Student learningfor Grades 9–12, Higher Ed
Data Trail Audit
Teams read an AI study app's privacy policy like investigators, map where their data could travel, and choose settings and habits that shrink their trail.
All activities Student learning
Phish Tank IRL
Teams sort fourteen texts, emails, and game-chat messages into safe, scam, or check-another-way, and learn why AI-polished scams make spelling mistakes a useless clue.
Overview
Many of us were taught that scams are easy to spot because they're full of typos. Now anyone can use AI to write a polished, friendly, perfectly spelled scam in seconds. In this gallery-walk sort, teams visit a "tank" of fourteen realistic messages, decide which are safe, which are scams, and which need to be checked another way, and name the red flags that still work. They leave with a SLOW DOWN routine they can use on any message.
Objectives
- Students will sort realistic messages into Safe, Scam, or Check another way, and justify each choice with at least one red flag or green flag.
- Students will explain why spelling and grammar are no longer reliable scam clues and name flags that still work (urgency, secrecy, requests for codes or passwords, unexpected links).
- Students will practice a safe response: not clicking, checking through a trusted route, and telling a trusted adult.
Materials
On paper
- Handout A: Message Tank (1 set of 14 strips; enlarge and post around the room, or give each team a set)
- Handout A sorting mat (1 per team)
- Handout B: SLOW DOWN Check (1 per student)
- Handout C: Scam Reply Lab (1 per team)
- Painter's tape; sticky notes in three colors (green = Safe, red = Scam, yellow = Check another way)
On screen
- Optional: teacher projector to show messages as slides
- Optional: a generative AI chatbot your district approves, driven by the teacher only, for the "polished scam" demo
Before you start
- Print Handout A. For a gallery walk, enlarge each message strip and tape it around the room, numbered 1–14. For desk work, cut one set per team.
- Put a stack of green, red, and yellow sticky notes at each station, or give each team a set.
- Review the key. Several messages are safe (Messages 3, 7, 11) or need checking (Messages 5, 9, 13). Don't let the lesson become "everything is a scam."
- If you plan the AI demo, prepare a harmless prompt such as "Rewrite this message so it sounds friendly and professional" and paste in Message 1's typo version.
Step by step
-
10–5 min
Hook
Spot the scam in two seconds
Show or read two versions of the same message side by side. Version 1: "URGENT!! you acount is lockd. click hear to fix now". Version 2: "Hi! We noticed unusual activity on your PixelPlay account. To keep your progress safe, please confirm your login within 24 hours using the secure link below." Ask: "Which one is the scam?" Reveal: both are. Say: "Scammers can now use AI to fix the spelling and make it sound friendly. So we need better clues."
Facilitator noteIf you have a district-approved chatbot, paste Version 1 and ask it to "make this sound professional" live on the projector. Don't send anything anywhere; the point is how fast the polish appears.
-
25–18 min
Explore
The gallery walk
Teams rotate through the 14 messages (about one minute per station, or work through the strips at their desks). At each one, they place a colored sticky note: green = Safe, red = Scam, yellow = Check another way, and write one flag that convinced them. Teams may not click, call, or reply to anything; they may only notice.
Facilitator noteListen for "It has no typos, so it's fine." Bring that reasoning to the debrief.
-
318–26 min
Debrief
Which flags still work?
Go to the three messages with the most split votes. Ask teams to defend their color. Reveal the key and build a class list titled "Flags that still work": urgency, secrecy ("don't tell anyone"), a request for passwords, codes, or money, a link or sender that doesn't match the real company, an offer that's too good to be true, and a message you didn't expect. Then ask: "Why is 'check another way' sometimes the smartest answer?"
Facilitator noteStress that asking for a verification code is a major flag. A login code is meant only for you; a real friend or company will not ask you to send it to them in a message.
-
426–30 min
Model
The SLOW DOWN check
Hand out Handout B and model it on Message 5 (the "friend" asking for a code in game chat). Think aloud: "Stop. I feel rushed. Look at the sender... it's a new account using my friend's name. Open nothing. Who can I check with? I'll ask my friend in person or through our usual chat. Don't share codes or passwords, ever. Own it: tell an adult. Warn others. Note what happened so I recognize it next time."
Facilitator noteStudents under 13 may not have accounts of their own; frame it as protecting a family phone, a game console, or a school account.
-
530–37 min
Apply
Scam Reply Lab
Teams complete Handout C. They choose one scam from the tank and write the safe action they'd take, the trusted route they'd use to check, and what they'd say to a younger sibling or friend who got the same message. Then each team writes one new flag the class didn't list.
Facilitator noteLook for trusted routes that don't use the message itself: the official app, a number from the back of a card, a teacher or parent, the real website typed in by hand.
-
637–40 min
Reflect
One flag I'll remember
On an exit sticky note, each student writes the one flag they'll remember and one person they'd tell if something felt off. Collect them at the door.
Facilitator noteIf a student shares a real scam they or their family experienced, thank them and follow your school's reporting process if there's any ongoing risk.
Paper or screen
Unplugged
Designed for paper: the message tank is taped to the walls, sticky notes record votes, and the SLOW DOWN card goes home. Read Version 1 and Version 2 of the hook aloud if you have no projector.
Digital
Post the messages as slides or a form so students vote Safe, Scam, or Check another way and see the class results as a chart. The teacher alone may demonstrate how a district-approved chatbot polishes a clumsy message; students never paste real messages or personal information into an AI tool. Grades 6–8 can review their school account's security settings with the teacher afterward.
Does it need a screen? A live AI polish demo proves in seconds that good spelling means nothing, which shifts students to flags that still work. The core sorting and reasoning is stronger on paper, where every vote and flag is visible on the wall.
Evidence of learning
What you should be able to see or collect if it worked.
- Students justify a color with a specific flag ("asks for a code," "link doesn't match the company"), not "it looks fake."
- Students reject spelling as a reliable clue and explain why, citing the AI-polished example.
- Handout C names a trusted route that doesn't use the suspicious message's own link, number, or reply button.
Adaptations
- Grades 3–5
- Use Messages 1, 3, 5, 7, 8, and 12, and shorten SLOW DOWN to three moves: Stop, Don't click, Tell a grown-up.
- Grades 9–12
- Add job-offer and scholarship scams, and discuss how AI helps scammers personalize messages using information people post publicly.
- Emergent bilinguals
- Provide the messages in students' home languages where possible; scams often target families in more than one language. Let teams discuss the flags in any language.
Standards connections
Students sort realistic messages as safe, scam, or check another way and name red flags that still work, the phishing and security part of digital citizenship.
- TEKS
- privacy, safety, and security (c)(10)TEKS sections: Technology Applications §126.8–§126.10, §126.17–§126.19
Reflect
- Do I stay safe and make good choices when I use the internet? What will I do the next time a message makes me feel rushed?
- Which personal information would a scammer most want from me or my family, and how will I protect it?
- Who is my trusted adult or trusted route for checking a message?
What comes next
Students take the SLOW DOWN card home and walk a family member through one message from the tank. Next class, invite volunteers to share one scam flag their family recognized.
Pairs well with
- Digital Citizenship Breakouts (K–8)Follow-up breakouts on online safety and privacy.
- Family App Privacy AuditA family-facing tool to continue the conversation at home.
