Cover lesson · PSE / Well-being · Year 8 · Beginner

Phishing email analysis

DCF: Citizenship → Online behaviour and online bullying

Name: Class: Date:

Cover teacher — you need no subject knowledge

Print: this sheet one per pupil, and the stimulus sheet “Four emails. Three are fake.” one per pair. One highlighter between two. No computers are needed and nobody should open an email client. Every address and link on the stimulus sheet is invented and must not be typed into a browser.

Run: 6 min — read “The five warning signs” aloud and do Email 1 together on the board · 18 min — pairs highlight Emails 2, 3 and 4 and fill the evidence table · 8 min — the domain drill · 10 min — write the report to the IT helpdesk · 5 min — go round the class: one sign each, no repeats · 3 min — close on “never your password, never in a hurry”.

Collect: this sheet with the evidence table, the domain drill and the report completed. The highlighted stimulus sheet can stay with the pair.

Answer for you: Emails 1, 2 and 3 are fake. Email 4 is genuine — it is from the school’s own domain, the reply-to matches, it asks for nothing, and it offers a face-to-face route instead of a link.

What you are doing

You have four printed emails. Three are phishing attempts and one is real. Using a highlighter, you will mark every warning sign on the fakes, record your evidence in the table, and then write a short report to the school IT helpdesk explaining which one worried you most and why.

The skill is not “spotting a dodgy email”. It is reading the sender’s domain and noticing what the message is asking you to do.

Step by step

  1. 6 min — Read the five warning signs on the stimulus sheet. Do Email 1 together as a class.
  2. 18 min — In pairs, highlight Emails 2, 3 and 4. Fill one row of the evidence table per email, quoting the words you highlighted.
  3. 8 min — Complete the domain drill. This is the part that catches real scams.
  4. 10 min — Write your report to the IT helpdesk in the frame provided.
  5. 5 min — Class round-up: everyone names one warning sign, nobody repeats one.

Evidence table

Tick the signs you found. In the last column, quote the exact words that gave it away.

Email Name / address mismatch Rushed you Generic greeting Link goes elsewhere Attachment or password Quote your best piece of evidence
1
2
3
4

Which email is genuine, and what is the single strongest reason you trust it?

Domain drill

The domain is the part of an address after the @, and in a web link it is the part before the first single slash. Read it from the right: the last two or three pieces are what count. Write down the real domain for each, and say who actually owns it.

Address or link, as printed The real domain Whose is it, really?
secure.alerts@setup-bank-verify.login-check.net
it-helpdesk@scoolmail-support.com
no-reply@parcel-post-cymru.delivery-fee.info
headofyear8@ysgolnantgwyn.cymru

Your report to the IT helpdesk

Five or six sentences. Say which email worried you most, list three pieces of evidence, and say what you did and did not do with it.

 

 

 

 

 

 

Success criteria

If you finish early