Stretch tasks Scams, phishing and misinformation

Round 1: Quiz Blitz

1. amazon.co.uk.account-check.net/login Read the address from the first single slash backwards. The real site is the part just before it: account-check.net, not Amazon at all.
2. False Logos can be copied in seconds and the most effective scams are carefully written. Look at the request and the link, not the polish.
3. A generic greeting; A threat with a short deadline; A request for your password Generic greeting, urgent threat and a password request are classic signs. Naming a real company is exactly what a scam would do too.
4. The attacker sends a message pretending to be a bank → The victim clicks the link in the message → The victim types their login on a fake page → The attacker logs in to the real account The fake page only collects what you type. That is why typing the real address yourself breaks the whole attack.
5. disinformation Disinformation is deliberate. Misinformation is false information shared by someone who believes it.
6. Contact your friend another way, such as phoning them Hacked accounts are used to ask friends for money. Checking through a different channel shows straight away whether it is really them.
7. A reverse image search to see where the photo first appeared A reverse image search often shows a photo is years old, from another country, or edited. This exact shark photo has done the rounds for years.
8. Misinformation She believes it, so it is misinformation. The person who first invented the story knowingly was spreading disinformation.
9. True Independent sources checking the same facts is the strongest test. A huge claim that only one account is reporting is a red flag.
10. Strong feelings make people act before they check Panic and excitement switch off careful thinking. The scam wants a click before you have time to notice anything odd.
11. Your login, so they can take over the account and its items Accounts with skins, items and history are worth real money. Nobody gives away coins in return for a password.
12. It is a fake shop that will take the money and send nothing Too-good-to-be-true prices, no address and bank transfer only are a classic fake shop. Card payments give you far more protection.

Round 2: Quick Fire

1. • The link could lead to a fake look-alike website
   • You know you are going to the genuine site
   • The link could download malware
   Model answer

   A link in an email could take you to a fake look-alike website that steals what you type, or download malware onto your device. Typing the address yourself means you know you are on the genuine, official site.

2. • Check who posted it, or the source
   • Check whether trusted news sites report it too
   • Check the date it was published
   • Check for evidence or links to a source
   Model answer

   First check who posted it and whether the source is reliable. Then check whether trusted news organisations such as the BBC are reporting it too, and check the date in case it is an old story being shared again.

3. • Any message asking for your password can be treated as a scam
   • Real organisations do not need your password: they can reset it or check it themselves
   Model answer

   It means any message that asks for your password can be treated as a scam straight away, however real it looks. A genuine organisation has no reason to need your password, because its own systems check it and it can reset it for you.

4. • The web address is not the real organisation's
   • It asks for money or card details
   • It is unexpected: you may not be waiting for a parcel
   • It creates urgency or pressure
   Model answer

   The web address is not the official Royal Mail website, it asks you to pay money with your card details, and it may be unexpected because you might not be waiting for a parcel at all.

Round 3: Big Think

1. • False stories are often shocking, surprising or new
   • They trigger strong emotions such as anger or fear
   • People share quickly without checking
   • Algorithms promote posts that get lots of likes and shares
   • People want to warn friends or be first with the news
   Model answer

   False stories are often more shocking and surprising than the truth, because they are made up to be exciting. They are designed to trigger strong emotions such as anger or fear, and people who feel strongly share instantly without checking whether the story is true. Social media algorithms then promote posts that get lots of likes and shares, so the false story reaches even more people. Many people also share because they want to warn their friends or be the first with the news.

2. • Logos are easy to copy from the real website
   • Her name may be known from a data breach or social media
   • Banks never ask you to confirm details or passwords through an email link
   • The link may go to a fake login page that steals her details
   • She should check the sender's address or the real address behind the link
   • She should contact the bank directly, using the official app or the number on her card
   • She should report or delete the email
   Model answer

   Lena should not trust the email just because it looks real. Logos are easy to copy from the bank's own website, and her name could have been leaked in a data breach or found on social media, so neither proves anything. Banks never ask you to confirm your details or password through a link in an email. The link probably leads to a fake login page, a look-alike copy of the bank's site that steals whatever she types. She should check the sender's email address and hover over the link to see its real address, but the safest thing is not to click at all. Instead she should contact the bank directly, by phoning the number on her card or logging in through the official banking app, and then report the email as phishing and delete it.

This or That

1. A real company would usually use your name Phishing emails go to thousands of people at once, so they use a general greeting instead of your name.
2. Ignore it: banks never ask for passwords No genuine organisation ever asks for your password. A logo takes seconds to copy.
3. Type the bank's web address in yourself Going to the site yourself avoids the fake link. A fake page can look exactly like the real one.
4. Disinformation is spread on purpose Both are false. Misinformation is shared by people who believe it; disinformation is spread deliberately to mislead.
5. Stop and check it before sharing Content built to make you angry is built to be shared before you think.
6. Looking at when it was published Old stories are recirculated as if they were new. The number of shares tells you nothing about the truth.
7. A scam to collect your details Fake competitions ask for personal details to claim a prize that does not exist.
8. Leave it unopened and report it Unexpected attachments are a common way to deliver malware. Opening it is exactly what the sender wants.

Memory Match

• A 3 Phishing: A fake message pretending to be a trusted organisation
• B 1 Misinformation: False information shared by someone who believes it
• C 5 Disinformation: False information spread deliberately to mislead
• D 6 Urgency: Pressure to act now, before you can think
• E 2 Reverse image search: Finds where else a photo has appeared online
• F 4 Fake shop: A website with prices that are too good to be true