Recognizing Phishing
Spot malicious emails.
Recognizing Phishing is a free Cyber Security Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What Is Phishing
Phishing is a fraudulent message that tricks you into revealing information, clicking a malicious link, or opening a harmful attachment.
Most phishing arrives by email, the most common entry point for cyberattacks.
Check the Sender Address
Always inspect the real sender address, not just the display name.
Attackers use look-alike domains that are easy to miss at a glance.
Display name: 'PayPal Support'
Real address: support@paypa1-secure.com
Notice the '1' instead of 'l'.Hover Before You Click
The visible link text can hide a different destination. Hover over a link to see where it really goes.
Visible text: https://yourbank.com/login
Actual target: http://192.0.2.55/steal-login
Never click if these do not match.Urgency and Threats
Phishing emails create panic so you act before thinking.
- 'Your account will be suspended in 24 hours'
- 'Unusual login detected, verify now'
Legitimate organizations rarely demand instant action this way.
Generic Greetings
Mass phishing often uses vague openings because the attacker does not know your name.
- 'Dear Customer'
- 'Dear User'
- 'Hello account holder'
A real provider usually addresses you by name.
Spelling and Grammar
Poor spelling, odd grammar, and inconsistent formatting are classic red flags.
While some phishing is polished, unexpected errors in a 'professional' email should raise suspicion.
Suspicious Attachments
Unexpected attachments can carry malware.
- Files ending in .exe, .scr, or .js
- Office documents asking you to 'Enable Macros'
If you did not expect a file, do not open it.
Requests for Credentials
No legitimate company will email you to ask for your password, full card number, or one-time code.
A message demanding these is almost always phishing.
Spear Phishing
Spear phishing targets a specific person using personal details gathered beforehand.
It may reference your job, colleagues, or recent projects, which makes it far more convincing than generic phishing.
What To Do With Phishing
When you suspect phishing:
- Do not click links or open attachments
- Do not reply with information
- Report it to your security team
- Delete it after reporting
Verify Through a Trusted Channel
If an email seems to come from your bank or boss, confirm through a known channel.
Call the official number or type the website address yourself. Never use the contact details inside the suspicious message.
Quick Check
Test your phishing-detection skills.
Recap
To recognize phishing, watch for:
- Spoofed sender addresses and mismatched links
- Urgency, generic greetings, and errors
- Unexpected attachments and credential requests
When in doubt, verify independently and report.
Frequently asked questions
Is the “Recognizing Phishing” lesson free?
Yes — the full text of “Recognizing Phishing” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Recognizing Phishing”?
Spot malicious emails. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Recognizing Phishing” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Social Engineering Tactics
- Recognizing Phishing
- Vishing and Smishing
- Building Security Awareness