TryBench
Digital Safety & Security Tasks · Practitioner lesson 10 of 17

Spotting Fake Emails

Detect sender mismatches, artificial urgency, and scam links with AI triage.

Why this matters

Quickly pulling out the key facts from a suspicious email helps your security team act in minutes instead of hours.

Phishing Uses Fake Deadlines

Attackers use tight deadlines, like "within 60 minutes", so you skip your normal checks. Pressure is a warning sign.

In real life: Phishing uses a short deadline, like 'within 60 minutes', so you skip the usual checks. Pressure is a clue that something is wrong.

Check the Sender Address First

Look at the real email address, not the display name. A small typo or lookalike domain is the strongest sign of fraud.

In real life: A letter signed "Bank Manager" could come from anyone. The postmark shows where it really came from. In email, the postmark is the address after the @ sign.

Ask for Proof Before the Verdict

Ask the AI to quote the exact suspicious sender and the urgent words before it says PHISHING. Then you can check its work.

In real life: A good detective shows the evidence before naming the suspect. Asking the AI to quote the exact sender and deadline lets you see why it says PHISHING.

Your practice task

Analyze the suspicious email alert below. Have the AI identify the mismatched sender domain, the urgent deadline phrase, and the targeted department, then return raw JSON (no markdown ```) with keys: sender_domain, urgent_phrase, and targeted_dept.

How to do it

  1. Read the suspicious email above.
  2. Ask the AI to find the sender domain, the deadline phrase, and the department being copied.
  3. Ask for raw JSON with exactly those three keys.
  4. Say: no ``` marks. Press Run proof.

Practice it for free in the app. You get instant checks that show what you got right and what to fix. A lesson takes about two minutes and you can try as many times as you like.

Quick reference: Email Phishing Triage Prompt

Automates initial screening of employee-reported suspicious emails.

Analyze the email text inside <email> tags.
Extract:
1. sender_domain: Actual domain from the From header.
2. urgent_phrase: Any high-pressure deadline.
3. verdict: [CLEAN | PHISHING].
Return ONLY a JSON object matching this schema. No markdown fences.

<email>
[Paste email here]
</email>

Practice this lesson free

More lessons in this course

See all 17 lessons in Digital Safety & Security Tasks