The reading is a comic. Students follow Dee, a student IT intern, through one morning and three attempted cons: a fake IT phone call, a phishing email and a stranger at the back door. Then they sort a real-looking inbox, run phone calls against a verification checklist, and write the incident report.
The reading is a comic. It replaces a textbook passage: every key term is defined in a caption with an example and a non-example, the process and the figure are drawn as panels, and it ends with a Summary. A plain-text version sits under it. Read it.
Objectives
Students will be able to:
- Define social engineering, vishing, phishing, smishing, tailgating, impersonation and urgency, and give an example and a non-example of each.
- Identify the warning signs in a phishing email.
- Apply verification: contact a person through a number or address already known to be real.
- Write an incident report that another technician could act on.
Board question
- Name one thing someone could get from you without ever touching your computer.
- Describe, in one sentence, a call, text or email that made you suspicious. Leave out anything private.
Students answer in the notebook at the start, and revisit the answer on the exit ticket.
The 90-minute block
| Minutes | Segment | Teacher | Students |
|---|---|---|---|
| 0–8 | Do Now | Board question. Collect a few suspicious-message stories aloud; keep names and private details out. | Answer both asks. |
| 8–28 | Read the Comic | The comic is the reading and the I Do. Students read it on their own, then answer lab Part A. Read panels 1 to 4 aloud first for students who need it. | Read the comic; lab sheet Part A. |
| 28–38 | Debrief | Walk panel 5 (the code con) step by step: which step did Ms. Harris stop? Then Figure 1: cover the flags and have the room find them. | Name the step that broke the attack; find the email flags. |
| 38–58 | Lab: The Inbox | Pairs sort six messages. Push for a reason on every call, including the real ones. | Lab Part B. |
| 58–72 | Lab: The Call | Pairs run the phone call twice, switching roles. The receiver follows the checklist. | Lab Part C. |
| 72–84 | Lab: The Report | Students write the incident report for the comic's morning. Share two aloud. | Lab Part D. |
| 84–90 | Exit Ticket | Board question returns. Two A+-style items. | Revisit, then answer. |
The 50-minute period
| Minutes | Segment | Teacher | Students |
|---|---|---|---|
| 0–4 | Do Now | First board ask. | Answer the first ask. |
| 4–22 | Read the Comic | Independent reading, then Part A questions 1–3. | Comic; Part A 1–3. |
| 22–40 | Lab: The Inbox | Pairs sort the six messages. | Lab Part B. |
| 40–50 | Exit Ticket | Both board asks and the two items. | Revisit, then answer. |
What moves to tomorrow: Part A questions 4 and 5, the phone call (Part C) and the incident report (Part D) run tomorrow. The comic stays open as the reference.
Materials
- The comic, on Chromebooks or printed in color (12 panels).
- Lab sheet (printed), one per student.
- Phone-call role cards (on the lab sheet: one caller card and one receiver checklist per pair).
Before class
- Decide how students read the comic: on Chromebooks, or printed. It prints in color and stays readable in grayscale.
- Find your school's real help desk number and how staff report a suspicious email, so Part C and the debrief use the real procedure.
Vocabulary
- Social engineering
- Tricking a person into giving up information or access, instead of breaking into a computer.
- Impersonation
- Pretending to be someone the person trusts.
- Urgency
- Pressure to act right away, so the person acts before thinking.
- Vishing
- Social engineering over the phone.
- Phishing / smishing
- Social engineering by email / by text message.
- Tailgating
- Following an authorized person through a secured door without using a badge.
- Shoulder surfing
- Watching someone type a password or PIN.
- Verification
- Contacting the person through a number or address you already know is real.
Exit ticket
Item 1 is always the board question, revisited. Then:
A user receives a call from someone who says they are from IT and asks for the six-digit code that was just texted to the user. What type of attack is this?
- Phishing
- Vishing (key)
- Tailgating
- Shoulder surfing
An employee holds a secured door open for a person carrying boxes who has not used a badge. What is this an example of?
- Tailgating (key)
- Smishing
- Impersonation by email
- Dumpster diving
Support
- The comic carries the reading in pictures and short captions, with a plain-text version under it that works with screen readers and translation tools.
- Part A questions point to the exact panel.
- In Part C the teacher can play the caller for students who prefer not to perform.
Stretch
- Write a training phishing email with three warning signs, and swap with a partner to find them.
- Research one reported attack on a school district and identify which kind of social engineering it used.
Where this leads
Help desks are the front line for social engineering: technicians take these calls, see these emails first and write the reports. A student who can explain the code con and write a clean incident report has a strong interview answer.