Spot the Shapeshifter: A Guide to Phishing
What if you could spot a digital trickster in disguise? The sneakiest cyberattacks don't use fancy code—they use psychology. And with AI "ghostwriters" making fake messages more believable than ever, learning to spot the tricks is a true superpower. Ready to become a digital detective? Let's go! 🕵️
1. The Human Exploit
Imagine a castle. A cyber-hacker could spend all day trying to break down the giant wooden door (the computer's code). Or... they could just trick a guard into handing over the key! Social engineering is tricking people to get the key. It's usually easier than breaking down the door.
Mini-Game: Choose the Disguise!
A hacker wants to send you a fake message about a problem with your bank account. Which disguise should they wear to trick you? Click one!
Game Dev
Banker
Delivery Driver
2. Digital Detective: The Email Simulator
Look at each email carefully. Is it real or a phishing attempt? Click your verdict — if you guess it's a phish and you're right, we'll highlight the clues for you!
Dear PayPal Customer,
We have detected unusual activity on your account. To avoid permanent suspension, you must verify your identity within 24 hours.
Please click the link below to restore your account:
http://paypal-account-verify.secure-login.net/restore
PayPal Security Team · © 2026 PayPal Inc.
A new sign-in on Windows
Your Google Account ([email protected]) was just signed in to from a Windows device. If this was you, you don't need to do anything.
Review your account activity
You received this email to let you know about important changes to your Google Account and services.
Google LLC · 1600 Amphitheatre Pkwy · Mountain View, CA 94043
Hello,
We attempted to deliver your recent Amazon order but were unable to complete the delivery. A $1.99 redelivery fee is required to release your package.
Please update your delivery information and payment details here:
https://amazon-redelivery.com/update?order=7723
Amazon Logistics · Delivery Services
Hi,
We detected something unusual about a recent sign-in to the Microsoft account associated with this email. To help keep you safe, we've blocked access to your inbox and contacts.
Please review your recent activity and we'll help you take any necessary corrective action.
Review recent activity
Thanks,
The Microsoft account team
4. Evidence Hunt: Spot the Clues!
Let's turn this into a game! Click on the dotted red flags in the fake PayPal email below. Each time you find a clue, you'll earn a checkmark. Find all three to complete the mission!
Please click the link below to restore your account:
http://paypal-account-verify.secure-login.net/restore
paypa1 (with a 1) instead of paypal. Super tricky!evil-site.com/steal-your-info
⚙️ View the HTML Source
This is the actual code a web developer writes to make that link. Notice how the part you see isn't the same as the part the computer uses!
<a href="http://evil-site.com/steal-your-info">Go to TomorrowHub.ai</a>The href attribute is the REAL destination. The text between the > < symbols is just a disguise. That's the secret!
🤖 The AI Shapeshifter: A New Challenge
Watch out, detective! As of 2026, the newest trick is using AI to write phishing emails. This means many of the old clues, like bad grammar or spelling mistakes, are disappearing. AI can write perfect, convincing emails in any style.
AI can even clone voices for "Vishing" (voice phishing) attacks. A scammer might call, sounding exactly like a family member, and ask for money or a password. The red flags you've learned—like urgency and weird requests—are more important than ever!
5. URL Train Inspector Challenge
The URL (web address) is where attackers hide their best tricks. Think of it like a train: you need to find the engine to know where it's really going. The whole train wiggles when you get it right!
⚙️ Advanced Intel: How Domains Really Work
A URL has a hierarchy, like a family tree. For roblox.com.hacker-site.com:
.comis the Top-Level Domain (TLD).hacker-siteis the Second-Level Domain. This is the part someone actually buys and owns.roblox.com.is the Subdomain. The owner ofhacker-site.comcan create ANY subdomain they want to trick you!
The real "engine" of the train is always the Second-Level Domain + TLD. That's the true destination!
The Rule: The real domain is the "engine" right before the first single slash (`/`). Always click the engine! 🚂
Mission: Find the real destination (the engine 🚂) for each train below.
6. Challenge: Build Your Own Phish!
The best way to spot a trick is to learn how it's made. Let's build a (harmless) phish. Use the tools to create your sneaky message! This is your own Phish Kit Builder.
7. Sneaky Brain Tricks
Phishing works because it's designed to hack our brains, not just our computers. These tricks bypass our logic centers by triggering strong emotions.
🧠 Bonus Challenge: Spot the Brain Tricks!
Scenario 1: 😱 A pop-up screaming 'VIRUS DETECTED!' appears while you're playing a game. What brain trick is the hacker using?
Scenario 2: 👩🏫 A message from your 'principal' asks for your password to a new school portal. What brain trick is this?
Scenario 3: 🤩 A DM from your favorite YouTuber has a 'secret link' to win free merch. What brain trick is this?
8. What To Do If You Click: Your 3-Step Plan
Even pros make mistakes. If you ever accidentally click a weird link or enter your password on a fake site, don't panic! Here's your Incident Response Plan.
The best way to protect an account is with Two-Factor Authentication (2FA). This means even if a hacker steals your password, they can't log in without a second code from your phone or another device. Ask your parents to help you turn on 2FA for your important accounts, like email and gaming!
And always remember the 5-second pause. If a message feels weird or urgent, stop. Ask a trusted adult before you click. That pause is your superpower.
📖 Your Detective's Log Summary 📖
The Rush: Is it trying to scare you or make you hurry?
The Disguise: Does the sender's address look weird?
The Trap: Does the link's real destination look fishy?
9. Final Challenge: The Official Phishing Test
You've trained like a pro. Now it's time to test your skills on a quiz built by Google's own cybersecurity team. This quiz uses real examples of tricky phishing emails. Can you get a perfect score?
👨👩👧 Take This Challenge With a Parent!
This is a perfect mission to do together! See if your family can get a perfect 8/8 score. For each email, talk about why you think it's real or fake before you click. It's a fun way to build your family's digital defense team!
👨👩👧 Parent Corner: From Learning to Doing
Great job working through this! Now is the perfect time to level up your family's security together. Here are a few co-op missions:
- Enable 2FA: This is the single most effective thing you can do. Sit down with your child and enable Two-Factor Authentication on their most important accounts (email, Roblox, Steam, etc.). It's a fantastic real-world application of this lesson.
- Pro Tool Co-op: Found a weird link? Use VirusTotal or urlscan.io. These free tools safely analyze links and files. Analyzing a real spam email together feels like you're in a cyber command center! (Note to advanced learners: you're ready to use these pro tools yourself, with permission!)
- Start a "Weekly Security Sync-Up": Spend 5 minutes on Sundays checking in. "Did anyone get a weird message this week?" This normalizes safety conversations and makes it a family habit, not a lecture.
- Create a Family Tech Contract: Use a template online to create a simple agreement about screen time, app downloads, and what to do when something scary happens online. Signing it together makes it a team effort.
🕵️ Security Clearance Quiz
Prove you can think like a cybersecurity analyst!