Chapter 8 — Spotting phishing
Lesson map
Lesson 08 published. Map, example, EX029.
flowchart TD
N0["Learning outcomes"]
N1["8.1 Signs of phishing"]
N2["8.2 The phishing lab"]
N3["Lab — Scoring synthetic emails with four phishing si"]
N4["8.3 Why rules miss"]
N5["8.4 What staff should do"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX029"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["8.1 Signs of phishing"]
N2["8.2 The phishing lab"]
N3["Lab — Scoring synthetic emails with four phishing si"]
N4["8.3 Why rules miss"]
N5["8.4 What staff should do"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX029"]
[Learning outcomes]
|
v
[8.1 Signs of phishing]
|
v
[8.2 The phishing lab]
|
v
[Lab — Scoring synthetic emails with four phishing si]
|
v
[8.3 Why rules miss]
|
v
[8.4 What staff should do]
|
v
[Worked example] --> [Exercise EX029]
Learning outcomes
You will (1) recognise common signs of phishing; (2) test a simple scoring rule; (3) explain why rules miss some messages.
8.1 Signs of phishing
Phishing emails try to trick people into clicking a harmful link, opening an attachment or giving away information. Chloe learns four common signs: the sender's address does not match the organisation it claims to be from, the message uses urgent words such as immediately or account suspended, a link's real address differs from the text shown and there is an unexpected attachment. Mr. Appiah warns that careful attackers avoid some of these signs, so none is a guarantee. She writes the four signs on a card.
8.2 The phishing lab
The lab scores 40 synthetic emails, 12 known to be phishing and 28 genuine, by counting how many of the four signs each shows. Messages with two or more signs are flagged. The rule catches 11 of the 12 phishing emails and misses one. It also flags 3 genuine emails as false alarms. Chloe looks at the missed message and finds it showed only one sign, a sender address that did not match, with no urgent words, odd link or attachment. She shows the result to Mr. Appiah, who points out that a rule looking at only four signs will always miss some messages, because attackers can change their methods to avoid them.
Lab — Scoring synthetic emails with four phishing signs and comparing with known labels
"""Score synthetic emails with four simple phishing indicators and compare with known labels (stdlib only)."""
import random
random.seed(3)
msgs = []
for i in range(40):
phish = i < 12
f = {
"sender_mismatch": random.random() < (0.75 if phish else 0.05),
"urgent_words": random.random() < (0.8 if phish else 0.15),
"link_mismatch": random.random() < (0.7 if phish else 0.03),
"unexpected_attachment": random.random() < (0.4 if phish else 0.1),
}
msgs.append((phish, sum(f.values()), [k for k, v in f.items() if v]))
tp = sum(p and s >= 2 for p, s, _ in msgs); fn = sum(p and s < 2 for p, s, _ in msgs)
fp = sum((not p) and s >= 2 for p, s, _ in msgs); tn = sum((not p) and s < 2 for p, s, _ in msgs)
print(f"messages {len(msgs)}; phishing {tp+fn}; genuine {fp+tn}")
print(f"flagged (score >= 2): caught {tp}, missed {fn}, false alarms {fp}")
print("signs on missed phishing:", [k for p, s, k in msgs if p and s < 2])
Run with python3 lab_phish.py. Verified output:
messages 40; phishing 12; genuine 28
flagged (score >= 2): caught 11, missed 1, false alarms 3
signs on missed phishing: [['sender_mismatch']]
8.3 Why rules miss
Chloe learns that any simple rule makes two kinds of mistake. It misses some phishing, and it flags some genuine messages. Lowering the threshold to one sign would catch more phishing but create many more false alarms, such as genuine supplier emails marked urgent. Raising it would miss more phishing. Mr. Appiah explains that rules help people focus, but staff judgement and a way to report doubts are still needed. She tries the threshold of one sign on paper with the same messages and sees the false alarms rise, which helps her understand the trade-off.
8.4 What staff should do
Chloe writes simple advice for Westfield staff: if an email shows any of the four signs, do not click; check by contacting the sender another way; and report it to Mr. Doyle with the report button in the email program. She also explains that reporting a genuine email by mistake is fine. Mr. Doyle prefers ten unnecessary reports to one missed phishing email. Staff respond well to the clear, blame-free message. She prints the advice on a small card for each till and office desk. Mr. Doyle receives more reports in the following month.
Worked example
Chloe learns four phishing signs, finds a two-sign rule catches 11 of 12 synthetic phishing emails with 3 false alarms and writes blame-free advice for staff.
Synthetic case. Emails are synthetic; outputs come from lab_phish.py.
Errors and limits
Treating a simple rule as perfect leads people to trust messages it misses.
Exercises
- EX029 — Caught count. How many phishing emails does the rule catch? Rubric: 3 = 11 of 12;; 2 = partly correct;; 1 = wrong;; 0 = none.
- EX030 — False alarms. How many genuine emails are flagged? Rubric: 3 = three;; 2 = partly correct;; 1 = wrong;; 0 = none.
- EX031 — Missed message. Why was one phishing email missed? Rubric: 3 = it showed only one sign;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX032 — Lower threshold. What happens if the threshold drops to one sign? Rubric: 3 = more false alarms;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 08 (chapter 08 of 18)
← Chapter 07 · Course chapter index · Chapter 09 →
Continue to the next authored lesson.