“`html

If you want to teach kids to spot phishing emails, the good news is you don’t need a cybersecurity degree — and neither do they. With the right framework, a child as young as eight can learn to pause, scan, and make a smart decision in under 60 seconds. That simple habit could protect your whole family from scams, stolen passwords, and identity theft.

Phishing emails are now the number one delivery method for cyberattacks targeting families. And as kids spend more time online — in school, gaming, and messaging — their inboxes are increasingly in the crosshairs. The question isn’t if your child will receive a phishing attempt, but when.

This guide gives you a practical, age-appropriate method for building that critical skill — fast.

Why Are Kids Especially Vulnerable to Phishing Attacks?

Children are naturally trusting. They’re also less experienced with the subtle cues that signal something is off. A teenager who gets an email saying “Your Roblox account has been suspended — click here to restore it” feels urgency before they feel skepticism.

Cybercriminals know this. They craft messages around the things kids care about most: gaming accounts, social media, free gifts, and school deadlines. According to the Federal Trade Commission, phishing is one of the most commonly reported cybercrimes affecting young people and their families.

There’s also the issue of hand-me-down devices. Kids using an older tablet or a shared family email account may receive phishing attempts that were aimed at adults — but land in front of a child who doesn’t know the warning signs.

The solution isn’t to lock everything down. As we explore in our piece on monitoring vs teaching why parental controls arent enough on their own, restriction without education leaves kids unprepared the moment they step outside your controls.

What Exactly Is a Phishing Email? How Do You Explain It to a Child?

Start with an analogy your kids already understand: a phishing email is like a costume. It’s designed to look exactly like something real — a message from their school, a notification from YouTube, or an alert from a game — but underneath the costume, it’s a scammer trying to steal something.

For younger kids (ages 6–10), keep it simple:

• “Some bad guys send fake emails that look real to trick you into clicking a link.”
• “They want your password, your name, or to put a virus on our computer.”
• “If something feels weird, you come to me first — no clicking.”

For tweens and teens (ages 11–17), you can go deeper:

• Phishing emails impersonate trusted brands (Google, Netflix, your school district).
• They use fake links that look real but redirect to malicious sites.
• Their goal is to harvest credentials, install malware, or trick someone into sending money.
• The Cybersecurity and Infrastructure Security Agency (CISA) estimates that over 90% of successful cyberattacks begin with a phishing email.

Once your child understands what phishing is and why it works, they’re ready to learn how to spot it.

The 60-Second Phishing Check: A Simple Method Kids Can Actually Use

The best phishing education gives kids a repeatable process, not just a list of rules to memorize. The method below — called the SLAM Check — takes less than a minute and covers the four areas where phishing emails almost always give themselves away.

S — Check the Sender

Teach your child to look at the actual email address, not just the display name. A message may say it’s from “Netflix Support” but come from something like [email protected].

• Does the domain match the real company? (@netflix.com vs. @netflix-alert.com)
• Is the name spelled strangely? (Goog1e instead of Google)
• Do you know this person at all?

L — Look at the Links (Before Clicking)

On a computer, hovering your mouse over a link shows you where it actually goes — without clicking. On a phone, pressing and holding a link usually reveals the URL.

• Does the link match the website it claims to be from?
• Is there a long string of random characters in the URL?
• Does the link start with http:// instead of https://?

Teach this as a reflex: hover before you click, every single time.

A — Check for Attachments You Didn’t Expect

Unexpected attachments — especially .zip, .exe, or .docm files — are one of the most dangerous elements in a phishing email. Malware can be embedded in documents that look completely normal.

• Did anyone tell you they were sending you a file?
• Is the file type something unusual for a school assignment or game update?
• When in doubt, don’t open it — ask a parent first.

M — Read the Message for Pressure and Panic

Phishing emails rely on urgency and fear. They want you to act before you think. Common pressure phrases include:

• “Your account will be deleted in 24 hours.”
• “Unusual activity detected — verify immediately.”
• “You’ve won a prize — claim it now before it expires.”
• “Action required or your order will be cancelled.”

Teach your child: the more panicked an email makes you feel, the more suspicious you should be. Legitimate companies don’t threaten you into clicking links.

How Do You Make Phishing Education Actually Stick?

Telling kids about phishing once isn’t enough. Research consistently shows that practice beats passive learning for building lasting digital safety habits. Here’s what works:

Turn Real Emails into Teaching Moments

The next time you spot a suspicious email in your inbox, pull your child over and walk through the SLAM Check together. Point out the fake sender address. Hover over the link. Show them how the urgency language is designed to pressure them. Real examples are far more memorable than hypothetical ones.

Use Simulated Phishing Practice

Tools like LanternPhish let families practice identifying phishing attempts in a safe, controlled environment — so kids build pattern recognition before they encounter the real thing. Simulation-based learning is the same method used to train corporate employees, and it works just as well with children.

Make It a Family Habit, Not a One-Time Lesson

You don’t learn to ride a bike by hearing about it once. Build phishing awareness into your regular routines. Check out these safer internet day activities fun ways to teach your family about online safety — many of them translate into easy weeknight habits that reinforce the SLAM method.

What Are the Most Common Phishing Red Flags to Teach Your Kids?

Beyond the SLAM framework, here are the specific warning signs that appear again and again in phishing emails targeting children and teens:

• Prize and gift card offers: “You’ve been selected to receive a $100 Amazon gift card.” Legitimate brands don’t give away prizes via unsolicited email.
• Account suspension threats: Messages threatening to delete a gaming account, YouTube channel, or school login are almost always fake.
• Requests for your password: No legitimate service will ever ask for your password by email. Ever.
• Misspellings and grammar errors: Professional companies proofread their emails. Awkward phrasing is a classic phishing giveaway.
• Generic greetings: “Dear Customer” or “Dear User” instead of your actual name suggests a mass phishing campaign.
• Mismatched branding: The logo looks slightly off, the colors are wrong, or the email design looks dated compared to the real brand.
• Requests to “verify” information: If an email asks you to confirm personal details, payment info, or login credentials through a link, treat it as phishing.

The FBI’s Internet Crime Complaint Center (IC3) consistently ranks phishing among the top cybercrime categories by victim count. Teaching kids to recognize these signs is one of the highest-leverage safety investments you can make.

How Can Families Practice Spotting Phishing Emails Together?

Practice doesn’t have to feel like homework. Here are a few low-pressure ways to build the skill together:

The “Real or Fake” Game

Pull up a mix of real emails and obvious phishing examples (many free samples are available through cybersecurity education resources). Take turns guessing which is real and which is fake. Walk through the reasoning out loud — the process matters as much as the answer.

The Dinner Table Quiz

Once a week at dinner, read out a phishing scenario: “You get an email from your school saying your account will be locked unless you click this link and enter your password. What do you do?” Let your kids talk through it. There’s no score — just practice thinking critically.

The Screenshot Museum

When you spot a real phishing attempt in your inbox, screenshot it and save it. Over time, build a family “phishing museum” — a folder of real attempts you’ve caught. Reviewing them together reinforces what to look for and reminds everyone that these threats are genuinely common.

For a broader framework for building family digital literacy, our the parents complete guide to internet safety in 2026 covers phishing alongside other key threats families face this year.

What Should Your Child Do If They Receive a Suspicious Email?

Even with solid training, kids will still encounter emails they’re unsure about. Give them a clear, simple protocol so they always know what to do:

1. Stop. Don’t click anything. Not the link, not the attachment, not the “unsubscribe” button.
2. Tell a trusted adult. Show a parent, guardian, or teacher before taking any action.
3. Report it. Most email providers have a “Report Phishing” button. Use it — it helps protect other people too.
4. Delete it. Once it’s been reviewed, remove the email from the inbox and trash.
5. If they clicked something: tell you immediately. No blame, no punishment. Fast action can limit the damage. Change affected passwords right away.

The most important thing is to create an environment where kids feel safe coming to you when something goes wrong. If they’re afraid of getting in trouble, they’ll hide it — and that’s when real damage happens.

Start Building This Habit Today

Teaching your kids to spot a phishing email in 60 seconds isn’t about turning them into cybersecurity experts. It’s about giving them a short, repeatable checklist — Sender, Links, Attachments, Message — that becomes second nature over time.

The families that stay safe online aren’t the ones with the most restrictions. They’re the ones that practice together, talk openly about threats, and treat digital literacy as a life skill worth investing in.

Start practicing internet safety with your family today at LanternPhish.com — and turn that 60-second check into a habit your kids will carry for life.

Frequently Asked Questions

At what age should I start teaching my child about phishing emails?

You can introduce basic concepts — “some emails are fake and try to trick you” — as early as age 6 or 7, using simple analogies like costumes or disguises. By age 10, most children are ready to learn the SLAM method and practice identifying phishing red flags with parental guidance.

What are the most common phishing emails targeting kids right now?

The most frequently reported phishing lures targeting children involve gaming platforms (Roblox, Fortnite, Minecraft), free gift card offers, fake school district notifications, and impersonation of popular streaming services like YouTube or Netflix. These messages typically threaten account loss or dangle a reward to create urgency.

How is phishing different from spam?

Spam is unsolicited bulk email — annoying, but usually harmless (think promotional newsletters you never signed up for). Phishing is a targeted attempt to deceive you into taking a specific action, like clicking a malicious link or surrendering your login credentials. Phishing emails are designed to look legitimate, while spam usually doesn’t bother with disguise.

What should I do if my child already clicked a phishing link?

Act quickly but calmly. Disconnect the device from Wi-Fi, change the password for any account that may have been accessed, run a malware scan, and check if any personal or payment information was entered on the fake site. Report the incident to the platform being impersonated, and if financial data was involved, contact your bank. The FTC’s fraud reporting portal accepts phishing reports that help investigators track active campaigns.

Can phishing happen through text messages too, not just email?

Yes — phishing via text message is called “smishing,” and it’s growing rapidly. The same red flags apply: suspicious sender numbers, urgent language, unexpected links, and requests for personal information. Teach your kids that the SLAM method works on texts and direct messages too, not just email.

How often should families practice phishing awareness?

Even brief, monthly conversations keep the skill sharp — it doesn’t require formal lessons. Sharing real-world examples when you spot them, using free simulation tools occasionally, and discussing any close calls your family experiences is enough to maintain strong awareness without making it feel like a chore.

“`