Email is the most common way attackers try to get into our systems. You don't have to be a tech wizard to be a target — and you don't have to be a tech wizard to protect yourself either.
This training will walk you through what phishing, spoofing, and other email-based attacks look like, how to spot them, and exactly what to do when something seems off.
At the end, you'll take a short 10-question quiz. You'll need to score 80% or higher to complete the course. You can retake the quiz as many times as needed.
More than 90% of cyberattacks start with an email. It's cheap, it scales, and it works — because it targets people, not just software.
Attackers aren't just going after big corporations. Schools, nonprofits, and small organizations are frequently targeted because they often have valuable data (student records, payroll, personal information) and fewer dedicated security resources.
The good news? Most email attacks rely on tricking you into taking an action — clicking a link, opening a file, entering a password. That means you are the most important line of defense. Knowing what to look for makes a real difference.
Phishing is when an attacker sends an email pretending to be someone or something trustworthy — like Microsoft, your bank, or even a coworker — to trick you into handing over credentials, clicking a malicious link, or opening an infected attachment.
Think of it like a digital version of a con artist. They're not breaking down a door — they're getting you to open it for them.
What makes this suspicious?
Regular phishing casts a wide net. Spear phishing is targeted — the attacker researches you specifically before sending the email.
They might know your name, your supervisor's name, a project you're working on, or even something from your school's public website. That makes the email feel much more legitimate and harder to spot.
Why this one is tricky:
When in doubt, call the person directly using a number you already have — not one in the email.
Email spoofing is when an attacker forges the "From" field of an email to make it look like it came from someone you trust — a colleague, IT, your bank, or a well-known company.
There are two types to be aware of:
Gmail shows the sender's display name prominently. The real email address is hidden until you click the arrow to expand details. Attackers count on you never checking.
Click the ▼ details arrow below to see what's actually hiding behind a trusted-looking name.
The address looks almost exactly right — but one small change makes it completely different. These are easy to miss when you're busy.
Habit to build: In Gmail, always click ▼ details to expand the sender info and read the full email address before clicking anything or replying.
No single red flag means an email is definitely malicious, but the more you spot, the more suspicious you should be. Here are the most common ones:
This is the most important habit you can build: if you weren't expecting an email, especially one asking for sensitive information or urgent action, verify it through a completely separate channel before doing anything.
Don't reply to the email. Don't call numbers listed in it. Don't click links in it. Use a contact method you already trust.
What to do instead of clicking: Were you actually expecting a UPS package? If yes — go directly to ups.com and enter your tracking number there. If no — this is almost certainly a phishing email. Report it to IT.
This same pattern works for FedEx, USPS, Amazon, your bank, your health insurance, and any other trusted brand. Attackers clone them all. The URL in the email is never trustworthy. The real website always is.
Beyond spotting bad emails, a few everyday habits significantly reduce your risk — and protect your coworkers and students too.
Think you received a phishing or suspicious email? Here's exactly what to do — step by step.
These emails are designed by professionals to fool people. They are crafted to look real, feel urgent, and bypass your instincts — and they work on everyone, including people who work in cybersecurity.
If you click a link, open an attachment, or realize after the fact that something was suspicious, please never hesitate to reach out to us. There is absolutely no judgment here. Mistakes happen, and they happen to the best of us.
What matters most — the only thing that matters — is that you let us know right away. The sooner we hear from you, the more we can do to protect you and everyone else in the district. A quick call or email to IT can prevent what might otherwise become a serious incident.
We are here to help, not to judge. You will never be in trouble for reporting something in good faith, and you will never be criticized for asking us a question. Please always feel comfortable reaching out.
You've made it through the content — great work. Now let's see how much stuck.
The quiz has 10 questions. You'll get immediate feedback after each answer. You need to score 80% or higher (8 out of 10) to pass.
If you don't pass on the first try, no problem — you can retake it as many times as you need.
Thank you for completing this training.
Your awareness is one of the most important defenses our district has. Attackers rely on people not knowing what to look for — and now you do.
If you ever have a question, something feels off, or you just want a second opinion on an email, please reach out to us anytime at it@rsu87.org. We would rather hear from you ten times about something that turns out to be nothing than not hear from you once about something that matters.
— RSU #87 IT Department