Phishing and Account Protection: Pause, Verify, Then Act

Learning goal

Identify a suspicious request, verify it independently, and understand why a second authentication factor adds protection.

Phishing is a deceptive request

Phishing uses convincing messages to lead someone to harmful links, malicious downloads or disclosure of sensitive information. It can arrive by email, text or other channels. Pressure to act immediately, an unusual sender and requests for credentials deserve attention. Good spelling or a familiar display name does not settle authenticity. NIST: Phishing

Worked example: an urgent exam message

An invented message says that a learner's application will be cancelled in ten minutes unless a password and one-time code are entered through its link. The learner expected no such request.

1. Pause. The claimed deadline is a reason to verify, not a reason to rush.
2. Do not enter credentials or open the unexpected attachment to “check” it.
3. Open the service through an independently known address or contact it using details already known to be genuine. Do not use the suspicious message's contact details as your independent check.
4. Check the account's actual notice or ask the genuine support channel whether any action is needed. Use the email service's reporting control for a suspected phish.

This scenario demonstrates independent verification; it is not a claim about any particular exam authority's messaging policy. FTC: Recognise and avoid phishing

Add another barrier to account access

Multi-factor authentication (MFA) combines at least two different factor types: something known, possessed or inherent to the user. A password and a security key are an example. A password plus a second password is still only the knowledge type. MFA reduces risk, but methods differ; codes can still be phished. Do not give a one-time code to a caller or approve a sign-in you did not initiate. NIST: MFA fact sheet

Common mistake

“It has our logo” and “it asks for an OTP” are not proof that a message is genuine. An extra factor is useful only when used in the genuine sign-in process.

Check yourself

1. Is a ten-minute threat proof that you must click? No. Verify independently first.
2. Is the phone number in the suspicious message an independent check? No. Use known genuine contact details.
3. Are two passwords two different factor types? No. Both are knowledge factors.

These are original teaching scenarios and checks, not official previous-year questions.