How do I teach students to spot phishing?
How do I teach students to spot phishing?
Teach phishing as a set of tricks rather than a list of bad emails. Once students can name the pressure tactics, such as urgency, fake rewards and lookalike senders, they can recognize a scam in any app. Practice with realistic printed examples and a simple pause-and-check routine. This page explains what students get wrong, gives classroom moves and a five-lesson plan, and points to ready-made units for Grades 6–9.
Get the phishing unitTeach students that phishing is a message designed to rush them into clicking, sharing a password or code, or sending money. The warning signs are pressure to act fast, an offer that seems too good, a sender address or link that does not quite match, and requests for login details. Practice with printed examples, have students annotate the red flags, and drill one routine: pause, check through the official app or website, and ask a trusted adult.
Ready-made material
AI & Cybersecurity Units Bundle, Grades 6–9
6 resources in one download: $89.99 instead of $149.94 bought separately.
The first cover is the main resource; the others are related options. Open any cover for the full contents and price.
AI & Cybersecurity Units Bundle | How AI Works, Prompting, Phishing, Encryption & Data Privacy | 6 Units | Grades 6–9
Coding & Computer Basics Units Bundle | Algorithms, Python, Binary & How the Internet Works | 4 Units | Grades 6–9
Computer Science Activities Bundle | Artificial Intelligence, Python Programming, Cybersecurity & Digital Literacy | Middle School Grades 7–10
AI Literacy & Cybersecurity Activities | Artificial Intelligence, Prompt Engineering & Online Safety | Grades 7–10
Digital Citizenship Activities | Cyberbullying, AI, Social Media & Media Literacy Lessons | Grades 7–10
Why it is hard
Why smart students still fall for it
Most middle schoolers are sure they would never be fooled. They picture phishing as a clumsy email full of spelling mistakes from a stranger asking for bank details, and since they have no bank account, they assume it does not concern them. The scams that reach them look different. A message in a game chat promises free skins or currency if they log in on a special page. A text says their account will be deleted in an hour. A direct message that looks like it is from a friend asks them to vote in a contest by entering a code. Students also believe a familiar logo proves a message is real, and they tend to trust a link if the visible text names the right company. Another common belief is that clicking is harmless as long as they do not type anything. In class, the trap is teaching phishing as a one-off warning poster. Students nod, then fail a realistic example the next week because the lesson gave them rules about emails instead of an eye for the tactics behind any message. They need repeated practice with varied examples and a habit they can use on their phones.
What works
Activities that train the eye
Use made-up companies and names in every example so no real brand or student is involved. Short, frequent practice beats one long lesson.
- Print ten messages, some genuine and some phishing, and have pairs sort them with reasons.
- Show a link on paper with its friendly text and its real address side by side.
- Give students a red-flag checklist: urgency, reward, threat, odd sender, request for a code.
- Act out a phone call where a caller pretends to be tech support and asks for a password.
- Have groups write a fake phishing message on paper, then swap and annotate each other's tricks.
- Rehearse the response: do not click, open the real app yourself, tell an adult, report it.
Step by step
A five-day phishing awareness plan
The days build from recognizing tricks to responding calmly when something has already gone wrong. Each fits a single class period.
- Day 1: What phishing wantsStudents list what a scammer could gain from a password, a game account or a one-time code. This makes the goal concrete before any examples appear and explains why young people are targets too.
- Day 2: The tacticsIntroduce urgency, rewards, fear and impersonation. Students match short printed messages to the tactic each uses, then rewrite one message to remove the pressure and show how ordinary it becomes.
- Day 3: Links and sendersCompare lookalike addresses and links letter by letter. Students circle the difference in each and practice the habit of opening an app or typing a known address instead of following a link.
- Day 4: Beyond emailWork through texts, game chats, social media messages and phone calls. Students sort a mixed set and explain which red flags appear in every format and which are specific to one.
- Day 5: What to do after a clickWalk through steps if someone already clicked or shared a password: tell an adult, change the password from the real site, report the message. Students write a short guide for a younger sibling.
Ready-made option
A ready-made phishing unit
The AI & Cybersecurity Units Bundle ($89.99, parts bought separately $149.94) includes Cybersecurity: Phishing & Social Engineering, with leveled worksheets on four levels, a reading text, a hands-on task, slides and full answer keys with a marking guide. The bundle's Data Protection and Cyber Safety unit pairs naturally with it, and the other units cover AI, prompting, filter bubbles and encryption. If phishing is all you need this term, that unit is also sold alone for $24.99. Teachers of Grades 7–10 who want a smaller set can use the AI Literacy & Cybersecurity Activities ($69.99), which include recognizing phishing and protecting personal information.
Honest limits
Before you rely on the material
The unit teaches recognition and response; it does not include email accounts, simulation software or a way to send test messages to students. If your school runs phishing simulations, coordinate with your IT staff. You will want to add current examples from apps your students use, using invented names. Read through the lessons alongside your state's digital safety or computer science standards to see where they fit. Licences are for your own classes; ask Teach Lessons with a short message before sharing across a team. Within 7 days, a product that does not suit you can be exchanged for store credit of equal value.
Good to know
More teacher questions
Should I send students a fake phishing email as a test?
Only with your school's approval and your IT team involved, since simulated phishing touches school accounts and trust. In most classrooms, printed or projected examples give the same practice without the risk of embarrassing a student. If a test does happen, debrief privately and focus on the tactic, never on who clicked.
What are the most common scams aimed at middle schoolers?
Free game currency or skins, fake giveaways from influencers, messages claiming an account will be closed, requests from a hacked friend's account to share a code, and fake prize or contest links. Build your examples around these, using invented brands, so students practice on situations they actually meet.
Is bad spelling still a good sign of phishing?
It can be a clue, but teach students not to rely on it. Many phishing messages are well written and use real logos. The stronger signs are pressure to act fast, unexpected requests for codes or passwords, rewards that seem too good, and sender addresses or links that do not match the company.
Does the phishing unit match my state's standards?
Teach Lessons does not state that the unit is aligned with any state's standards, CSTA or ISTE. Cybersecurity and online safety appear in many computer science and digital literacy frameworks under different headings. Check the unit's tasks against your own standards and note which parts support them before you plan.
How do I teach phishing without scaring students?
Keep the tone practical. Present phishing as a trick with a pattern that anyone can learn to spot, give students a clear routine, and stress that telling an adult after a mistake is the right move. Avoid dramatic stories and spend most of the time on practice.
How often should phishing come up during the year?
A focused unit builds the skill, and short refreshers keep it. A two-minute real-or-phish warm-up once a month, using one new example, keeps students alert. Revisit the topic before holidays or big game releases, when scam messages tend to switch to gift, sale and free-item themes.
Teach the tricks, not just the warnings
Print a few made-up messages and run the sort tomorrow. A ready unit can supply the texts, leveled tasks and keys for the rest of the week.
Get the phishing unit