Unit 1, Day 1: How Scams Work

Lesson 1 of 6 in Unit 1, Spot It, Lock It, Recover

School-year day

Day 1 of 180

Time

20-minute core + 30-minute extension (50 minutes in all)

Teacher Talk with MystrS. Checked October 27, 2026 (Pacific time). Tags: Cyber.

Existing lessons: /cyber/government-impersonator-scams/, /teach-it-this-week/irs-wont-text-you/, /cyber/scam-text-signs/ (preview for Day 2)

Goal: Students will be able to:

• Name the FTC's four signs of a scam.
• Apply the four signs to a made-up message without using any real personal accounts.
• Explain one safe first move: stop before you click, call or pay.

Materials:

• Projector or board
• One printed card set per pair (six made-up messages, each labeled "Made-up example")
• Exit ticket slips (or LMS equivalent)

Core (20 min)

1. Warm-up. Teacher: "A message can look ordinary and still be a trap." Students write one sentence defining a scam. Share two examples aloud (no real student stories required). (3 min)
2. Teach the FTC's four signs: scammers pretend to be someone you trust; they make up a problem or a prize; they pressure you to act immediately; they tell you to pay in a specific way that is hard to reverse (gift cards, crypto, wire, cash apps). Quick check: thumbs up if "Pay a $2.99 fee with a gift card in the next 10 minutes" is a scam sign. (7 min)
3. Activity, Spot the four signs. Pairs mark which signs appear on six made-up cards (a card can have more than one). Cards: (1) fake school tech office demanding a password in 1 hour; (2) prize text that asks for a prepaid card fee; (3) "Mom" asking for a login code; (4) fake Amazon call-now text; (5) friend Venmo ask (may be real: check through another channel); (6) fake IRS crypto demand (tie to irs-wont-text-you). One pair explains card 1. (7 min)
4. Exit ticket. Name the four FTC signs in your own words. Circle which sign showed up most often. (3 min)

Extension (up to 30 min)

• Groups rewrite one scam card into a safer version of the same situation (for example, school tech contact through the school account you already use). Share two rewrites. (15 min)
• Family connect: preview /teach-it-this-week/government-impersonator-scams/. Students draft one Table Talk question for home. (10 min)
• Stretch: teacher projects ISC2 CC Domain 2.3 Concepts line only. Students write one sentence connecting "social engineering" to today's four signs. (5 min)

Check for understanding: Student names all four signs (or three of four with a clear example), and marks at least one sign correctly on two different cards.

Differentiation and EL / IEP supports:

• EL: one-page glossary (scam, pretend, pressure, prize, gift card); short-phrase answers OK.
• IEP / 504: checklist with the four signs preprinted; oral exit ticket OK.
• Advanced: seventh card that mixes a real-looking brand with a weird payment method; no links opened.
• Shared devices: Core stays on paper; students do not need FTC.gov.

Standards (from our standards map):

• CSTA 2026: S1-CYB-PP-14; HS-SYS-SE-31; HS-SYS-SE-32
• CSTA 2017: 2-NI-05 (related awareness)
• NICE: PD-WRL-006; OG-WRL-008 (awareness)
• NSPFE: Managing Risk (as mapped for CyberSandberg scam lessons)

Certification alignment (ISC2 CC): Domain 2.3 Understand security awareness (social engineering, phishing); Domain 1.1 Privacy (awareness). Outline: English, Revised 01-2026, effective September 1, 2026. https://www.isc2.org/certifications/cc/cc-certification-exam-outline

Sources

1. FTC: How To Avoid a Scam, four signs, checked October 27, 2026.
2. FTC: How to Recognize and Report Spam Text Messages, checked October 27, 2026.
3. ISC2 CC Exam Outline, Revised 01-2026, checked October 27, 2026.
4. CyberSandberg lesson-standards map, checked October 27, 2026.