Phishing Game for Students to Learn Digital Safety

Teachers & homeschoolers · Activities · Updated October 1, 2026 · LearnLife Editorial

What is a phishing game for students and why use it?

A phishing game is an educational activity designed to mimic the tactics scammers use to trick people into sharing personal data, such as passwords or credit card information. These games give students a hands-on way to practice identifying red flags in emails or messages, like suspicious links, unusual sender addresses, or urgent demands for action. Using games in teaching keeps students engaged and allows them to learn by doing, which improves retention. For teachers and homeschooling parents, phishing games provide a structured way to meet digital safety learning goals while making the lessons interactive and relevant.

How can I create a phishing game for different age groups?

Phishing games should be adjusted to suit the students’ age and understanding. For younger students (grades 3-5), keep the scenarios simple by focusing on spotting obvious signs like sender email addresses that don’t match the company or strange requests to click links. For example, a fake email might say, “Click here to win a prize!” Middle school students (grades 6-8) can handle more detailed clues such as poor grammar, spelling mistakes, or URLs that don’t match a legitimate site. For high school students (grades 9-12), introduce subtle phishing tactics like spoofed websites or social engineering, where the scammer tries to create trust or pressure the victim. Tailor language and examples so they are age-appropriate—for instance, use school-related scenarios for younger learners and social media or banking examples for older students.

What are some engaging phishing game activities for the classroom or home?

1. Phishing Email Sorting (Grades 4-8)

• Time: 30 minutes
• Materials: Printed or digital emails (mix of real and phishing samples)
• Steps:

1. Provide students with a set of emails.
2. Ask them to sort each into “Safe” or “Phishing” piles by examining sender addresses, subject lines, and content.
3. Encourage students to underline or write down clues that influenced their choice.

• Skill built: Careful email examination and critical thinking
• Debrief: Discuss as a group which clues were most helpful, such as misspelled company names, suspicious links, or requests for passwords. Remind students to never click links or reply to suspicious emails.
• Adaptation: At home, parents can gather examples from their own email inbox and review them with children, pointing out risks in familiar contexts.

1. Spot the Scam Website (Grades 6-12)

• Time: 40 minutes
• Materials: Screenshots of real and fake websites, projector or individual devices
• Steps:

1. Show students website screenshots and ask them to find signs of a scam (e.g., misspelled URLs, missing security padlock, poor design quality).
2. Ask students to explain their reasons.
3. Provide the official website for comparison.

• Skill built: Website verification and awareness of online security indicators
• Debrief: Explain how entering information on fake sites can lead to identity theft or fraud. Discuss browser safety features like HTTPS and how to check URLs carefully.
• Adaptation: Home learners can use a safe browser to explore real websites and identify security features.

1. Phishing Role-Play (Grades 9-12)

• Time: 45 minutes
• Materials: Scenario cards describing phishing attempts for both “scammer” and “target” roles
• Steps:

1. Divide students into pairs or small groups.
2. One student acts as the scammer trying to trick the other with a phishing message.
3. The other student practices safe responses, such as questioning the sender, refusing to click links, or reporting the message.

• Skill built: Communication skills, refusal strategies, and digital safety awareness
• Debrief: Talk about how staying calm and asking questions can prevent falling for scams. Encourage sharing phrases like “I need to verify your identity before sharing information.”
• Adaptation: Families can role-play during discussions about internet use, helping children practice safe responses.

1. Create Your Own Phishing Email (Grades 7-12)

• Time: 1 hour
• Materials: Paper or digital devices for writing
• Steps:

1. Students write a phishing email that uses common scam tactics (urgent requests, fake offers, suspicious links).
2. Swap emails with peers and identify the phishing clues.

• Skill built: Understanding scam techniques and developing analytical reading skills
• Debrief: Review what made the emails convincing or suspicious. Discuss why scammers use certain language or scare tactics.
• Adaptation: Parents can review the emails with the child, reinforcing how to spot danger signs.

1. Phishing Quiz Game (All Grades)

• Time: 20-30 minutes
• Materials: Printed or digital quiz with multiple-choice questions on phishing indicators and safety steps
• Steps:

1. Administer a quiz with questions such as “What should you do if you get an email asking for your password?”
2. Review answers collectively and explain reasoning.

• Skill built: Knowledge reinforcement and quick decision-making
• Debrief: Clarify any misunderstandings and provide exact wording students can use, such as “I don’t share passwords via email.”
• Adaptation: Parents can quiz children during screen time, turning it into a fun challenge.

1. Email Header Investigation (Grades 9-12)

• Time: 50 minutes
• Materials: Sample email headers and guides on reading headers
• Steps:

1. Teach students to open email headers and read metadata like “From” address, “Received” path, and IP addresses.
2. Analyze sample headers to verify if the sender is genuine.

• Skill built: Advanced digital literacy and forensic thinking
• Debrief: Explain how headers reveal information scammers can hide in the visible message. Encourage students to ask adults for help when in doubt.
• Adaptation: Older students at home can check suspicious emails from family accounts under supervision.

How should teachers and parents debrief phishing game activities?

Debriefing should focus on what clues students noticed and how these clues indicate danger. Ask students to explain their reasoning, helping them articulate their thought process. Emphasize the importance of skepticism online—no matter how trustworthy a message seems, it’s okay to double-check by contacting the company or adult directly. Review exact steps to take if they encounter suspected phishing: do not click links, do not reply, delete the message, and tell a trusted adult or the school IT department. Reinforce that scams often rely on pressure tactics like urgency or fear, so pausing to think is a powerful defense.

What materials and preparation are needed for phishing games?

You will need a mixture of real and simulated phishing emails or messages, website screenshots, writing tools, or digital devices. Teachers should prepare these in advance, ensuring all phishing examples are safe (no active links) and appropriate for the age group. Many educational websites provide vetted examples, or you can use archived scam emails from official sources. For digital quizzes or games, free online platforms or slideshow tools can support interactive experiences. Parents can use emails from their own inboxes but should preview them carefully to avoid exposing children to inappropriate content.

How can homeschooling parents adapt phishing games for individual learners?

Home educators can tailor the pace and complexity based on their child’s interests and understanding. They can turn phishing games into ongoing conversations during regular screen time, using real examples from the household’s emails. Parents can create simple, casual practice sessions, such as asking their child to identify safe vs. suspicious emails during a daily routine. Adding rewards like certificates or stickers for correctly identifying phishing attempts can motivate learners. Since homeschooling often involves more one-on-one time, parents can dig deeper into explanations and answer questions as they arise.

What skills do students build through phishing games?

Students develop several critical skills:

• Careful observation to spot suspicious details in messages
• Analytical thinking to question the legitimacy of digital content
• Digital literacy, including knowing security indicators like HTTPS and email headers
• Decision-making skills for safe online responses
• Communication skills for refusing unsafe requests and reporting scams

These skills help students protect their personal data and reduce the chances of falling victim to online scams.

Where can teachers find ready-made phishing game resources?

Several trusted resources offer lesson plans and examples to use or adapt:

• The Phishing Email Lesson Plan for Middle School provides structured activities and background info.
• Collections like Phishing Email Examples for Training Students offer authentic email samples.
• The Online Scams Activities for Students page includes games and quizzes that complement phishing lessons.

Review these materials to select activities that best fit your classroom or homeschooling needs.

Frequently asked questions

How often should students practice phishing recognition games?

Regular practice, such as once every few months, helps students maintain awareness. Combining these games with other digital safety lessons creates ongoing reinforcement.

Can younger children learn about phishing safely?

Yes. Use simple language and focus on basic rules like not clicking unknown links and telling an adult about strange messages. Avoid overwhelming details.

How do I handle a student who shares a real phishing email from home?

Use it as a teaching moment by reviewing the email together, identifying risks, and discussing safe responses like deleting or reporting the message.

Are there online platforms that offer phishing simulation games?

Some cybersecurity organizations and education sites provide simulations. Always check that the content is age-appropriate and safe before use.

What should students do if they accidentally click on a phishing link?

They should immediately tell a trusted adult and avoid entering any personal information. Adults can then help secure accounts and scan devices for issues.

How can parents stay informed about new phishing scams targeting kids?

Parents can follow updates from sources like the FTC Consumer Advice or CISA websites, and regularly review educational materials on digital safety.