Lesson 10 of 10
Phishing and impersonation
Verify the sender through a channel you already trust.
The idea
Phishing attempts use deceptive messages to obtain credentials, personal information, or money. Similar techniques can arrive by text or phone. A familiar logo, urgent wording, or a plausible sender name is not enough to establish authenticity.
Pause before opening an unexpected link or following a payment instruction. Reach the organization using a known app, a saved address, or contact details independently obtained from an official source. Never disclose a one-time sign-in code to an unsolicited caller.
Worked example
Practice scenario: A text says, “Your brokerage is locked. Verify your login now.” It links to an unfamiliar domain and creates urgency. Instead of using that link, open the brokerage app directly. If there is no matching notice, contact the broker through the app’s verified support channel. The message itself should not supply the only evidence that it is legitimate.
| Message cue | Verification step |
|---|---|
| Unexpected urgency | Pause and inspect |
| Login link | Open the known app independently |
| Request for a code | Do not disclose it to the sender |
| Payment instructions | Confirm through a verified contact |
A common mistake
Replying to the suspicious sender to ask whether the message is genuine.
Try it yourself
Write the first three actions you would take after an unexpected password-reset text. Use fictional details only.
Show the worked answer
A valid sequence: do not click the link; open the known account app independently; inspect activity and contact verified support if needed.