Around the room hang a dozen messages: a parcel that could not be delivered, a streaming account “on hold”, a prize with a countdown timer, a note from “the principal” asking for gift cards. Every specimen in the gallery is invented for this activity — the brands and senders are fictional — but each one is built from the same techniques used in real attacks arriving in real inboxes today.
The task
Tour the gallery in groups with two jobs. First, rank the specimens from crudest to most convincing — argue about the order, because the argument is where the learning is. Second, for each specimen, catch the tells: circle every detail that gives the game away, and name the pressure the message is applying. Finish by writing your group’s top three rules for spotting a phish, in your own words.
Getting started (click to expand)
- Read the sender, not just the message. Where would replying actually go?
- Hover before you trust: where does that link say it goes, and where does it actually point?
- Every phish sells an emotion before it asks for a click. Name the emotion — urgency, fear, greed, helpfulness — and the request underneath gets easier to see.
What tends to surface
Ranking forces the uncomfortable finding: the best specimens have almost no tells. Spelling mistakes and absurd promises mark only the crude ones; the convincing ones are beaten not by sharper eyes but by better habits — verifying through a second channel, never acting inside the message itself. Those habits are exactly what Staying Secure Online turns into a checklist worth keeping.
An extension
Design the lure that would catch you — the message tuned to your own life — and trade with a partner. Knowing your personal bait is worth more than any general rule. Then take the gallery home: which specimen would be most likely to catch someone you live with?
The answer is not on this page
There is no official ranking and no complete list of tells — real attackers retire old tricks the day we learn them. The class builds its defences together, and rebuilds them as the specimens change.
Curriculum connection
B3.2
apply safe and effective security practices, including practices to protect their privacy, when using digital technology in various contexts
Link to original
A2.2
analyze personal and societal safety and cybersecurity issues related to digital technology, and identify measures and technologies that can help mitigate related concerns for individuals and communities
Link to original