An email arrives at a student's school address. From: [email protected] Subject: Account suspension today “Confirm your Ridgeview password now to keep your email.” The school's domain is ridgeviewhs.edu. How should this message be classified?

A message says: From: [email protected] Subject: Weekend controller sale “Save 20% on controllers through Sunday. Browse products at gamegear.com.” The student subscribed to GameGear sale emails. How should this message be classified?

An email says: From: [email protected] Subject: You were selected! “Congratulations! Claim your mystery prize today.” It contains no request for a password, payment, or account login, and the student never entered a contest. How should it be labeled?

A text message reads: “BankSafe: Unusual activity detected. Verify your account at banksafe-security-check.com.” The bank's real website is banksafe.com. What is this message?

An email says: From: [email protected] Subject: Hold ready for pickup “Your reserved book is ready at the Oakwood Library desk until Friday.” The student placed the hold through oakwood.edu. How should this email be classified?

An email says: From: [email protected] Subject: Payment failed “Update your card immediately at streamnow-account.org to avoid cancellation.” The real streaming service uses streamnow.com. What type of message is this?

A student receives five identical emails advertising study guides from a company they never contacted. The emails link to the seller's real website and do not ask for a login or payment information. How should the emails be classified?

An email says: From: [email protected] Subject: New assignment posted “A new biology assignment is available in your CloudClass course.” The link opens cloudclass.edu, which the class normally uses. What is the best classification?

A message says: From: [email protected] Subject: Direct deposit update required “Enter your employee ID and password before 3 PM.” The district's payroll site is district-payroll.org. How should this be classified?

A student gets an unsolicited email promoting a downloadable wallpaper collection. It has an unsubscribe link, no account request, and no claim to represent a service the student uses. What is it most likely?

A text reads: “City Utilities: avoid shutoff. Pay at cityutilities-billing.info.” The real utility website is cityutilities.gov. Which detail is the strongest evidence of a scam?

An email says it is from a gaming platform and asks for a one-time verification code. Its sender is [email protected], which matches the platform's official domain, gamezone.com. Which feature is most suspicious?

A message reads: “Your package is waiting. Pay $2.14 at parcel-track-support.net.” The carrier's real site is parceltrack.com. What gives the scam away most clearly?

An email from [email protected] says, “A password reset was requested. If this was you, use the password-reset page you opened yourself.” It does not contain a link. Which detail supports that this may be legitimate?

A caller says, “I am from your phone carrier. Read me the code just texted to you so I can stop the account takeover.” What is the strongest warning sign?

A school email claims to be from the principal. Its display name is “Dr. Chen,” but its sender address is [email protected]. Staff addresses normally end in northstarhs.edu. Which feature is strongest evidence of impersonation?

A pop-up says, “Your laptop has 17 viruses! Call 1-800-555-0199 within five minutes for immediate repair.” Which feature is the clearest evidence of a scam?

An email says: From: [email protected] “Your receipt is attached. For account questions, sign in by typing musicbox.com into your browser.” The student made the purchase. Which feature is the best evidence that it could be legitimate?

A text claims to be from a school counselor and says, “Send your student ID and password now so I can register you before the deadline.” Which detail is the strongest evidence of a scam?

An email from [email protected] says a student's channel will be deleted unless they sign in at videohub-support.com. The real site is videohub.com. What is the clearest warning sign?

An email says, “Your class photo order is ready,” and includes a link shortened as bit.ly/3PhotoOrder. The school photography company normally uses brightphoto.com. Which feature deserves the closest inspection?

A student gets an email saying, “We noticed a sign-in from a new device. Do not reply; open your saved bookmark for the account site if you need to review activity.” Which feature makes this safer than a typical phishing message?

A person wearing a visitor badge stands near a secure office door. When an employee badges in, the visitor quickly walks in behind them without using a badge. Which social-engineering technique is being used?

A USB drive labeled “Final Exam Answers” is left on a hallway floor where students will likely find it. What technique does this describe?

Someone calls the attendance office, claims to be a technician fixing the printer, and asks for the office computer's login so the repair can begin. What technique is this?

On a crowded bus, a person watches closely as another rider unlocks a phone and enters a passcode. Which technique is being used?

A stranger leaves a note in the staff lounge: “Free concert tickets! Plug in this flash drive to reveal your code.” Which social-engineering technique is involved?

A person carrying a tall stack of boxes waits outside the locked records room. When an employee unlocks the door, the person slips in right behind them without being let in. What is this technique?

At a coffee shop, someone sits behind a student and records the student's screen while the student signs in to a scholarship website. What technique is this?

A caller says, “I work in the superintendent's office and need the Wi-Fi password for an emergency board meeting.” The caller gives a made-up employee number. Which technique is being used?

An unknown person places a QR code sticker over a parking-meter payment code and writes “Scan for free parking credit.” What technique does the offer use?

A visitor waits outside a badge-controlled lab. When a student badges in and opens the door, the visitor walks in close behind before it shuts, without saying anything. What technique is this?

A student typed a school password into a fake site and then noticed the domain was not the school's. What should the student do first?

After entering a gaming-account password on a fake login page, a student realizes that the same password is used for email. What is the best immediate action?

A student gave a fake scholarship page their username and passphrase. What is the most important next step?

A student entered their library password on a fraudulent page. That password is also used for a music account. What should happen next?

A fake school portal collected a student's username and password. The student uses multi-factor authentication on the real portal. What should the student do first?

A student submitted a password to a fake online-store checkout page. The same password protects a cloud-storage account. Which response is best?

After typing a password into a page reached from a suspicious email, a student realizes the site was fake. What action best protects other accounts using that password?

Four emails claim to be from riverbank.com. Which sender address does NOT belong to that domain?

A university's real domain is westfield.edu. Which link is an impostor?

A store uses the domain northstarbooks.com. Which address is not from the store?

A school district's website is cedarvalleyschools.org. Which link is the impostor?

An online game uses playforge.net. Which sender address should be treated as an impostor?

A community clinic uses healthpoint.org. Which URL does not belong to the clinic?

A delivery company uses fastparcel.com. Which email address is the impostor?

A video service uses watchwell.tv. Which link should not be trusted as belonging to that service?

An athletic club's real domain is lakesiderunners.org. Which sender is an impostor?

A state park reservation site uses pinecrestparks.gov. Which URL is an impostor?

A caller offers a free antivirus subscription if a student installs an app from a USB drive handed out at a mall. Which social-engineering technique is used?