Student learning · Grades 3–5, Grades 6–8 · 40 minutes
Phish Tank IRL
Teams sort fourteen texts, emails, and game-chat messages into safe, scam, or check-another-way, and learn why AI-polished scams make spelling mistakes a useless clue.
Many of us were taught that scams are easy to spot because they're full of typos. Now anyone can use AI to write a polished, friendly, perfectly spelled scam in seconds. In this gallery-walk sort, teams visit a "tank" of fourteen realistic messages, decide which are safe, which are scams, and which need to be checked another way, and name the red flags that still work. They leave with a SLOW DOWN routine they can use on any message.
In this packet
- Handout A: Message Tank (card sort)
- Handout B: SLOW DOWN Check (checklist)
- Handout C: Scam Reply Lab (worksheet)
- Facilitator key (last page)
TCEA ELE indicators
- S2.1 I know how to protect my personal information online.
- S2.3 I am aware of the potential risks of sharing content online.
- AI2.2 I can identify potential ethical issues in AI applications and propose solutions.
- T2.2 I know how to guide students in safe and responsible internet use.
Full facilitator guide: mglearn.github.io/eles/activities/phish-tank-irl.html
Handout A for Phish Tank IRL
Message Tank
All names, companies, and numbers are made up for this lesson. Sort each message and write one flag that convinced you.
Safe
Scam
Check another way
Handout A for Phish Tank IRL
Message Tank: cards to sort
Cut apart the strips. Sort each one onto the mat and be ready to explain why.
Sheet 1 of 2
1 · Text: "Hi! We noticed unusual activity on your PixelPlay account. To keep your progress safe, please confirm your login within 24 hours: pixelplay-secure-login.help"
2 · Email: "Congratulations! You've been selected for a FREE SkyStream tablet. Just pay $4.99 shipping with your parent's card in the next 10 minutes."
3 · Text from the number saved as "Mom": "Running 10 min late for pickup. Wait inside by the office."
4 · Game chat: "I'm a mod. Your account will be banned unless you send me your password so I can verify it."
5 · Game chat from a new account using your friend Leo's name: "Hey it's Leo, new account! I just sent a code to your phone by accident, can you send it to me?"
6 · Email: "Your QuickShip package could not be delivered. Pay a $1.25 redelivery fee here." (You aren't expecting a package.)
7 · A message inside your school's learning platform from your teacher: "Reminder: science lab report due Friday. Rubric is in the Week 6 folder."
8 · DM: "OMG is this you in this video?? lol look: vid-share.click/you"
9 · Email that appears to be from Maple Hollow ISD: "Update your student portal password by Friday. Use this link."
10 · Text: "Northwind Bank ALERT: your card is frozen. Reply with your card number and PIN to unlock."
11 · An app you just downloaded shows: "Allow this app to send you notifications?" with Allow and Don't Allow buttons.
12 · Social post: "Share this post and tag 5 friends to win 10,000 free coins in Pixel Quest! Enter your username and password below."
Handout A for Phish Tank IRL
Message Tank: cards to sort
Cut apart the strips. Sort each one onto the mat and be ready to explain why.
Sheet 2 of 2
13 · Voicemail from "Grandpa": "It's me. Something happened and I need money right away. Don't tell your mom."
14 · Email: "Dear student, I am writing on behalf of the BrightPath Scholarship Fund. You have won $2,000. Kindly reply with your full name, address, birthday, and school."
Handout B for Phish Tank IRL
SLOW DOWN Check
Use this card any time a message makes you feel rushed, excited, scared, or curious. Keep it by your family's computer or phone.
| Done |
|---|
| S · Stop. Am I being rushed, scared, or promised a prize? |
| L · Look at the sender. Is it someone I know, from an account or number I already have saved? |
| O · Open nothing yet: no links, no attachments, no replies. |
| W · Who can I check with? Use a trusted route: the real app, a saved number, a teacher, or a parent. |
| D · Don't share passwords, codes, PINs, birthdays, addresses, or money, ever, through a message. |
| O · Own it: tell a trusted adult, even if I already clicked. It's fixable, and fast help matters. |
| W · Warn others: report or block the sender and tell friends who might get the same message. |
| N · Note the flag, so I recognize the trick next time. |
| Remember: perfect spelling is NOT a safe sign. AI can make any scam sound polished. |
Notes
Handout C for Phish Tank IRL
Scam Reply Lab
Pick one scam from the tank. Plan the safe response as a team.
Message number and the flags we noticed:
What should you NOT do? (Be specific.)
The trusted route we'd use to check (not the message's own link, number, or reply):
What we'd say to a younger sibling or friend who got this message:
A new flag our class didn't list yet:
Why can't we rely on spelling mistakes to spot scams anymore?
Facilitator only for Phish Tank IRL
Answer key and notes
Handout A: Message Tank
| Item | Sort | Why |
|---|---|---|
| 1 · Text: "Hi! We noticed unusual activity on your PixelPlay account. To keep your progress safe, please confirm your login within 24 hours: pixelplay-secure-login.help" | Scam | Polished and friendly, but it's urgent, unexpected, and the link isn't PixelPlay's real site. Open the app yourself instead. |
| 2 · Email: "Congratulations! You've been selected for a FREE SkyStream tablet. Just pay $4.99 shipping with your parent's card in the next 10 minutes." | Scam | Too good to be true, a countdown, and a request for a payment card. |
| 3 · Text from the number saved as "Mom": "Running 10 min late for pickup. Wait inside by the office." | Safe | Expected, from a saved contact, and asks for nothing: no link, no money, no codes. |
| 4 · Game chat: "I'm a mod. Your account will be banned unless you send me your password so I can verify it." | Scam | Real moderators never need your password. A threat plus a password request is a major flag. |
| 5 · Game chat from a new account using your friend Leo's name: "Hey it's Leo, new account! I just sent a code to your phone by accident, can you send it to me?" | Check another way | Never share the code. Check with Leo through a route you already use, like in person. This is a common account-takeover trick. |
| 6 · Email: "Your QuickShip package could not be delivered. Pay a $1.25 redelivery fee here." (You aren't expecting a package.) | Scam | Unexpected, a small fee to lower your guard, and a payment link. Check the real delivery app or site yourself. |
| 7 · A message inside your school's learning platform from your teacher: "Reminder: science lab report due Friday. Rubric is in the Week 6 folder." | Safe | Inside a platform you already use, from a known teacher, expected, and asks for nothing private. |
| 8 · DM: "OMG is this you in this video?? lol look: vid-share.click/you" | Scam | Curiosity bait plus an odd link. It's designed to make you click before you think. |
| 9 · Email that appears to be from Maple Hollow ISD: "Update your student portal password by Friday. Use this link." | Check another way | It may be real or a copy. Don't use the link; ask your teacher or go to the portal the way you normally do. |
| 10 · Text: "Northwind Bank ALERT: your card is frozen. Reply with your card number and PIN to unlock." | Scam | Banks don't ask for PINs by text. Tell an adult, who can call the number on the back of the real card. |
| 11 · An app you just downloaded shows: "Allow this app to send you notifications?" with Allow and Don't Allow buttons. | Safe | A normal permission prompt you caused. It's safe to answer, but you can choose Don't Allow. |
| 12 · Social post: "Share this post and tag 5 friends to win 10,000 free coins in Pixel Quest! Enter your username and password below." | Scam | Free-coin offers that ask for your login are classic account-stealing scams. |
| 13 · Voicemail from "Grandpa": "It's me. Something happened and I need money right away. Don't tell your mom." | Check another way | Voices can be faked with AI. Hang up and call Grandpa or a parent on a number you already know. Secrecy is a big flag. |
| 14 · Email: "Dear student, I am writing on behalf of the BrightPath Scholarship Fund. You have won $2,000. Kindly reply with your full name, address, birthday, and school." | Scam | You can't win something you didn't enter. It's a request for personal information that could be used to impersonate you. |