Before you click
Do not reply or open unexpected attachments. Verify the request through a phone number or website you already trust.
Lesson 03 / Pause before you click
Phishing Awareness
A familiar name or a convincing message does not always mean the sender is genuine.
Look beyond the message.
Phishing is a deceptive message designed to get you to share information, open a harmful file, or visit a fake website. It can arrive by email, text, or social media.
- Pressure to act: “Your account will close in 10 minutes.”
- Unexpected requests: Someone asks for a password, payment, or verification code.
- Unfamiliar addresses: The sender or destination does not match the organization.
- Surprise attachments: An invoice or document arrives when you were not expecting it.
Some scams use perfect spelling and real-looking logos. Check the request itself, not just how professional it looks.
Pause. Investigate. Decide.
Scam or Safe?
Try four everyday situations. Choose “Looks suspicious” or “Looks legitimate,” then find out which clues matter. A message can look genuine and still need checking.
ALL MESSAGES ARE FICTIONAL. NO LINKS IN THE EXAMPLES ARE CLICKABLE.
CHALLENGE COMPLETE
Every message you question is a chance to protect yourself. Keep checking requests through a trusted app or website.
Pause, verify, report.
If you shared a password
Use a trusted device to change it, sign out other sessions, and check recovery details. Change it anywhere else you reused it and enable MFA.
Report the message
Use your email provider’s “Report phishing” option. Tell your school or workplace if it affects them. Contact your bank promptly if financial information was exposed.
You can forward a suspicious email to the Anti-Phishing Working Group at reportphishing@apwg.org. Use this address for phishing reports, not general website questions.
Further help: FTC phishing guidance (opens in a new tab).