
Everyday MODULE
Phishing fundamentals
Start here. What phishing is, why it works, and the one check that answers most of it.
The entry point to the catalogue and the module a new starter should do first. What phishing actually is, why convincing messages get past capable people, the places it arrives beyond email, and the single habit that answers almost all of it. Written for everybody in an organisation, with no technical background assumed.
- Recognise what a suspicious message is asking you to do, whatever story it tells.
- Check an unexpected request through a route the message cannot reach.
- Report quickly and confidently, including when you have already clicked.
Your learning path
01What the message is really asking forRecognise the action behind a message, whatever story is wrapped around it.Free preview02Why it works on people who are paying attentionUnderstand the levers a phishing message pulls, and why noticing them is not a matter of being clever.Locked03It does not only arrive by emailApply the same thinking to texts, calls, chat messages and QR codes.Locked04Checking it properlyVerify an unexpected request in a way that actually proves something.Locked05The account behind the messageMake a stolen password less useful, and recognise the requests that are after your second step.Locked06Reporting, and what to do if you already clickedAct quickly and usefully after a suspicious message, whether or not you did anything with it.LockedPut your decisions into practice.
Complete each lesson’s scenario, then take eight new questions. A score of at least 80% earns a personal completion record. Retry with feedback; this is a learning exercise, not a timed exam or professional accreditation.
Lessons and scenarios are original Jatzo material informed by published guidance and research:
- NCSC: phishing scams, how to spot and report them
- NCSC: how to spot scam messages
- NCSC: report a suspicious email
- NCSC: phishing attacks, defending your organisation
- NCSC: three random words, and password managers
- NCSC: QR codes, what is the real risk
- Cyber security breaches survey 2025 to 2026
- Report Fraud: reporting a fraud
- Check Point: Q2 2026 brand phishing report
