Spot phishing.
An 18-minute, knowledge-first lesson: what phishing is, how its mechanism works, the scam broken into 4 pieces, cases that build judgment, busted myths, and a 5-question mental model you put to the test in a final mission.
What phishing is, how its scam is built, its myths, and a 5-question model to decide on any suspicious message.
The case
You've got a new email from Banco Nacional. And this time it's in a hurry.
In 18 minutes you'll understand what phishing is, see how the scam is built piece by piece, bust its myths, and finish by applying a 5-question model to a real message.
What you will learn
- Explain what phishing is and why it works
- Take a phishing attempt apart: deception, impersonation, manipulation, and action
- Apply the 5-question model and justify a decision about a message
The 5-question model
Before trusting a message, run the chain: who? what do they want? why now? where does it take me? what information does it ask for?
Who?
The real sender, not the pretty name.
What do they want?
A click, data, money, or access.
Why now?
Real urgency or theater.
Where does it take me?
The link's destination, not its text.
What does it ask for?
Something a real company would never ask.
Frequently asked questions
What is phishing?
A social engineering scam that impersonates someone you trust (your bank, a shop) to get you to hand over your data, money, or access yourself.
How long is this micro-lesson?
About 18 minutes: context, concept, mechanism, breakdown, examples, myths, mental model, final mission, and wrap-up.
What is the difference between phishing and smishing?
Smishing is phishing by SMS or WhatsApp: the same impersonation-and-urgency logic, a different entry channel.
Test yourself: Final test: what would you do?
What is phishing?
Correct answer: A scam that impersonates someone you trust so you hand over your data yourself.
Phishing is impersonation with one goal: getting you to hand over your data while thinking you're talking to the right person.
Which of these phrases is a classic manipulation signal?
Correct answer: «Verify within 24 hours or your account will be suspended».
The dramatic deadline is fake urgency: it rushes you so you don't think and click.
An email shows the HTTPS padlock and the bank's logo. Can you trust it?
Correct answer: Not necessarily: logos are easy to copy and HTTPS doesn't identify the owner.
HTTPS encrypts the channel, it doesn't vouch for the owner, and copying a logo takes seconds. Trust the exact address and what they ask for, not the padlock.
The pocket rule — Before you act: who? what do they want? why now? where does it take me? what information does it ask for? When in doubt, verify through the official channel.
What you take away
Apply the 5-question model to a suspicious message.