Phishing email lesson plan for middle school

Teachers & homeschoolers · Lesson plan · Updated October 1, 2026 · LearnLife Editorial

What grade band and learning objectives suit a phishing email lesson for middle school?

This phishing email lesson is designed for grades 6-8, a critical age when students begin managing their own email accounts and online interactions independently. At this stage, they can grasp abstract concepts like deception and cybersecurity risks, making it ideal for introducing phishing awareness.

The learning objectives for this lesson include:

• Recognizing phishing email features: Students will learn to spot common signs such as suspicious sender addresses, urgent language, spelling errors, and unexpected attachments.
• Understanding phishing risks: Learners will understand how phishing can lead to identity theft, financial loss, and compromised personal data.
• Developing safe email habits: They will practice checking sender details, avoiding clicking on suspicious links, and verifying requests for personal information.
• Building critical thinking skills: Students will analyze sample emails and discuss why some might be scams, encouraging thoughtful online behavior.

Timing for the lesson is about 45 to 60 minutes, which includes instruction, a group activity analyzing emails, and a wrap-up discussion. For homeschoolers, the pace can adjust based on their child's interest and interaction level, allowing for deeper exploration if desired.

What materials are needed to teach a phishing email lesson without printables?

This lesson requires only materials commonly available in classrooms or homes, making it easy to implement. You will need:

• A digital device (computer, tablet, or smartphone) with internet access to display example emails or videos.
• Projector or screen (if available) for group viewing or sharing examples with multiple learners.
• Whiteboard, chalkboard, or large paper and markers for writing down key points, brainstorming characteristics of phishing emails, or recording answers during discussions.
• Sample phishing and legitimate emails: You can display these digitally or write key parts on the board. Examples should include common phishing traits, such as misspellings, suspicious links, and urgent requests.
• An analysis checklist: This can be a simple list you present on the board or screen, guiding students to evaluate sender address, language, links, and requests.

No printed worksheets or handouts are necessary, making this lesson adaptable for classrooms without printing resources or informal homeschooling environments.

How to start with a warm-up that prepares students for phishing email learning?

Begin your lesson with a warm-up that activates prior knowledge and connects to students’ experiences with emails or messages. You might ask:

• “Have you ever received a message or email asking for your password or personal information?”
• “What did you do when you got that message?”
• “Have you ever been asked to click a link or download something that seemed strange?”

Give students a few minutes to share experiences or feelings, then explain that some messages online are designed to trick people—this is called phishing. You could say:

“Phishing emails look like messages from someone you trust, but they try to steal your private information or get you to click harmful links. Today, we will learn how to spot these emails and keep ourselves safe online.”

This introduction sets a personal, relevant tone, helping students see why the topic matters to them. You can follow with a brief video or story illustrating a phishing attempt for stronger engagement.

What are the key direct instruction points about phishing emails for middle school students?

Use clear, simple language and examples to teach these essential points:

• What is phishing? Phishing is when bad people send fake emails or messages pretending to be someone trustworthy to steal your personal information or trick you into doing something unsafe.
• Common signs of phishing emails:
• The email address or sender name looks strange or doesn’t match the company it claims to be from (e.g., “[email protected]” instead of “[email protected]”).
• The message uses urgent language like “Your account will be closed!” or “You must act now!” to pressure you.
• There are spelling or grammar mistakes that real companies usually don’t make.
• It asks for personal information such as passwords, Social Security numbers, or bank details.
• It contains links or attachments you weren’t expecting or that look suspicious.
• Why phishing is dangerous: If you share your password or click on harmful links, scammers can steal money, pretend to be you, or damage your reputation.
• How to respond: Never click links or download attachments unless you are sure the email is real. If you receive a suspicious email, tell a trusted adult or your school’s IT person. If the message claims to be from a company, contact that company directly using information from their official website—not through links in the email.

Show examples side-by-side—one genuine email and one phishing email—highlighting these points to reinforce learning.

How to structure the main activity so students can practice spotting phishing emails?

Hands-on analysis is critical for reinforcing phishing awareness. Here’s a step-by-step activity:

1. Group students into pairs or small groups (3-4 students each) to encourage discussion.
2. Provide each group with 4 to 6 sample emails—a mix of phishing, spam, and legitimate messages. These can be displayed on devices or printed if possible, or shown on a shared screen. Use examples with varied difficulty and clear phishing signs.
3. Give each group a simple checklist to evaluate each email, including questions like: Does the sender’s email address look correct? Does the email ask for personal info? Are there spelling or grammar errors? Does the message use urgent or scary language? Are there suspicious links or attachments?
4. Groups discuss each email and decide if it is phishing or safe. They should note reasons for their decision.
5. Each group shares one example with the class, explaining the clues that made them identify it as phishing or legitimate.

For homeschool settings, this activity can be done one-on-one. Ask your learner to think aloud as they analyze each email, guiding with questions from the checklist.

This interactive, collaborative approach increases engagement and helps students learn from each other’s reasoning.

What discussion questions help deepen understanding after the activity?

A guided group discussion reinforces concepts and encourages personal connection to digital safety. Use questions like:

• “Why do phishing emails try to make you act quickly or feel scared?” (To pressure people before they think carefully.)
• “What kinds of personal information should never be shared by email?” (Passwords, Social Security number, bank account info, etc.)
• “If you get a suspicious email at school or home, what steps should you take?” (Don’t click links, tell an adult, verify sender.)
• “How can you help friends or family avoid phishing scams?” (Share what you learned, help them check emails carefully.)
• “Have you ever seen a phishing attempt outside of email, like in text messages or social media? How might those be similar or different?”

Encourage students to answer in their own words, fostering critical thinking and real-life application.

What assessment or exit ticket can check student understanding of phishing emails?

Wrap up the lesson with a quick formative assessment to gauge learning. Options include:

• Written exit ticket: Have students write three signs that an email might be phishing and one action they would take if they received a suspicious email.
• Oral quiz: Ask students to name two warning signs of phishing and explain why it’s risky to share passwords by email.
• Scenario response: Present a brief email example and ask students to decide if it’s safe or phishing, explaining their reasoning.

This provides immediate feedback for you as the teacher and reinforces key takeaways for students.

How can homeschoolers differentiate or extend this phishing email lesson?

Homeschoolers can tailor the lesson to fit individual learning needs and interests:

• Simplify for younger learners: Focus on just one or two phishing signs, such as “never share your password” and “don’t click strange links,” using easy-to-understand examples and stories.
• Challenge advanced learners: Introduce related topics like spear phishing (targeted phishing), identity theft, and how phishing fits into broader cybersecurity issues. Encourage creating their own phishing email examples to test family members.
• Creative extensions: Have learners design posters, infographics, or short videos warning about phishing that can be shared with friends or community groups.
• Use technology tools: Interactive phishing games or quizzes can provide additional practice and reinforce concepts in an engaging way.
• Connect to other digital safety lessons: Link phishing awareness to lessons on password safety and online scams to build a comprehensive digital safety curriculum.

This flexibility allows homeschoolers to deepen understanding and keep learning relevant and engaging.

Frequently asked questions

How can I teach phishing awareness to elementary school students?

Use simple language and relatable examples focused on “stranger danger” online. Teach kids not to share passwords or personal info and to always ask a trusted adult if unsure about a message. Stories, cartoons, and role-playing help make the lesson fun and memorable. See phishing email explained for kids for tips.

What is the difference between phishing and spam emails?

Phishing emails try to trick you into giving personal info or clicking harmful links by pretending to be someone you trust. Spam emails are usually junk mail or advertisements that don’t try to steal your data but can be annoying or clutter your inbox.

Are there free games or tools for students to learn about phishing?

Yes, games like the Phishing Game for Students let learners practice spotting phishing emails in a safe, interactive setting. These tools reinforce lessons through play and help students build confidence recognizing scams.

How can I adapt this lesson for high school students?

Include more detailed explanations of phishing tactics such as spoofed email headers, spear phishing, and social engineering. Use real-life case studies, teach students to analyze emails in-depth, and discuss consequences like identity theft and online fraud.

What should a student do if they accidentally click a phishing link?

They should immediately tell a trusted adult or school IT staff, change any passwords that might be affected, and monitor their accounts for suspicious activity. Early action helps prevent damage and protects information.