Step 1 of 6 Phishing and suspicious messages
The hook
Phishing is a message that pretends to be from someone you trust, such as your bank, a delivery company or your boss. It wants you to click a link, open a file, pay, or give away a password. The name comes from fishing: the message is the bait, and you're meant to bite.
This lesson explains how phishing works. Every bank, company, person and web address in it is invented. If you think you've been scammed, contact your bank and report it.
Open the messages in the inbox. Find the phishing one and report it.
Phishing isn't only email. Which of these can carry it?
Step 2 of 6 Phishing and suspicious messages
The pressure
Scammers press buttons that stop us thinking. They claim authority ("your bank", "the police"), add urgency ("within 24 hours"), stir up fear or excitement, and dangle offers that are too good to be true.
Tap each sentence in the email that puts pressure on you. Find all four tricks.
Why does pressure work so well on people?
Step 3 of 6 Phishing and suspicious messages
Who really sent it?
The name you see on a message can be typed by anyone. The address behind it shows who really sent it, and what counts is the part after the @, the domain. Dunebridge Bank's real domain is dunebridgebank.ae. Lookalikes add words, swap letters or put the real name in the wrong place.
Look closely at each sender. Which address really comes from Dunebridge Bank?
Can a scammer ever make a message look as if it came from the bank's real address?
Step 4 of 6 Phishing and suspicious messages
Where does the link go?
The words of a link can say anything. To see where it really goes, hover over it on a computer, or press and hold it on a phone, without tapping. Then read the address: the real website is the name just before the first single "/". In dunebridgebank.ae.dunebridge-signin.net/verify, that's dunebridge-signin.net, not the bank.
Hover over each link. Which one really goes to Dunebridge Bank?
The fake page shows a padlock next to its address. What does the padlock tell you?
Step 5 of 6 Phishing and suspicious messages
Check safely
Never check a suspicious message using what's in it: its links, its phone numbers or its reply button all lead back to the scammer. Check independently instead: use the organisation's own app, type its website yourself, or call a number you already know, such as the one on the back of your card.
A text says: "Zephyrlane: your parcel is held. Pay AED 12 redelivery fee: zephyrlane-redelivery.com/pay". Choose the safe way to check it.
A caller says they're from your bank's fraud team. Your account is at risk, they say, so you must move your money to a "safe account" now. What do you do?
Step 6 of 6 Phishing and suspicious messages
If you've already clicked
Anyone can be fooled, so don't panic, and act quickly. If you typed a password, change it on the real site, and anywhere else you used it, then turn on two-step sign-in. If you gave card or bank details, call your bank on the number you know. Then report the message.
In the UAE, report scams to the police (in Dubai through the eCrime service, in Abu Dhabi through Aman, 800 2626), and always tell your bank.
You typed your email password into a page you now think was fake. What's the first thing to do?
Why is it worth reporting a phishing message, even after you've spotted it?
Quiz Phishing and suspicious messages
Check what you know
Six questions, 5 points each. One answer per question.
Done Phishing and suspicious messages
Lesson complete
Now you know the bait: pressure, borrowed names and links that lie. You know to check who really sent a message and where a link really goes, to check independently, and what to do if you've already bitten.
MARIFA · Nothing you do here leaves this device.