Wirebook

Wirebook › Lesson 16 of 18

How can you spot a fake message?

About 7 minutes · hands-on · nothing you type leaves your browser unless a button says so

Most messages are exactly what they say. A few are costumes: a thief dressed up as a game, a bank, a parcel company or even a friend, hoping you'll click before you think. Grown-ups call it phishing, because the message is bait on a hook. The good news is that fakes nearly always leave the same clues. Here's a pretend inbox to sort, a magnifying glass that shows who really sent each message, and an X-ray for any link.

The sneaky inbox

Eight pretend messages. Some are real, some are sneaky fakes. Press 🔍 Look closer to see who really sent each one and where its button really goes, then decide. Every company and person here is made up, and nothing in this page ever opens a link.

Sort all 8 messages.

    The five clues fakes leave behind

    The one rule that beats every trick: go there yourself. Don't use the link in the message. Close it and open the app, or type the website's name yourself, or ask a grown-up to phone the number on the back of a bank card. If something really needs you, it'll be waiting there too. If it isn't, the message was bait.

    Link X-ray

    Type or paste any link. The X-ray shows who really owns it and points out the tricks fake links use. It only reads the text: nothing is opened or sent.

    Building an app? The same idea, with the full list of shared endings, is a free link X-ray API on Anvil.

    Why does anyone bother?

    Sending a million fake messages costs almost nothing, so even if only a handful of people fall for it, the thief wins. That's why fakes go to everyone, not just to you: you weren't picked, you were one of a crowd. It also means you don't need to be clever to beat them. You just need to slow down.

    Fakes are getting better at spelling and pictures, and some even use a real friend's hacked account, so no single clue is perfect. Put the clues together: did you expect this? Is it rushing you? Is it asking for something secret? Where does the link really go? Two "yes" answers to the wrong questions is enough to stop.

    If you already clicked, or typed something in. Don't panic and don't hide it. Tell a grown-up straight away, change that password on the real website (going there yourself), and turn on the code-on-your-phone lock. The sooner, the better: that's how most stories end happily. Here's how passwords and the second lock work.
    Same trick as a disguise. A fake message is a costume, like a moustache and goggles trying to fool face unlock (see how face unlock knows it's you). And the trick of reading an address from the right-hand end comes from anatomy of a web address.

    Words from this lesson

    Earn your stamp

    Get all 3 right to collect the Spotting fakes stamp. Wrong answers are fine: just try again.

    1. A message says you've won free gems, but only if you log in within 10 minutes. What's the biggest clue?

    2. Who really owns https://blockcraft.com.free-gems.win/claim ?

    3. What is the safest thing to do with a message you're not sure about?

    Try another lesson

    1. 17What are bots doing on the web?7 min · interactive
    2. 18What is a cookie on a website?7 min · interactive
    3. 1What happens when you open a web page?6 min · interactive