Email is the most common way attackers try to get into our systems. You don't have to be a tech wizard to be a target — and you don't have to be a tech wizard to protect yourself either.
This training will walk you through what phishing, spoofing, and other email-based attacks look like, how to spot them, and exactly what to do when something seems off.
At the end, you'll take a short 10-question quiz. You'll need to score 80% or higher to complete the course. You can retake the quiz as many times as needed.
More than 90% of cyberattacks start with an email. It's cheap, it scales, and it works — because it targets people, not just software.
Attackers aren't just going after big corporations. Schools, nonprofits, and small organizations are frequently targeted because they often have valuable data (student records, payroll, personal information) and fewer dedicated security resources.
The good news? Most email attacks rely on tricking you into taking an action — clicking a link, opening a file, entering a password. That means you are the most important line of defense. Knowing what to look for makes a real difference.
Phishing is when an attacker sends an email pretending to be someone or something trustworthy — like Microsoft, your bank, or even a coworker — to trick you into handing over credentials, clicking a malicious link, or opening an infected attachment.
Think of it like a digital version of a con artist. They're not breaking down a door — they're getting you to open it for them.
What makes this suspicious?
Regular phishing casts a wide net. Spear phishing is targeted — the attacker researches you specifically before sending the email.
They might know your name, your supervisor's name, a project you're working on, or even something from your school's public website. That makes the email feel much more legitimate and harder to spot.
Why this one is tricky:
When in doubt, call the person directly using a number you already have — not one in the email.
Email spoofing is when an attacker forges the "From" field of an email to make it look like it came from someone you trust — a colleague, IT, your bank, or a well-known company.
There are two types to be aware of:
Gmail shows the sender's display name prominently. The real email address is hidden until you click the arrow to expand details. Attackers count on you never checking.
Click the ▼ details arrow below to see what's actually hiding behind a trusted-looking name.
The address looks almost exactly right — but one small change makes it completely different. These are easy to miss when you're busy.
Habit to build: In Gmail, always click ▼ details to expand the sender info and read the full email address before clicking anything or replying.
No single red flag means an email is definitely malicious, but the more you spot, the more suspicious you should be. Here are the most common ones:
This is the most important habit you can build: if you weren't expecting an email, especially one asking for sensitive information or urgent action, verify it through a completely separate channel before doing anything.
Don't reply to the email. Don't call numbers listed in it. Don't click links in it. Use a contact method you already trust.
What to do instead of clicking: Were you actually expecting a UPS package? If yes — go directly to ups.com and enter your tracking number there. If no — this is almost certainly a phishing email. Report it to IT.
This same pattern works for FedEx, USPS, Amazon, your bank, your health insurance, and any other trusted brand. Attackers clone them all. The URL in the email is never trustworthy. The real website always is.
Beyond spotting bad emails, a few everyday habits significantly reduce your risk — and protect your coworkers and students too.
RSU #87 provides two email addresses for IT support. Please use the appropriate address based on the nature of your request.
Please note: Both addresses are monitored by the IT Department — there is no need to send your message to both. If you are reporting a suspicious email, use security@rsu87.org exclusively, as it includes additional automated capabilities described below.
These emails are designed by professionals to deceive. They are crafted to appear authentic, create a sense of urgency, and bypass your instincts — and they are effective against everyone, including cybersecurity professionals.
If you click a link, open an attachment, or realize after the fact that something was suspicious, please do not hesitate to contact us. There is absolutely no judgment here. Mistakes happen, and they happen to the best of us.
What matters most is that you let us know right away. The sooner we hear from you, the more we can do to protect you and everyone else in the district. A quick call or email can prevent what might otherwise become a serious incident.
You will never be penalized for reporting something in good faith, and you will never be criticized for asking a question. Please always feel comfortable reaching out.
If IT determines that an email is suspicious — or if you would like to tag it for your own records — you can apply a label in Gmail to keep it clearly marked. Follow the steps below.
Click on the email in your inbox to open it. Do not click any links or download any attachments within the message.
After clicking the Labels button, a dropdown menu will appear showing your existing labels.
In the dialog box that appears, type a label name. We recommend:
Once the label is created, it will automatically be applied to the email. For future suspicious emails, simply click Labels, check the box next to "Suspicious", and click Apply.
After applying the label, the email will appear in your inbox with the label clearly visible next to the subject line:
You've made it through the content — great work. Now let's see how much stuck.
The quiz has 10 questions. You'll get immediate feedback after each answer. You need to score 80% or higher (8 out of 10) to pass.
If you don't pass on the first try, no problem — you can retake it as many times as you need.
Put your skills to the test with Google's interactive Phishing Quiz. It presents real-world phishing scenarios and challenges you to tell the difference between legitimate and malicious emails.
Opens in a new tab. Free, no login required.
Thank you for completing this training.
Your awareness is one of the most important defenses our district has. Attackers rely on people not knowing what to look for — and now you do.
If you ever have a question, something feels off, or you just want a second opinion on an email — forward suspicious messages to security@rsu87.org or reach out to us anytime at it@rsu87.org for general inquiries. We would rather hear from you ten times about something that turns out to be nothing than not hear from you once about something that matters.
— RSU #87 IT Department