Educational Content Studio

Educational Content Studio: practical plan

Lesson: spot common phishing signals

Learning objectives

By the end, learners can identify at least three warning signs, verify a sender through a trusted route and report a suspicious message without opening links.

Key ideas

Phishing messages may use urgent requests, unexpected attachments, look-alike sender addresses, mismatched link destinations or requests for credentials. A familiar display name is not proof of authenticity. Some legitimate messages are urgent, and some phishing messages look polished; evaluate multiple signals.

Practice

For each fictional message, mark the sender, request, link destination and pressure cue. Decide whether to open, verify separately or report.

Answer key

Message A uses an unexpected password-reset link and urgency: verify through the official site. Message B comes from a known internal address but requests payroll data: confirm through a separate channel. Message C is a routine receipt from a verified vendor with no action request: lower risk, but still check context.

Assessment

Learners explain their reasoning, not just label “phishing.”

Accessibility

Use readable contrast, alt text and keyboard-accessible examples. Update the lesson as threat patterns change.

Measurement and review

Record the baseline, source, date range, denominator and owner. Use one primary measure plus quality guardrails; compare like-for-like cohorts and disclose missing data. Treat estimates as scenarios, not observed outcomes.

Risks and controls

Check relevance, consent, disclosure, workload and downside before scaling. Keep an evidence trail, obtain human review for material commitments, and pause if trust, quality or compliance signals deteriorate.

Next steps

1. Confirm the goal, audience and available capacity.
2. Gather the minimum evidence for a first test.
3. Assign an owner, budget and review date.
4. Run a small pilot, record outcomes and decide whether to iterate, expand or stop.