Anatomy of a Phish

Sharkley's 'perfect' email has the bank's logo, a fancy signature and Barry's real name. Professor Shelldon dissects it like a biology lesson and shows the one thing scammers can't hide: the real address. Check the address, not the dress!

Coming soon

This episode is on its way to YouTube.

Subscribe to @phishmael

Today's rule: Check the address, not the dress.

What kids learn

Logos and names can be copied
Read the end of the address (before the first slash)
Hover before you click

Quiz time

Can you get them all?

Which link really belongs to Reef Bank?

Which sender is really Coral Post?

Play the game

🔍 Link Detective

The real Reef Bank lives at reefbank.reef. Can you spot the lookalike links?

For parents & teachers

Talk about it together

Open a real email together and find the sender's actual address.
Practise hovering over (or long-pressing) links to see where they really go.
Explain that logos and names can be copied, so they don't prove anything.
At work: report strange emails to your IT team, even if you're the boss.

Check the Address, Not the Dress: How to Read a Suspicious Email

Modern scam emails can look perfect: the right logo, your real name, polite language and no spelling mistakes. In this episode, Professor Shelldon dissects one, and sorts its parts into 'the dress' and 'the address'.

Read the full guide →