Phishing is a message that tricks you into clicking a harmful link or handing over information. CISA gives three steps that teenagers can remember: recognize the warning signs, resist the urge to click, and delete the message without replying. If it might be real, check through a separate channel.
Recognize
CISA lists warning signs: urgent or emotional language, requests for personal or financial information, shortened links you cannot trust, and misspelled addresses or links. It adds a modern point. AI can write polished messages, so do not rely on bad grammar as the clue.
Phishing arrives by email, text, social media message and phone call. For teens, the common places are direct messages and game chats, so teach the pattern, not one channel.
Resist
Do not click suspicious links or open attachments. Report the message through the platform's reporting tool. The FTC adds that real companies do not usually ask you to update payment details through a link in an email or text.
A useful family rule: nobody is in trouble for nearly clicking, and nobody is in trouble for clicking if they say so quickly. Speed of telling matters more than perfection.
Delete
Delete without replying, clicking a link or attachment, or using "unsubscribe".
When it might be real
CISA says to contact the company or person through a separately verified method, such as the official website or a phone number you already know, not the details in the message. Its summary line is worth printing: "If a message looks suspicious, it's probably phishing."
If a teen clicked
The FTC suggests: update your security software and run a scan if you clicked a link or opened an attachment, and visit IdentityTheft.gov if personal information may have been exposed. To report, forward emails to reportphishing@apwg.org, forward texts to 7726 (SPAM), and report at ReportFraud.ftc.gov. Change the password for that account, and for any account sharing it, as in family password habits.
Practice together
Take an evening and sort a handful of real looking messages into safe and suspicious. Do it with your own inbox examples with personal details hidden. Teens usually enjoy catching the parent out.
Quick check
Should we trust a message because it has no spelling mistakes?
No. CISA says AI can produce polished messages, so look for other warning signs such as urgency and requests for information.
Is it fine to tap unsubscribe to make it stop?
CISA advises against using unsubscribe links in suspicious messages. Delete them.
Sources
Last reviewed: 19 October 2026.
