Phishing Identification Training

Problem: phishing looks increasingly real

Emails, SMS, and links now mimic account alerts, delivery failures, and refunds. This skill is not a scanner; it is defensive training: pause before clicking, then inspect sender, domain, attachment, urgency, and information requests.

How it works: defensive triage of messages

Given a suspicious email, SMS, or link, it focuses on three signals: sender identity, content demands, and link behavior. It advises against clicking directly, instead hovering or long-pressing to view the URL, comparing domain spellings such as baiducom.xx vs. baidu.com, and treating bank, courier, platform suspension, or “boss transfer money” scenarios as high risk. If the user clicked but entered nothing, it suggests closing the page, clearing cache, and scanning; if credentials were entered, it directs immediate password change, platform contact, and IT reporting. Reporting paths include mailbox flags, SMS to 12321, official institutions, anti-fraud apps, and regulators.

Boundaries

It is intended for personal self-testing, email hygiene, and incident response. It does not provide offensive methods, social engineering in penetration testing, anti-phishing product development, or replace enterprise DMARC/SPF configuration and professional security teams. AI-generated phishing will get more realistic, so detection skills need ongoing practice.