Phishing
Don't take the bait. Learn to spot fake emails and scams.
Phishing Red Flags
Urgency
Claims you must act immediately (e.g., 'Account suspended').
Mismatched URL
Link says 'paypal.com' but goes to 'paypal-secure-login.com'.
Generic Greeting
Uses 'Dear Customer' instead of your name.
Unexpected Attachment
Invoices or receipts you didn't ask for.
Incoming Email visualization. Review the labels and use the controls, when present, to step through the diagram.
Dear Customer,
Your account will be closed in 12 hours unless you verify your identity immediately.
Check the sender
It says PayPal, but the address is paypa1‑billing.com — spelled with the digit 1. Scammers fake addresses that look right at a glance.
Phishing is one of the most common ways people lose accounts and money — not to genius hackers, but to one convincing message on a busy day.
Micro-tips to stay safe
- Hover or long-press links to reveal the real URL before clicking.
- When in doubt, open a new tab and type the site yourself.
- Unexpected invoices/attachments? Call the sender on a known number first.
Reading a Link: URL Anatomy visualization. Review the labels and use the controls, when present, to step through the diagram.
An address, read in a strange order
A web address has parts, like a postal address. The catch: the part that tells you WHO you’re visiting is not at the start — and scammers exploit exactly that.
One habit beats most phishing: before you tap, find the first single slash and read the owner to its left. If it isn’t the company you expect, stop. If the address looks long or confusing, don’t puzzle it out — open the company from its app or your bookmark instead.
Scams this audience actually sees
The names change, but the pattern is the same: pressure, secrecy, a link, a code, or a payment.
“Is this you in this video?”
A DM from a real friend can come from a stolen account. Do not open the link; ask them on another app.
Game and Discord scams
Fake Steam/Roblox trades, Discord Nitro gifts, tournament invites, or “staff” asking for login codes.
Marketplace and delivery
OLX/Nova Poshta-style fake payment or delivery-fee pages. Use the official app, not links from chat.
Fake bank security calls
A caller says they are “bank security” and asks for codes. Hang up and call the number in your banking app.
Diia-branded phishing
Fake government forms or “aid payment” pages. Open Diia or official domains directly.
Deepfake relative-in-trouble calls
If a voice or video asks for urgent money, pause and verify with a family code word or another contact.
If someone threatens to leak intimate images
This is abuse, not your fault. Paying usually does not make it stop.
- Do not pay and do not negotiate.
- Preserve evidence: screenshots, usernames, links, wallet/card details, and timestamps.
- Tell a trusted adult or friend immediately; isolation helps the blackmailer.
- Report the account on the platform. To get images taken down: Take It Down (takeitdown.ncmec.org) if you were under 18 in them, StopNCII.org if you were an adult.
- If you are in immediate danger or a minor is involved, contact local emergency help or cyberpolice.
Email Security Checklist
- Enable Multi-Factor Authentication (MFA) on your email account.
- Use a unique, strong password (generated by a password manager).
- Never click links in suspicious emails. Go to the site directly.
- Check the sender's actual email address, not just the display name.
If you already clicked
- If you entered credentials: Change the password immediately and enable MFA. This is the most urgent step.
- Revoke sessions/devices on that account; check recent activity for unauthorized access.
- If you entered credit card info, call the bank to block/replace the card.
- If you gave a code to a caller, treat the account as compromised and contact the real service from its official app/site.
- If friends are receiving messages from you, post a short warning and secure the account before replying to everyone.
- Downloaded a file but never opened it? Delete it and move on. Opened or ran it? Stop using that device for anything important, disconnect it from the internet, run a trusted antivirus scan, and change important passwords from another device.
Annotated example (no-click walkthrough)
From: "Support" <security@paypa1-billing.com>
Subject: URGENT - Account Suspended
Hi, your account will be closed in 12 hours. Download the attached invoice or log in here.
- Mismatched domain (paypa1 vs paypal).
- Urgency language to rush you.
- Unexpected attachment: treat as malicious.
Beyond Email: Other Phishing Channels
Attackers don't just use email. Watch out for these too:
SMS Phishing (Smishing)
Fake texts claiming to be from banks, delivery services, or government. Never click links in unexpected texts—go directly to the official website or app.
Phone Call Phishing (Vishing)
Callers pretending to be tech support, banks, or officials. They create urgency ('Your account is compromised!'). Hang up and call the official number yourself.
QR Code Phishing (Quishing)
Malicious QR codes placed over legitimate ones (parking meters, restaurant menus). Before scanning, check if the code looks tampered with. Preview the URL before opening.
Quick quiz
Question 1 / 5
A coworker sends an unexpected invoice attachment. What’s safest?
Complete the Quiz
Pass the quiz above (70%+) to unlock topic completion.