Cybersecurity · Beginner level

Beginner level · Module 2: Phishing and Social Engineering Awareness · Lesson 1 of 3

Spotting Phishing Red Flags

Check messages for the signs that they are not what they claim to be.

In this lesson you will

  • Identify common phishing red flags
  • Check links and senders safely

Key concepts

sender addressurgency and threatslink checkingattachments

The lesson

Phishing messages pretend to come from someone you trust — a bank, an employer, a delivery company — to get you to click, pay or reveal information.

Red flags: a sender address that does not match the organisation, urgency or threats ('your account will be closed today'), requests for passwords or codes, unexpected attachments and links whose real address differs from the text.

Check a link by hovering over it (or long-pressing on a phone) to see the real address, and go to important sites by typing the address yourself rather than following a link.

Step by step

  1. Examine the sender address.
  2. Look for urgency, threats or rewards.
  3. Check where each link really goes.
  4. Decide and explain your verdict.
Troubleshooting tree

Is this message safe to act on?

A quick path for deciding what to do with an unexpected email, SMS or chat message.

Does the message ask you to click a link, open an attachment, pay money or share a password or code?
  • Yes
    Does it create urgency, threaten a penalty or promise a reward?
    • Yes
      Treat as phishing. Do not click or reply; report it with the 'report phishing' option or to your IT contact.
    • No
      Can you confirm the request through a separate channel you already trust — a known phone number, the official app or in person?
      • Yes
        Confirm first, then act only through the official app or a site you type yourself — not through the message's link.
      • No
        Do not act. Report it and wait until the request can be confirmed.
  • No
    Low risk. Read normally, but stay alert if a follow-up message makes a request.

Notes

No bank, mobile money provider or IT department will ever ask for your password or MFA code. Reporting a mistake quickly is always better than hiding it.

Practice activity

Classify the ten sample messages as phishing or genuine and mark each red flag.

Expected result: Correct classifications with the red flags annotated.

Check your understanding

  1. Name three phishing red flags.

    Show answer

    Mismatched sender, urgency or threats, requests for passwords or codes, unexpected attachments or misleading links.

  2. How do you see where a link really goes?

    Show answer

    Hover over it, or long-press on a phone, before opening it.

Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.