Baca dalam Bahasa Melayu Office Niaga Learn · Lesson 6

Spot the phishing email: a Gmail safety game

Practise on a simple drawing of Gmail. A fake email is in the inbox. Find the signs of phishing, then report the email. Nothing is saved outside your browser.

Office Niaga LearnExplore · Try · Check

Lesson 6 of 6 0/6

Gmail Search mail NA

Action required: Your mailbox is full Inbox

Google Workspace Admin to me ·

Did you click the link?

Change your password.
Tell the school IT admin.
Turn on 2-Step Verification.

Report phishing

Report this email as phishing? Gmail removes it from your inbox.

Message reported

A simple drawing for practice, not the real app. Google Workspace and its app names are trademarks of Google LLC.

Try it yourselfStep 1 of 7

Open the new email
An email from Google Workspace Admin is at the top of your inbox. Click the email to open it.
Find the 5 signs of phishing
This email is not real. Find 5 parts that show phishing, and click each part. Examine the sender, the words and the link.
Do not click the link
Do not click Verify my account. Do not reply to the email. Do not type your password on a page from an email. Click Next.
Open the message menu
Click the ⋮ (More) button next to the Reply button.
Select "Report phishing"
Click Report phishing. Use this option for an email that tries to get your password.
Send the report
Click Report. Gmail removes the email from your inbox.
Do these steps if you clicked the link
Did you click the link or type your password? Do the 3 steps in the card immediately. Then click Next.

What you practised

Examine the sender address. The domain must be the real school domain, for example smkexample.edu.my.
Find the signs of phishing: a threat with a short time limit, a link to an unknown site, a request for your password, and a greeting without your name.
Report the email with ⋮ (More) and Report phishing.
If you clicked the link: change your password, tell the IT admin, and turn on 2-Step Verification.

This lesson is also good for students. Use it in class before students get their school Google accounts. A phishing email can look like a message from the school, so each student must know the signs.

Straight answers

Frequently asked questions

1Where is "Report phishing" in Gmail?

Open the email. Click More (the three dots) next to Reply, then click Report phishing. Gmail removes the email from your inbox.

2How does 2-Step Verification help?

With 2-Step Verification, a sign-in needs your password and a second step, for example a code or a prompt on your phone. If an attacker gets your password, the attacker still cannot sign in without the second step.

3Can the school make 2-Step Verification required?

Yes. A Google Workspace admin can make 2-Step Verification required for all users, or for one group of users, in the Admin console.