Phishing: Read the Message Before You Trust the Story

Phishing is social engineering delivered through a communication channel such as email, text message, direct message, or another digital service.

The message tries to move the user toward an action:

• reveal credentials
• open a link
• download a file
• send information
• approve a payment
• bypass a normal process

A phishing message does not have to be badly written or obviously fake. The strongest messages borrow real context.

Common phishing patterns

Generic phishing

A broad message is sent to many people with a common story such as an account problem or delivery notice.

Spear phishing

The message uses information about a specific person, team, or organization to become more believable.

Smishing

Phishing delivered through text messaging.

Vishing

Voice-based phishing or deceptive phone calls.

Business-email-style impersonation

The sender pretends to be an executive, teacher, vendor, administrator, or another trusted role and requests an unusual action.

The category matters less than the evidence. Ask what the message is trying to make the recipient do.

Analyze the visible evidence first

Use this fictional message:

From: tournament-support@robot-event.example
Subject: FINAL NOTICE: Team registration incomplete

Your team's registration cannot be validated.
Confirm the captain account within 15 minutes or your event slot will be released.

Verify: https://robot-event.account-check.example/login

Do not open the fictional link.

Visible clues include:

• urgent deadline
• threat of losing something valuable
• request to authenticate
• domain structure that does not match the claimed organization

Those clues justify treating the message as suspicious.

They do not prove who sent it or whether anyone entered credentials.

Read a URL structurally

Humans often read URLs from left to right and stop when they see a familiar word.

Instead, identify the host name carefully.

Compare:

https://support.robot-event.example/login
https://robot-event.example.attacker.test/login
https://robot-event-account.example/login

The first may be a subdomain of the fictional robot-event.example domain.

The other two are different host structures.

Do not rely on color, logos, or familiar words alone.

Build a phishing evidence ledger

For each teacher-provided synthetic message, record:

Analyze at least four samples.

At least one sample should be legitimate or ambiguous. A useful phishing exercise should not teach that every unusual message is malicious.

Verify through another channel

If a message claims that an account is locked, do not use the link in the message to verify the claim.

Use an independent path:

• open the known service directly
• use a saved official bookmark
• contact the teacher or approved support channel
• check the service through a known app

The principle is:

Do not let the suspicious message control both the warning and the verification path.

Attachment reasoning

A message can also carry risk through attachments.

Do not open teacher-provided suspicious samples outside the approved lab.

Instead, analyze supplied metadata such as:

• filename
• file type
• claimed purpose
• sender context
• whether the attachment was expected

A file named schedule.pdf.exe is structurally different from a normal PDF even if the icon looks convincing.

Build a decision workflow

Create a flowchart:

message arrives → expected? → sender verified? → request normal? → link/attachment needed? → independent verification → report or continue

Your flowchart should include an ambiguous path. Sometimes the correct answer is not "safe" or "phishing." It is "verify before acting."

Safe phishing test

Your teacher provides six synthetic messages.

Classify each as:

• likely legitimate
• suspicious
• insufficient evidence

For each classification, cite at least two clues.

Then state the safe next action.

Do not score yourself only on whether you guessed the intended label. Score yourself on whether your reasoning is traceable to evidence.

Evidence for Lesson 1

Submit:

• four-message phishing evidence ledger
• URL structure notes
• phishing decision flowchart
• six-message classification table

Finish with:

The clue I trust least by itself is ________ because ________.

Phishing defense is not spotting one magic red flag. It is slowing the request down long enough to verify the story through evidence the message does not control.