Middle School · Digital Citizenship · Unit 2

Spotting Scams and Phishing

"You won free game currency! Click in the next 10 minutes!" Scammers fish for your passwords and money. Here's how to stay off the hook.

A scam message doesn't look like a villain. It looks like your game, your school, your bank, or even your best friend. That's the whole trick.

On this page you'll learn what phishing is, the warning signs to look for, how to check a link, the tricks scammers use most, and what to do if a message seems off. Then you can sort real-looking messages in a game and take a self-guided quiz.

Start the lesson Jump to the game

What's phishing?

A scam is a trick to get your money, your information or your accounts. Phishing (said like "fishing") is a scam that uses a message as bait. It might be an email, a text, a direct message in a game or app, or even a phone call.

The message pretends to come from someone you trust. It wants you to click a link, open a file, or share a password or code. If you bite, the scammer can take over your account or your money.

Your digital footprint matters here too. The more personal details you post publicly, the easier it is for a scammer to write a message that sounds like it really knows you.

Five warning signs

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Trade Commission (FTC) list signs like these:

1. It's urgent or scary

"Your account will be deleted in 1 hour!" Scammers rush you so you don't stop to think.

2. It's too good to be true

Free skins, free phones, a prize for a contest you never entered.

3. It asks for private info

Passwords, login codes, home address, or a parent's card number. Real companies don't ask for your password in a message.

4. It wants odd payment

Only scammers demand gift cards. The FTC says no real business or government agency will tell you to pay with one.

5. The sender or link is a little off

An address like support@arnazon-help.example instead of the real company, or a shortened link that hides where it goes.

Did you know? Misspellings used to be a big clue. CISA now warns that some scam messages, written with AI, have perfect spelling and grammar. So check for the other signs too.

Check the link before you click

A web address has a domain, the main name of the site. Find the first single slash after https://. The real domain is the name and ending just before it (like name.com).

https://www.roblox.com/login: the domain is roblox.com. That's the real site.
https://roblox.com.free-robux.example/login: the real domain is free-robux.example. "roblox.com" is just a disguise at the front.
https://rob1ox.example: a number 1 swapped for the letter l. Sneaky look-alike.

Safest habit: don't use the link at all. Open the app yourself, or type the address you already know.

Common tricks aimed at students

Free game currency

"Log in here to claim 10,000 free coins." The page steals your username and password.

The hacked friend

A friend's account messages you: "Can you send me the code you just got?" That code can let someone break into your account. Check with your friend another way, like in person or by phone.

Gift card emergency

"I'm in trouble, buy gift cards and send me the numbers on the back. Don't tell anyone." The secrecy is a giveaway.

Fake account warning

"Suspicious login! Verify your account now." The FTC says scammers often claim a problem with your account that doesn't exist.

Your move: stop, check, ask

Stop. Don't click, reply, or download. Not even an "unsubscribe" link.
Check. Contact the company or person a different way you already know is real: the official app, a website you type yourself, or a phone number you already have.
Ask. Show a parent, teacher or other trusted adult. You won't be in trouble for asking.
Report and delete. Use the app's or email's report button, then delete the message. A grown-up can also report scams to the FTC at ReportFraud.ftc.gov.

Already clicked or shared something? Don't panic, and don't hide it. Tell a trusted adult right away, change that account's password from the real app or site, and turn on two-step login. Acting fast makes a big difference.

Try the interactive version at jugami.com/digital-citizenship/spotting-scams/

Scam or Safe?

Tap or click Scam or Safe for each message. About 2 minutes.

Try the self-guided quiz at jugami.com/digital-citizenship/spotting-scams/

Self-guided quiz

The self-guided quiz needs JavaScript turned on. Try each question on paper, then check the answer key.

What is phishing? Answer: A message used as bait to steal info.

Which is a warning sign of a scam? Answer: It says you must act right now.

What is the real domain in https://roblox.com.free-robux.example/login? Answer: free-robux.example

A message says to pay a fine with gift cards. What is it? Answer: A scam, every time.

A friend's account asks for the login code you just got. Best move? Answer: Check with them another way.

Why isn't perfect spelling proof a message is safe? Answer: AI can write scams with no typos.

You clicked a bad link and typed your password. What first? Answer: Tell an adult and change it.

Talk about it

Why do you think scammers so often pretend to be a friend instead of a stranger?
Have you seen an ad or message that felt "too good to be true"? What gave it away?
Why might someone feel embarrassed to tell an adult they clicked a scam link? How could we make it easier?

Sources

Cybersecurity and Infrastructure Security Agency (CISA), "Recognize and Report Phishing": warning signs, the note about AI and perfect grammar, and "don't click unsubscribe."
Federal Trade Commission, "How To Recognize and Avoid Phishing Scams": fake account problems and contacting companies a way you know is real.
Federal Trade Commission, "Avoiding and Reporting Gift Card Scams": only scammers demand gift cards.
Federal Trade Commission, ReportFraud.ftc.gov.

Credits: all illustrations on this page are original SVG art made for Jugami. Example web addresses are made up for teaching; don't visit them.