🎯 What you will learn
- By the end of this lesson you'll know what phishing is and why it works.
- You'll recognise its different forms: email, smishing, vishing, social media and QR codes.
- You'll be able to spot the warning signs of a scam message.
- You'll know how to check a link before you open it.
- You'll know exactly what to do if you've clicked or given away information.
What is phishing?
The word phishing comes from fishing. The scammer casts a “hook” (a tempting or frightening message) and waits for someone to “bite”: to click a link, type in a password, give away card details or download a harmful program.
Phishing doesn't attack the computer – it attacks the person. It plays on our emotions: curiosity, fear, being in a hurry, wanting something for free. Today, with the help of artificial intelligence, fake messages often have no spelling mistakes and look very convincing – so we need to learn to look out for other signs.
Different kinds of scam
- Email phishing – an email that looks as if it's from a bank, Netflix, your school, the post office or Microsoft, with a link to a fake login page.
- Smishing (SMS) – text messages such as “Your parcel has been held, pay €1.50 here” or “You've won an iPhone”.
- Vishing (phone calls) – someone rings up claiming to be from the bank, the police or the phone company and asks for codes or personal details. With AI, the voice can even imitate someone you know.
- Social media and chat – messages from fake or hacked accounts: “Is this you in this video? 😱”, “Vote for me in this competition”, “Win free skins”.
- Quishing (QR) – fake QR codes on posters, in car parks, in emails or stuck over real codes, which take you to scam websites.
Warning signs
When you get a message, stop and check for these signs:
- Urgency or fear: “Your account will be closed within 24 hours!”, “Act now!”
- Something too good to be true: free prizes, money, phones or in-game currency.
- A request for secret information: a password, verification code, PIN, card number or CVV.
- A strange sender: an address like support@instagram-help-team.xyz instead of the official domain.
- A link that doesn't match: the text says one thing, but the real address is something else.
- A generic greeting: “Dear customer” instead of your name.
- Unexpected attachments: .zip, .exe or .apk files, or documents asking you to “Enable content”.
How to check a link
- On a computer, hover your mouse over the link without clicking and look at the address that appears at the bottom of the screen. On a phone, press and hold the link to see it.
- Look at the main domain – the part just before .com, .org, .net, .eu and so on. For example, paypal.com.account-security.ru is NOT PayPal; the real domain here is account-security.ru.
- Watch out for look-alike letters: rnicrosoft (r+n) instead of microsoft, or g00gle with zeros.
- Shortened links (bit.ly and the like) hide the real address – treat them with care.
- Safest of all: don't click at all. Open the official app, or type the address you know into the browser yourself.
The padlock (🔒) and https only show that the connection is encrypted – not that the website can be trusted. Scammers use https too.
QR codes: scan smart
QR codes are handy, but you can't tell just by looking where they'll take you. So:
- When you scan one, your phone usually shows you the address before opening it – read it before you tap.
- Be careful with QR codes stuck on posters or payment machines – they could be fake stickers placed over the original code.
- Don't enter passwords or card details on a page opened from an unknown QR code.
- An email asking you to scan a QR code to “verify your account” is almost always a scam.
I've clicked! What do I do now?
It happens to adults too – don't be embarrassed, just act quickly:
- Don't type anything else on that page. Close it.
- If you typed in your password: change it straight away through the official app or website – and everywhere else you've used it.
- Turn on 2FA and sign out of all other devices.
- If you gave away card details: tell a parent immediately, so they can contact the bank and block the card.
- If you downloaded something: disconnect from the internet and scan the device with antivirus software; ask an adult for help.
- Report the message as phishing/spam in the app and warn your friends.
- If money has been lost or someone is making threats, your family can report it to the Kosovo Police (192).
📖 A real-life story
Arta, 15, from Prishtina, was waiting for a parcel from an online shop. She got a text message: “Your parcel cannot be delivered because the address is incomplete. Pay €1.99 for redelivery: post-delivery-ks.info”. Arta almost clicked, because she really was expecting a parcel.
But she stopped to think: the amount was small “so as not to raise suspicion”, the address wasn't the official website and it was asking for her mum's card details. Arta checked the status of her parcel by going to the shop's website herself – the parcel was fine. She reported the text as spam, deleted it and warned her friends in the class group chat.
✅ Do / Don't
✅ Do this
- Stop and think before you click, especially when a message is rushing you.
- Check the sender's address and the link's domain.
- Open websites by typing the address yourself, or use the official app.
- Double-check another way (ring your friend, ask your teacher).
- Read the address that appears when you scan a QR code.
- Report suspicious messages as phishing or spam.
- Tell an adult straight away if you've clicked or given away information.
- Use a password manager – it won't fill in your details on fake websites.
❌ Don't do this
- Never give your password, verification code, PIN or CVV by message or over the phone.
- Don't open unexpected attachments (.zip, .exe, .apk).
- Don't believe “free” offers of phones, money or in-game currency.
- Don't let “your account will be closed” threats rush you.
- Don't forward scam messages to your friends “as a joke”.
- Don't rely on the padlock 🔒 alone to decide whether to trust a website.
- Don't ring numbers you're given in a suspicious message.
👨👩👧 For parents and teachers
Phishing affects people of all ages – adults included. Talking openly is the best protection.
- Show your child examples of scam messages you've received yourself, and turn it into a “spot the signs” game.
- Agree on a family rule: no codes, passwords or card details are ever given out without asking a parent first.
- Reassure your child that they won't be told off if they've clicked – the aim is for them to tell you quickly.
- Teachers can use the “Spot the scam” exercise on this website and discuss each sign in groups.
- Beware of phone “emergencies”: agree on a secret family code word for situations where someone urgently asks for money.
🧠 Mini-quiz
Answer 3 questions. Get at least 2 right and the lesson is marked as completed in your passport.