Phishing basics

Phishing is a deceptive message that tries to get you to reveal information, send money, or open something harmful. It can arrive by email, text, or social messaging.

Four short lessons · For beginners

Lesson 1

Common warning signs

A warning sign is a reason to investigate. No single clue proves that a message is malicious, and a message without these clues can still be deceptive.

Pressure and urgency

A short deadline can rush your judgment.

“Your account closes in 30 minutes.”

Try this: Pause before deciding.

A mismatched sender

The address may not fit the claimed organization.

“School Office” <office@campus-alert.example>

Try this: Check through a known contact.

Requests for private information

Be cautious with requests for passwords, codes, or financial details.

“Reply with the code on your phone.”

Try this: Keep sign-in codes private.

Unfamiliar or hidden links

Shortened or lookalike addresses can disguise a destination.

“Confirm at school-verify.example.”

Try this: Open the known website yourself.

Unexpected attachments

A surprise file may be harmful even if it looks routine.

“Open this invoice you weren’t expecting.”

Try this: Verify before opening files.

Unexpected payments or rewards

An unfamiliar invoice or prize may be bait.

“Pay a fee to release your prize.”

Try this: Check the claim independently.

Remember: Good spelling, a polished logo, and a familiar display name do not establish trust. Look at the request and its context.

Further reading: CISA phishing tip sheet ↗ · FTC phishing guide ↗

Lesson 2

A message, explained

Study this fictional school message. Open each annotation to see how the details affect your decision. The example addresses are illustrative and are not links.

Fictional example

FromCampus IT <support@school-help.example>

SubjectFinal warning: your student account

Your school account will be deleted in 30 minutes. Verify your password at school-help.example/verify to keep access.

Do not contact the school office. Reply with the verification code sent to your phone.

01 Why check the sender?

The display name says “Campus IT,” but anyone can use that name. The address alone does not establish a relationship with your school. Compare it with your school’s known contact details.

02 What does the deadline do?

The 30-minute threat creates pressure. A safer decision starts by slowing down and checking the claim through the school’s usual IT channel.

03 What makes the request concerning?

The message steers you toward an unfamiliar password page and requests a sign-in code. Both could expose account access. Keep the code private and use your school’s official sign-in route.

04 Why is “do not contact the office” a clue?

It discourages an independent check. Reach out through a contact you already trust rather than relying on instructions from the message.

Your next move: Leave the message alone and contact your school through its usual help channel. Ask whether any action is required.

Lesson 3

Pause. Verify. Report.

Pause the interaction
Avoid replying, opening attachments, or following links in a suspicious message.
Verify through a known route
Use the official app, a saved address, or a phone number you already trust.
Report, then remove it
Use your service’s phishing-report option or your school’s reporting process. Report scams to the FTC ↗, then delete the message.

Already clicked or shared information?

If you exposed a password, change it through the real service and review account access. Contact your bank if financial details were exposed. If you suspect a harmful download, update security software and run a scan. For identity information, follow the steps at IdentityTheft.gov ↗. A click alone does not tell you what happened.

Response guidance: Federal Trade Commission ↗

Try a real-world workflow: inspect a URL →. The Link Inspector can show a domain registration date when public records are available. It cannot tell you when a specific page was created or guarantee legitimacy.

Lesson 4

Key terms

Phishing: A deceptive message intended to manipulate you into a harmful action.
Smishing: Phishing delivered through a text message.
Social engineering: Manipulating people into revealing information or taking an action.
Multifactor authentication (MFA): Signing in with more than one type of proof, such as a password plus an authenticator.
Impersonation: Pretending to be a person or organization you trust.

After the lessons

Check what you learned

Explore four topic quizzes, with an explanation after every answer.

Take a Knowledge Check →Try the Message Checker →

Sources & learning notes

Lessons draw on public guidance from CISA, the FTC, and the Canadian Centre for Cyber Security. Examples and annotations are original teaching scenarios. PhishWise is an independent educational project and is not affiliated with these agencies.