- \n
- Before You Start<\/a><\/li>\n
- Quick Fix Steps<\/a><\/li>\n
- Plan Your Drill<\/a><\/li>\n
- Run the Drill<\/a><\/li>\n
- Deeper Diagnosis<\/a><\/li>\n
- Preventive Care<\/a><\/li>\n
- When to Seek Help<\/a><\/li>\n
- Frequently Asked Questions<\/a><\/li>\n<\/ul>\n
Before You Start<\/h2>\n
Goal: practice spotting phishing messages (fake emails, texts, DMs) and build safe habits together.<\/p>\n
Phishing: a scam that pretends to be someone you trust to steal passwords or money. Router: the box that creates your home Wi\u2011Fi network.<\/p>\n
- \n
- Time needed: 10\u201320 minutes per month.<\/li>\n
- Difficulty: Easy.<\/li>\n
- Who: anyone in your home who uses email, texts, or social media.<\/li>\n<\/ul>\n
What you need:<\/strong><\/p>\n
- \n
- Your regular email and messaging apps.<\/li>\n
- A note or checklist (paper or digital) to track results.<\/li>\n
- A calendar to set a recurring reminder.<\/li>\n<\/ul>\n
Warning:<\/strong> Do not use real suspicious links or attachments in your drill. Use safe, made\u2011up examples only (see templates below). Never enter real passwords during practice.<\/p>\n
Note:<\/strong> You do not need to change network settings, reset devices, or install special tools to run this drill.<\/p>\n
<\/p>\n
Quick Fix Steps<\/h2>\n
- \n
- Create a monthly calendar event called \u201cPhishing Drill \u2013 10 minutes.\u201d Invite your household if you share a calendar.<\/li>\n
- Make a safe test message. Use the templates below. Send it to yourself and anyone participating.<\/li>\n
- Practice the hover\/press test. On computers, hover over links to see the real address. On phones, long\u2011press links to preview without opening.<\/li>\n
- Practice reporting. Find your email or messaging app\u2019s \u201cReport phishing\u201d or \u201cReport spam\u201d option. Do not forward scams to friends.<\/li>\n
- Review the five red flags: urgent tone, strange sender, mismatched links, requests for passwords, unexpected attachments.<\/li>\n
- Turn on two\u2011factor authentication (2FA) for your most important accounts (email, bank). This limits damage if a password leaks.<\/li>\n
- Record outcomes: who spotted the issue, what worked, what to improve next month.<\/li>\n<\/ol>\n
Plan Your Drill<\/h2>\n
Rotate scenario types each month so your family learns different patterns: email, text\/SMS (smishing), social media DM, or a fake support message.<\/p>\n
Email template (copy, paste, and adjust)<\/h3>\n
Subject: Important: Verify your account now\n\nHi [Your Name],\n\nWe detected unusual activity. Visit the secure portal to confirm your details:\nhttp:\/\/example.com-security-check.com\/login\n\nFailure to act in 24 hours may result in account suspension.\n\nThanks,\nSecurity Team\n<\/code><\/pre>\nText\/SMS template (copy and paste)<\/h3>\n
[Bank Alert]: Your account is locked. Verify identity at http:\/\/examp1e-support.net now.\n<\/code><\/pre>\nTip:<\/strong> Use obviously fake domains in your drills (like example.com-security-check.com<\/em> or examp1e-support.net<\/em>). These are for practice only.<\/p>\n
Decide roles:<\/p>\n
- \n
- Sender: prepares the test message and records results.<\/li>\n
- Observers: watch how others react (without shaming anyone).<\/li>\n
- Participants: practice checks and reporting.<\/li>\n<\/ul>\n
Create a simple scorecard:<\/p>\n
- \n
- Did we check the sender address carefully?<\/li>\n
- Did we hover\/long\u2011press to preview the real link?<\/li>\n
- Did we use the report button?<\/li>\n
- Did anyone click? If yes, what could we change?<\/li>\n<\/ul>\n
Run the Drill<\/h2>\n
Step 1: Send the test<\/h3>\n
- \n
- Send your safe test email\/text\/DM to participants.<\/li>\n
- Warning:<\/strong> Never attach executable files (like .exe) or enable macros. For practice, attach a harmless text file you created yourself, if needed.<\/li>\n<\/ul>\n
Step 2: Practice the 10\u2011second scan<\/h3>\n
- \n
- Check the sender: is the email or phone number slightly off?<\/li>\n
- Scan for urgency: \u201cact now,\u201d \u201c24\u2011hour deadline,\u201d or threats.<\/li>\n
- Look for odd spelling or grammar.<\/li>\n<\/ul>\n
Step 3: Inspect the link safely<\/h3>\n
- \n
- On computers: hover over the link. Look in the status bar for the real domain (the part just before the last dot, e.g., example.com<\/em>).<\/li>\n
- On phones: long\u2011press the link to preview. Do not open the page.<\/li>\n
- Optional: copy the link address and paste it into a plain text note to read it fully (do not visit it).<\/li>\n<\/ul>\n
Step 4: Decide and act<\/h3>\n
- \n
- If anything feels off, report it using your app\u2019s report button.<\/li>\n
- Delete the message. Do not reply. Do not forward.<\/li>\n<\/ul>\n
OS variations for link preview<\/h3>\n
Windows<\/h4>\n
- \n
- Hover the mouse over the link to see the actual URL in the status bar.<\/li>\n
- Right\u2011click the link, choose copy link, and paste into a note to inspect (do not open).<\/li>\n<\/ul>\n
macOS<\/h4>\n
- \n
- Hover over links to preview the destination. Press and hold Option while hovering in some apps to show details.<\/li>\n
- Control\u2011click to copy the link and review it in a note.<\/li>\n<\/ul>\n
iOS<\/h4>\n
- \n
- Long\u2011press a link to open the preview card. Read the full address before deciding.<\/li>\n
- Tap outside the preview to cancel. Do not open if unsure.<\/li>\n<\/ul>\n
Android<\/h4>\n
- \n
- Long\u2011press a link to preview or copy it. Inspect it in a note.<\/li>\n
- Back out if the preview looks odd or the domain is unfamiliar.<\/li>\n<\/ul>\n
Note:<\/strong> If a message claims to be from your bank, school, or a delivery service, ignore the link. Instead, go directly to the official website by typing the address yourself or using your saved bookmark.<\/p>\n
Deeper Diagnosis<\/h2>\n
Check the sender details<\/h3>\n
- \n
- Open the sender\u2019s details. Many apps let you tap or click the name to view the actual address or number.<\/li>\n
- Watch for extra letters, misspellings, or strange domains.<\/li>\n<\/ul>\n
Verify links and domains<\/h3>\n
- \n
- Read the domain carefully: real sites end with their proper domain (for example, example.com<\/em>, not example.com.verify-login.co<\/em>).<\/li>\n
- Search online for the domain plus the word \u201cscam\u201d to see if others reported it. Do not open the suspicious site itself.<\/li>\n<\/ul>\n
View full message headers (advanced, optional)<\/h3>\n
- \n
- Many email apps offer a \u201cview original,\u201d \u201cview headers,\u201d or \u201cshow details\u201d option.<\/li>\n
- Look for mismatched \u201cFrom\u201d and \u201cReturn\u2011Path\u201d addresses. If they differ wildly, it\u2019s likely a scam.<\/li>\n<\/ul>\n
Browser safety check<\/h3>\n
- \n
- Ensure your browser\u2019s phishing\/malware protection is on. Look for settings like \u201cSafe Browsing,\u201d \u201cFraudulent site warning,\u201d or \u201cDeceptive site protection.\u201d<\/li>\n
- Clear any saved password prompts for suspicious sites if you accidentally visited one.<\/li>\n<\/ul>\n
Warning:<\/strong> Do not change your system registry, edit the hosts file, or reset your router for this drill. These are risky and not required.<\/p>\n
Preventive Care<\/h2>\n
- \n
- Update devices monthly. Install OS and app updates on Windows, macOS, iOS, and Android.<\/li>\n
- Use a password manager and unique passwords for important accounts.<\/li>\n
- Enable 2FA (two\u2011factor authentication) on email, banking, and cloud storage.<\/li>\n
- Back up your files: at least one offline or cloud backup. Test a small restore quarterly.<\/li>\n
- Teach \u201cverify out\u2011of\u2011band\u201d: if you get a money or password request, call or text the person at a known number before acting.<\/li>\n
- Router care: log in monthly to check for updates. Do not factory\u2011reset unless support tells you to. Change default admin passwords if you still use them.<\/li>\n
- Downloads: only from official sources. Avoid random pop\u2011ups offering updates or cleaners.<\/li>\n<\/ul>\n
Tip:<\/strong> Keep a \u201cSuspicious? Pause.\u201d sticky note near your computer as a reminder to slow down and check links.<\/p>\n
When to Seek Help<\/h2>\n
- \n
- You clicked a bad link and entered info: immediately change that account\u2019s password, turn on 2FA, and review recent activity.<\/li>\n
- You clicked and downloaded\/ran a file: disconnect from the internet. Run a full device scan with your built\u2011in security tool. If unsure, contact a trusted professional.<\/li>\n
- Money or transactions: contact your bank or card provider at the number on the back of your card (not numbers in the message). Act quickly.<\/li>\n
- Children or elders targeted repeatedly: consider professional training or a local tech helper to review settings.<\/li>\n
- Unusual device behavior after a suspicious click (pop\u2011ups, slowdowns): get expert help.<\/li>\n<\/ul>\n
Wrap up each drill by noting wins and one improvement for next time. Keep it positive. The goal is steady progress, not perfection.<\/p>\n
Frequently Asked Questions<\/h2>\n
How is phishing different from smishing?<\/h3>\n
Phishing usually arrives by email. Smishing is phishing by text\/SMS. The red flags are the same: urgency, odd links, and requests for sensitive info.<\/p>\n
What if someone falls for the drill?<\/h3>\n
Use it as a teaching moment. Review the red flags together. Celebrate the fix (reporting, deleting, and enabling 2FA) so confidence stays high.<\/p>\n
How often should we run drills?<\/h3>\n
Monthly is ideal. It is short enough to remember and long enough to avoid fatigue. Rotate email, text, and social scenarios.<\/p>\n
Do we need special software?<\/h3>\n
No. Your existing email and messaging apps have report buttons and link previews. Good habits and updates are your best defense.<\/p>\n","protected":false},"excerpt":{"rendered":"
Run a 10-minute monthly phishing drill to protect your home network. Simple steps for email, texts, and social scams. Includes Windows, macOS, iOS, Android tips.<\/p>\n","protected":false},"author":1,"featured_media":544,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[9],"tags":[],"class_list":["post-545","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-it-docs"],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/i0.wp.com\/blog.asambe.ai\/wp-content\/uploads\/2026\/01\/2026-01-11-22-22-54-data.png?fit=1024%2C1024&ssl=1","_links":{"self":[{"href":"https:\/\/blog.asambe.ai\/index.php\/wp-json\/wp\/v2\/posts\/545","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.asambe.ai\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.asambe.ai\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.asambe.ai\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.asambe.ai\/index.php\/wp-json\/wp\/v2\/comments?post=545"}],"version-history":[{"count":1,"href":"https:\/\/blog.asambe.ai\/index.php\/wp-json\/wp\/v2\/posts\/545\/revisions"}],"predecessor-version":[{"id":546,"href":"https:\/\/blog.asambe.ai\/index.php\/wp-json\/wp\/v2\/posts\/545\/revisions\/546"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.asambe.ai\/index.php\/wp-json\/wp\/v2\/media\/544"}],"wp:attachment":[{"href":"https:\/\/blog.asambe.ai\/index.php\/wp-json\/wp\/v2\/media?parent=545"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.asambe.ai\/index.php\/wp-json\/wp\/v2\/categories?post=545"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.asambe.ai\/index.php\/wp-json\/wp\/v2\/tags?post=545"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- Search online for the domain plus the word \u201cscam\u201d to see if others reported it. Do not open the suspicious site itself.<\/li>\n<\/ul>\n
- Read the domain carefully: real sites end with their proper domain (for example, example.com<\/em>, not example.com.verify-login.co<\/em>).<\/li>\n
- On computers: hover over the link. Look in the status bar for the real domain (the part just before the last dot, e.g., example.com<\/em>).<\/li>\n
- Quick Fix Steps<\/a><\/li>\n