Spotting and Stopping Phishing Attempts as a Family

Phishing works because it targets the moment somebody is tired, distracted, or under pressure. You can't train that out of a household. You can build systems that catch it.

The three phishing archetypes

Urgency ('your bank is locked'), authority ('IT needs your password'), and reward ('you won'). Every phishing message is one of these.

The 'pause five seconds' rule

Before clicking any link in any message that made your pulse rise, pause. Almost every phish loses its power under five seconds of scrutiny.

Verify out-of-band

If your 'bank' emails you, don't click the link. Open the bank's app yourself. This one habit blocks 80% of phishes.

Teach the kids the 'weird vibe' test

Kids are usually better than adults at 'this feels off.' Trust that instinct. It's not paranoia; it's pattern-matching.

The shared inbox as a phishing net

Because the family sees every subscription email, a fake receipt gets a second and third pair of eyes. That's a superpower for anti-phishing.

Reset-link protection

The vault reset flow always warns before opening any URL that looks like a password reset from an inbox message. That warning has caught real phishes in testing.

What to do if someone clicks

Don't panic. Change the affected password from the vault (not from the phish link). Enable 2FA if it wasn't on. Check the activity log for surprises.

The lie of 'sophisticated' phishing

Most phishing is not sophisticated. It's a numbers game — good hygiene defeats 99% of it. Save your paranoia for the last 1%.

A worked example

A teen in the household gets a 'your Roblox account has been suspended' email. Because the family inbox already has all real Roblox mail, the fake one looks wrong immediately.

Wrap it up

Phishing training isn't a single lecture. It's a shared vocabulary. Once your household can say 'weird vibe' about a message, you've won most of the fight.