Phishing Awareness Kit

The one idea that beats almost every scam

Scammers win by rushing you. You win by slowing down and checking another way.

A phishing message (or call, or pop-up) is someone pretending to be a person or company you trust, so that you hand over a password, a code, money, or access to your device. They don't need to "hack" anything if you open the door for them, which is why this is the most-reported kind of online crime in the FBI's yearly report.

Car version: a stranger in the parking lot says "your tire's going flat, my buddy's shop is right there, go now". The fix isn't learning every con; it's checking the tire yourself.

How to use this kit

1. Lessons (about 25 minutes total, read in any order): why scams work, each channel, how to read a link, and more.
2. Spot the phish: 18 practice messages. Decide scam or legit, then tap the clues. Some are real-looking legit ones, because not everything is a scam.
3. Teens: gaming, Discord and Instagram-style scams, and sextortion (what to do; it's not your fault).
4. Scam rules: a one-page set of rules you can print and adapt.
5. If you clicked: what to do, step by step. Nobody's in trouble for being fooled; speed is what matters.

Passwords and two-factor (2FA) matter too. Strong 2FA is what saves an account when someone does get tricked.

About the examples: every web address here ends in .example or .test, names set aside so they can never be real websites; phone numbers are from ranges set aside for films and TV. Company names in the examples (Hometown Federal Bank, ParcelGo, Empire Tollway, GameChat, PhotoGram, Maple Hardware, Maple Grocery) are invented, and no example is a copy of a real company's page; any resemblance is coincidence. Nothing you tap or type on this page is sent anywhere: it has no forms and makes no network requests, and it keeps only your progress, in this browser. In real life the addresses would end in .com, .net and so on, and the names would be ones you know.

Lessons

Tap a lesson to open it. Mark it read at the bottom; progress stays in this browser.

For teens: the scams aimed at you

Teens get targeted on purpose: game accounts, skins and in-game currency resell for real money, and scammers know teens are online a lot and don't want to "get in trouble". These are the common ones right now.

Gaming, Discord and trading

• "Free Nitro / free skins / free Robux, just log in here." Usually sent from a friend's hacked account, so it looks trusted. The link is a fake login page. Real gifts show up inside the app, not on a website that wants your password.
• "Scan this QR code to verify you're human / join the giveaway." Some apps let you log in on a computer by scanning a QR code with your phone's app. Scanning a scammer's code logs them in as you. Only scan a login QR code on a screen you are sitting in front of yourself.
• "I accidentally reported you, your account will be banned, talk to this admin." The "admin" is the scammer's friend, and they'll ask for your login, a code, or a "verification" payment. Real platform staff don't contact you through friend requests or DMs to fix a ban.
• Trading and "middleman" scams: "you go first", fake trade screenshots, a fake middleman who keeps both sides' items. Use only the game's own trade system.
• "Test my game" / "try my new mod": a download that steals saved passwords and logged-in sessions from the browser. Ask before installing anything.
• Account sellers and cheat sellers: you pay and get nothing, or get malware. Cheats also get accounts banned.

Instagram, TikTok, Snapchat and other social apps

• "Your account broke copyright rules, appeal in 24 hours or it's deleted" from an account with a check-mark emoji in its name. Real warnings appear in the app's own notifications and settings, not in DMs.
• "Vote for me in this contest!" from a friend: the link asks you to log in, and then your account sends the same message.
• Easy-money offers: "cash flipping", "be a brand ambassador, just pay for the starter kit", "I'll send you money, just send part back", jobs that pay you to move money (that's money laundering, and the "mule" can get in legal trouble).
• Someone asking you to read back a code "to prove you're real" before buying something you're selling. That code is for your account (or a phone number in your name). Never read a code to anyone.

Turn on 2FA for every game and social account.

Sextortion: what it is and what to do

What it is: someone gets (or fakes) a sexual photo or video of you, then threatens to send it to your friends, family or school unless you pay or send more. The FBI says the money version ("financial sextortion") most often targets boys 14 to 17, and it's usually run by organized crime groups overseas working from a script. Some now make fake nude images with AI from normal photos, so it can happen even if you never sent anything.

How it usually starts: a new contact who seems to be someone your age, very friendly or flirty, often "mutual friends" with people you know, who quickly moves the chat to another app, sends a photo first, and asks for one back. The threats can start within minutes: that speed is designed to panic you.

What to do, in order

1. Stop replying. Don't pay. The FBI says paying almost never makes it stop; it usually brings bigger demands, and they may post anyway.
2. Tell a trusted adult right now. Parent, relative, school counselor. You don't have to handle this alone.
3. Save the evidence, not the pictures: screenshots of their profile, username, and the threatening messages, keeping any explicit image out of the shot. Don't forward or save the explicit images, even as proof. Don't delete the chat or your account: investigators may need it.
4. Then block and report the account in the app. Blocking before you screenshot can make the profile disappear.
5. Report it: NCMEC's CyberTipline (report.cybertip.org, 1-800-843-5678) and the FBI (tips.fbi.gov or 1-800-CALL-FBI). If anyone is in danger, call 911.
6. Get images taken down: NCMEC's free Take It Down service (takeitdown.ncmec.org) helps stop images taken when you were under 18 from spreading on participating sites, without you sending the image to anyone. For adults, StopNCII.org does the same.
7. The law is on your side: under the federal TAKE IT DOWN Act (2025; no relation to the NCMEC service above), it's a crime to knowingly post sexual images of someone without consent, including AI fakes, or to threaten to. Since May 19, 2026, sites and apps built on user posts must take such an image down within 48 hours of a valid request, and make a reasonable effort to remove copies. Use the site's removal form; you or someone acting for you, like a parent, can send it. If a site ignores it, complain to the FTC at takeitdown.ftc.gov.
8. Lock the accounts: change passwords and turn on 2FA on the account involved and your email.

For parents

Your first reaction decides whether they come to you next time. Stay calm, say "thank you for telling me, we'll fix this together", and skip the "why did you…" questions for later (or forever). Then follow the steps above with them.

If you clicked (or paid, or shared)

Find what happened, then do those steps. Use a known-good device (one that wasn't involved, such as a different phone or computer) to change passwords if you think the first one may have something bad on it.

I only opened the link (typed nothing, downloaded nothing)

• Close it. On an up-to-date phone or computer, just opening a page is usually low risk, though not zero.
• Make sure the device is up to date (updates fix the holes such pages try to use).
• Report the message (below) and delete it.

I typed a password into the page

1. Change that password now, by opening the real app or typing the real address yourself. If the same password is used anywhere else, change those too (and make them all different: a password manager makes that easy).
2. Turn on 2FA if it isn't on.
3. Sign out everywhere: most accounts have "sign out of all other sessions" or "devices" in security settings. This kicks out a scammer who already got in.
4. Check the account: recovery email and phone still yours? For email: any new forwarding rules or filters? Scammers add these to quietly copy your mail.

I gave someone a code, or tapped Approve on a sign-in I didn't start

Treat it as "they're in". Do every step above right now, starting with the password and "sign out everywhere". If it was your email, do that first: email is where all other password resets go.

I gave card or bank details, or sent money

1. Call the bank or card company on the number on the back of the card or on your statement. Say "I think I was scammed". Ask them to stop or reverse the payment and replace the card. Faster is better: some protections depend on how quickly you report.
2. Gift card: call the company that issued the card right away (the number is on the card), tell them it was used in a scam, and keep the card and receipt.
3. Payment app (Zelle, Venmo, Cash App, PayPal): report it inside the app and call your bank. These payments are like handing over cash, so they're often hard to undo, but report anyway.
4. Wire transfer: call the bank or wire company immediately and ask for a "recall" of the wire.
5. Crypto or a crypto ATM: contact the exchange or the ATM's operator right away and ask them to freeze the receiving account. Crypto usually can't be reversed, but a fast report sometimes stops the money moving on.
6. Report it to the FBI at ic3.gov and the FTC at ReportFraud.ftc.gov.

I gave my Social Security number or ID details

• Go to IdentityTheft.gov (the FTC's site); it builds a step-by-step recovery plan.
• Freeze your credit at all three bureaus (Equifax, Experian, TransUnion). It's free, and it stops most new credit being opened in your name. You can lift it when you need a loan.

I installed something, or let a caller onto my computer

1. Disconnect it from the internet (Wi-Fi off, cable out). That cuts off the scammer's remote control.
2. Uninstall the remote-access app or the download. Run the built-in security scan (Windows Security, or your phone's own).
3. From a different device, change passwords for email, banking and anything you used on that computer.
4. If you did online banking while they were connected, call the bank.
5. Ask a trusted tech helper whether it should be fully reset. When in doubt, a clean reset is the sure fix.

Report it (helps stop the next one)

Sources (checked 2026-10-24)

Advice changes as scams change. These are the official places to check again. Numbers quoted in the kit are from these sources as of the date above.

• FTC (Federal Trade Commission), consumer.ftc.gov: "How to Recognize and Avoid Phishing Scams", "Gift Card Scams", "Tech Support Scams", "What To Do if You Were Scammed", "Scammers hide harmful links in QR codes", and its alerts on unpaid-toll texts; reporting at ReportFraud.ftc.gov; recovery at IdentityTheft.gov.
• CISA (Cybersecurity and Infrastructure Security Agency), cisa.gov/secure-our-world: "Recognize and Report Phishing", "Require Strong Passwords", "Turn On MFA", and its fact sheet on phishing-resistant MFA.
• FBI Internet Crime Complaint Center (IC3), ic3.gov: the 2025 Internet Crime Report (released April 2026: about $20.9 billion in reported losses; phishing/spoofing was again the most-reported complaint type, about 191,000 complaints; tech-support scams about $2.1 billion); public service announcements on generative AI in fraud and the family code word (I-120324-PSA, December 2024) and on toll-payment texts (2024).
• FBI, fbi.gov/sextortion: financial sextortion of teens, what to do, how to report (tips.fbi.gov, 1-800-CALL-FBI).
• NCMEC (National Center for Missing & Exploited Children): Take It Down (takeitdown.ncmec.org) and the CyberTipline (report.cybertip.org, 1-800-843-5678).
• TAKE IT DOWN Act (Public Law 119-12, signed May 19, 2025; removal duties from May 19, 2026): summary from WilmerHale, "The TAKE IT DOWN Act Goes Live" (June 2026), added 2026-10-30; complaints at takeitdown.ftc.gov.
• U.S. Postal Inspection Service, uspis.gov "Smishing": USPS texts only come if you asked for tracking with a tracking number, and they don't contain links; report it to the Inspection Service (its Smishing page lists the current address).
• New York State: Thruway Authority / E-ZPass NY scam warnings (2025): real E-ZPass NY texts come only if you signed up for alerts and only point to EZPassNY.com or TollsByMailNY.com; E-ZPass NY 1-800-333-8655, Tolls by Mail 1-844-826-8400. Department of State, Division of Consumer Protection (dos.ny.gov/consumer-protection, 1-800-697-1220). Attorney General (ag.ny.gov, 1-800-771-7755).
• IRS, irs.gov "Recognize tax scams and fraud": the IRS doesn't start contact by email, text or social media to ask for personal or financial information, and never demands gift cards.
• Social Security Administration OIG, oig.ssa.gov: SSA won't threaten arrest, suspend your number, or demand gift cards, wire transfers, crypto or cash by mail.
• FCC, fcc.gov "Caller ID Spoofing".
• 988 Suicide & Crisis Lifeline, 988lifeline.org; Crisis Text Line, text HOME to 741741.

Words