What you'll learn
- Recognize phishing pressure tactics and spoofing
- Inspect domain names without opening suspicious links
- Respond to potential account compromise
Spot common phishing warning signs
Phishing attempts persuade people to reveal information, send money, or open harmful links. Attackers often use urgency and impersonation.
Hands-on steps
- Imagine a message saying: "Your domain expires in 10 minutes! Sign in using this link."
- Look for pressure, unusual sender details, unexpected requests for passwords, and strange domains.
- Do not open the message link. Visit your domain registrar by typing the known address yourself.
- If the renewal message is genuine, verify it within your trusted account dashboard.
Remember: Scammers can spoof names and logos, so visual appearance alone does not establish authenticity.
Knowledge check: Should you trust an urgent renewal message because it displays a familiar logo?
No. Verify through the service website or app you already trust.
Read a URL carefully
Attackers may put a brand name in a subdomain or path to make a link look official. The registered domain is the crucial part of the address.
Hands-on steps
- Look at this harmless made-up example as text only: https://cloudflare.example.net/security (do not browse it as a Cloudflare page).
- Identify that example.net is the registered domain; "cloudflare" is just a subdomain label.
- Compare it with https://dash.cloudflare.com, where the registered domain is cloudflare.com.
- Practice by examining, not visiting, three suspicious links. Never paste private reset or verification links into public scanners.
Remember: A brand name somewhere in a URL is not enough. Read the actual registered domain.
Knowledge check: In login.example.com.attacker.test, is example.com the registered domain?
No. The final registered domain is attacker.test in this illustrative address.
Verify requests outside the message
Unexpected messages may claim to be from a bank, family member, delivery company, or technical support. Verification should not rely on contact information supplied in the same suspicious message.
Hands-on steps
- If a message requests money, codes, identity documents, or an urgent password reset, stop before responding.
- Open the official app or type the known website address yourself; do not follow the message link.
- Call a saved number or a number listed on a statement or official website.
- Report the suspicious message using the service’s built-in report button and remove it if appropriate.
Remember: Independent verification breaks the attacker’s control over the conversation.
Knowledge check: Which phone number should you use to verify a suspicious bank text?
A trusted number from the bank’s official app, website, or bank statement—not the number in the text.
Respond if you clicked or shared information
Fast action can limit damage. The right response depends on whether you simply visited a page, installed something, or gave up a password or MFA code.
Hands-on steps
- Stop using the suspicious page. Do not download further files or enter additional information.
- If you entered a password, open the real website directly and change it; also change that password anywhere else it was reused.
- Review recent sign-ins, recovery methods, connected devices, and active sessions; sign out unknown sessions where supported.
- If you installed software or suspect device compromise, disconnect when appropriate, update and scan the device with trusted tools, and contact official support. For financial loss, contact the bank promptly.
Remember: Keep a simple record of what happened, the time, affected accounts, and steps taken.
Knowledge check: If you gave away an MFA recovery code, is changing only the password enough?
Not necessarily. Revoke/regenerate compromised recovery codes and review all sign-in methods and active sessions.
Reliable places to learn more
These are independent educational resources, not paid endorsements.
