Lab 02 · Intro to Cybersecurity · About 45 minutes
Spot the Phish
Phishing tricks people into handing over passwords, money, or access, and AI has made it more convincing than ever. You'll learn how modern scams work, why they fool smart people, and how to slow down and verify. Along the way you'll complete 2 hands-on challenges, document your work, and write a professional lab report.
Your browser isn't saving progress right now (this happens in private windows and some strict browsers). The lab still works. Finish it in one sitting, or reopen it in a regular window.
Step 1
Before you begin
Locked
Same three boxes as every lab:
- HintHelp if you get stuck. Searching the web or asking an AI is encouraged; check what it tells you against your own screen.
- ChallengeHands-on work you do yourself, then capture as evidence for your lab report. Tick the box when you have it.
- Quick checkA question to make sure it clicked. Unlimited tries, and every answer explains why.
Safety first. Later in this lab you'll look for real scam messages. When you find one: don't click its links, don't open its attachments, don't reply, and don't call any number in it. Looking is safe; interacting is not.
Step 2 · Lesson
Phishing comes in many forms
Locked
Phishing is any attempt to trick a person into giving up information, money, or access by pretending to be someone trustworthy. It's one of the most common ways attacks begin, because it's often easier to fool a person than to break into a computer.
| Type | What it looks like | What the attacker is after |
|---|---|---|
| Email phishing | Mass emails pretending to be a bank, a delivery company, or a popular service | Passwords, card numbers, malware on your device |
| Spear phishing | A message written for one specific person, using details about their life or job | Access to a company, often as the first step of a larger attack |
| Whaling | Spear phishing aimed at executives and other high-value targets | Large payments, sensitive company data |
| Smishing | Phishing by text message: fake delivery notices, toll fees, bank alerts | Card numbers, logins, two-factor codes |
| Vishing | Phishing by phone, increasingly with AI-cloned voices | Codes, payments, remote access to your computer |
| Quishing | A QR code that leads to a fake login page, on a flyer, parking meter, or email | Logins and payment details, while dodging email link scanners |
| Business email compromise | A fake or hijacked boss or vendor asks for an urgent payment or changed bank details | Money, often in very large amounts and hard to recover |
| Fake support | Pop-ups, search ads, or calls claiming your computer is infected | Remote control of your computer, payments, gift cards |
The damage can be much bigger than one stolen password. A single click at work can be how a criminal group gets inside a whole company, and many ransomware attacks start exactly this way.
Quick check
Your phone gets a text: a package couldn't be delivered, tap the link to reschedule. What type of phishing is this?
Quick check
A parking meter has a sticker with a QR code: “Scan to pay.” Why should you be cautious?
Step 3 · Lesson
The old red flags, and why they're not enough
Locked
For years, people were taught to spot phishing by its mistakes. These signs still catch plenty of scams, so keep checking for them:
- Typos and awkward grammar
- Generic greetings like "Dear Customer"
- Look-alike addresses, such as
paypa1.comorsupport@microsoft-help.co - Links that don't match. Hover over a link (or press and hold on a phone) to see where it really goes.
- Unexpected attachments, especially ones asking you to "enable content"
But a message without these flaws is not automatically safe. AI tools now let attackers write flawless, friendly, personalized messages in any language, in seconds. Attackers also break into real email accounts and send scams from them, so the sender address is genuine. They host fake login pages on trusted services, so the link points to a real, well-known domain. And with a few seconds of recorded audio, AI can clone a person's voice for a phone call.
So the most important question isn't "does this look fake?" It's "does this request make sense?"
- Was I expecting this message?
- Is this how this person or company normally contacts me?
- Is it asking me to skip a normal step, keep a secret, or act right now?
Quick check
A perfectly written email from your coworker's real email address asks you to quickly buy gift cards for a client and send the codes. What's going on?
Quick check
You hover over a link and see https://login.microsoft.com.account-verify.net/signin. Whose website is it?
Quick check
A link in an email points to a page on a well-known file-sharing or forms service, and asks you to sign in to view a document. Is it safe because the domain is legitimate?
Step 4 · Lesson
Pressure is the weapon
Locked
Scammers rarely rely on technology alone. They rely on psychology: getting you to act on emotion before you think. Nearly every scam uses one or more of these levers:
| Lever | What it sounds like |
|---|---|
| Urgency | "Your account will be closed in 24 hours." |
| Fear | "Suspicious login detected." "A warrant has been issued." |
| Authority | "This is the IRS." "The CEO needs this done now." |
| Reward | "You've won." "You're owed a refund." |
| Curiosity | "See who viewed your profile." "Your package is on hold." |
| Helpfulness | "I'm stuck in a meeting and need a quick favor." |
The defense is simple to say and hard to do: slow down. Real organizations can wait the few minutes it takes you to check. When a message pushes you to hurry, that pressure is itself the warning sign. Verify through a channel you already trust: call the number on your card, type the company's website yourself, or message the person directly.
And be honest with yourself: anyone can fall for a scam. Smart, careful people get caught when they're tired, busy, stressed, or when the message happens to match something real, like an order they just placed. Attackers count on this and time their messages for busy moments. Falling for one isn't a sign of being foolish. What matters is reporting it quickly, because fast reporting limits the damage.
Quick check
You get a text: "Fraud alert: did you just spend $847 at an electronics store? Reply NO to cancel." Your heart jumps. What's the best move?
Quick check
Your grandmother gets a call from someone who sounds exactly like you, crying, saying you're in trouble and need money sent right away. What would protect her best?
Quick check
You typed your password into what turned out to be a fake login page. What should you do first?
Step 5 · Lesson
Information is ammunition
Locked
The most convincing scams are built from ordinary, harmless-seeming information. On its own, none of it is secret. Put together, it lets an attacker sound like an insider.
- A social media post: "First day at my new job!"
- A professional profile listing your manager and your team
- A company website that shows the email format:
firstname.lastname@company.com - Vendor names, office locations, and who's on vacation this week
Combine those, and an attacker can text a brand-new employee, pretending to be their CEO, asking for an urgent favor, which is a scam that really does target new hires. Gathering public information like this is called OSINT (open-source intelligence), and attackers do it before almost every targeted attack.
That's why information security matters for everyone, not just IT. Think before you post about work, be careful about who you tell how your company operates, and verify identities before you share anything, even with someone who seems to know all the right names.
Quick check
Why would an attacker care about an employee posting a photo of their new work badge?
Step 6 · Lesson
Defenses that work before you ever see a scam
Locked
Much of the protection happens before a message reaches you:
| Defense | How it works |
|---|---|
| Spam and phishing filters | Score each message on the sender's reputation, known scam patterns, and the links inside, then block it or send it to spam |
| Sender checks (SPF, DKIM, DMARC) | Like checking a return address against a list of approved post offices. They confirm a message really came from a server allowed to send for that domain, which makes faking a company's exact address much harder. |
| Link and attachment scanning | Many email services open links and attachments in an isolated test space first, and block them if they misbehave |
| Browser warnings | Browsers keep lists of known dangerous sites and show a red warning page before you reach one |
| Phone spam filtering | Carriers and phones label likely spam calls and can filter texts from unknown senders |
| Two-factor authentication | Even if a password is stolen, the attacker still needs your second factor. Passkeys and security keys go further: they won't work on fake sites at all. |
| Password managers | They only fill in your password on the real website. If yours doesn't offer to fill in a login page, stop and check the address. |
These tools stop most phishing, but not all of it. Attackers test their messages against filters, so some always get through. That makes you the last line of defense, and every time you use the "Report phishing" button, you help train the filters that protect everyone else.
Try it
- Find the "Report phishing" or "Report junk" option in your email app
- Find your phone's setting for filtering unknown senders or spam calls
- In the US, you can forward scam texts to 7726 (it spells SPAM) to report them to your carrier
Quick check
Someone calls claiming to be from your company's IT department. They say they're fixing your account and need you to read them the code that was just texted to your phone. What do you do?
Step 7 · Challenge
Catch one in the wild
Locked
Now be the analyst. Search your spam or junk folder, your text messages, your voicemail, or your call log for a real scam attempt. Most people find one in minutes.
Hint
Remember the rules: look, but don't click, open, reply, or call. Before taking your screenshot, cover your own email address, phone number, name, and anything else personal.
Challenge 1 · Screenshot or story
Option A: Take a screenshot of a real phishing attempt you found. In your lab report, analyze it:
- What type of phishing is it?
- Which pressure levers does it use?
- What red flags can you spot, and what parts look convincing?
- What was the attacker trying to get?
- Did a filter catch it, or did it reach you?
Option B: Can't find one? Your filters (or your cleaning habits) are doing their job. Instead, write about a scam you fell for or nearly fell for: what happened, which levers it used, what made it convincing, and what you'd do differently now. A story from someone you know works too, with their permission and without identifying details.
Step 8 · Finish
Get your badge
Locked
Connelly Labs badge
Phish Spotter
Your name
Challenge 2 · Screenshot
Your badge, with your name showing.
Your lab report evidence
- Challenge 1: a real phishing attempt, or your scam story
- Challenge 2: your badge
Write it up
Put these images into a short lab report: what you set out to do, what you did, and what you found. For this lab, your analysis of the scam is the heart of the report. The Start Here guide has a template and tips. Accuracy matters more than polish.