Pipeline draft · Security awareness
DRAFTRecognising a phishing email
This lesson left the pipeline and nobody published it. It passed the structure and concept-ordering gates; the rubric gate result below is read from the verdict files beside it. Rubric gate: passed with three independent models, means 4.38–5.00, largest disagreement on any one criterion 1 point. LLM rubric scores, not human QA.
- SEC-01Given an email, identify the signals that distinguish a phishing attempt from a legitimate message, and take the correct action
The attack is on the reader, not the system
Phishing does not attack software. It attacks the person reading the screen, which is why a fully patched system still loses to a well-written attacker. The defence is not a tool — it is a **habit**: checking two or three things before acting.
The weakest signal in any message is the sender's **display name**, and it is the one people trust most. A display name is free text: a sender can type a colleague's name, an internal department, or a bank, and it renders exactly as typed. What cannot be set freely is the **address** behind it. Reading the address rather than the name shown is the first check.
A genuine registered domain chosen to be misread rather than examined: a letter pair that takes another shape at a glance, an added or removed hyphen, a different top-level domain on an otherwise correct name. Not a technical failure — it relies entirely on a reader scanning instead of reading.
A temporary code sent to you to prove who you are. It exists precisely because it is not shareable. Anyone asking for it — including someone claiming to be internal support — is asking for the only thing standing between an attacker and an account whose password they already have.
Key takeaways
- A display name is free text; the address behind it is the evidence.
- Link text is a label and its destination is another thing — reveal the destination before following it.
- Urgency is engineered: it is there to remove the pause in which you would check.
- A request for a password or a one-time code ends the conversation, however convincing the rest is.
- Verify through a channel you already had, never through anything inside the message.
Work one message, signal by signal
A message arrives with the display name “IT Service Desk”. It says your account closes in two hours, carries a “Confirm account” button, and asks for the verification code you are about to receive. Run the checks in order.
Knowledge check — not scored
A message carries a display name that exactly matches an internal department you know. Which signal outranks that name?
Select one answer.
A message from your manager's display name: he is in a meeting and cannot take calls, and needs a supplier payment moved before end of day. The tone reads like his, and the reply-to address differs from the sending address.
Knowledge check — not scored
You are now sure a message was phishing, and you clicked the link before you noticed. What is the correct action?
Select one answer.
Files in the repository: lesson.json · items.json · STATUS.md