Unit 7 · Cybersecurity · Lesson 7.7

Phishing and Attacks on People

No cipher was broken in any successful phishing attack. The attacker didn’t need to — they asked, and someone typed the password in. Today: the signals, and the habit that works even when the fake is perfect.

Big Idea 5 — Impact of ComputingCED 5.6

Before this lesson — read on Runestone

20.3.1 Types of Cyber Attacks

Ten minutes. Read it before class; we start from it. Enrolled in our Runestone course? Open it from there so your progress counts.

Where We Are

People→ Bits→ Programs→ Internet→ Security→ Big Data→ Impact

Security, reaching back to People. Strong encryption and MFA protect against machines. This lesson is about the human in the loop.

The Hook

Real or fake? Vote first. Your teacher shows four messages — a district login notice, a scholarship email, an “account will be closed” warning, a package text. Vote on each before the reveal.

Expect the class to get at least one wrong. That’s the lesson.

The Idea

Phishing is a fake message — email, text, call, or website — designed to trick someone into giving up information or clicking something harmful. It’s one kind of social engineering: attacking the person instead of the technology. Spoofing is faking where a message comes from — a sender name, a phone number, a web address.

The common signals:

Signal	Sounds like
Urgency	“within 24 hours,” “final notice,” “your account will be closed”
Authority	the principal, IT, the bank, a delivery company, the government
A link that doesn’t match	the text says one address; the real destination is another
Skipping the normal process	“just reply with your password,” “pay with gift cards”

The honest part: good phishing can be nearly perfect, so spotting it by eye isn’t a reliable defense. The defense that works is a procedure: never act through the message itself. Go to the site by typing its address or using the app you already have, or call the number you already know. If the message was real, the request will be there too.

Try It — Inspect the Messages

All examples use made-up organizations. Examples reviewed October 2026; next review January 2027 — phishing styles change, so stale examples teach the wrong habits.

Part 1. Red flags, or no red flags? Every explanation ends the same way for a reason.

Part 2. Hovering over a link (or long-pressing on a phone) shows where it really goes. Does the real destination match what the link claims?

Vocabulary

phishing Security: A fake message designed to trick a person into revealing information or taking a harmful action.
social engineering Security: Manipulating people, rather than breaking technology, to gain access or information.
spoofing Security: Faking the source of a message — a sender address, caller ID, or web address — to look trustworthy.

Check

Five scenarios. Pick the action, not just the label.

0 of 5 answered

Impact Check

Who gets targeted

Phishing often aims at people with the least support: older relatives, new employees, anyone rushed or stressed. Advice that says “just be vigilant all the time” fails exactly those people. A simple rule they can follow — “call me before you click anything about money or passwords” — protects them better. Who in your family could use that rule?

Connections

Came from 7.6 — MFA limits the damage when a password is phished — the attacker still lacks your phone.

Came from 7.5 — a padlock doesn’t mean honest. Phishing sites have valid certificates for their look-alike names.

Came from 5.13 — same move as the claim relay: evidence in, judgment out.

Next in 7.8 — the other way in: software that does the attacker’s work for them.