Digital Literacy · Grade 6 · Chapter 1
Online Safety Deep Dive
Recognizing sophisticated scams, multi-factor security, and managing your permanent digital footprint.
Lesson Overview
Learning Objectives
- Identify Phishing: Spot fake links, deceptive domain names, and social engineering tactics.
- Strengthen Authentication: Understand passphrases and Two-Factor Authentication (2FA).
- Control Digital Footprint: Analyze how personal data is collected and permanent online records are created.
- Actionable Defense: Apply step-by-step verification protocols before clicking or sharing.
Building On Grade 5
What Changes in Grade 6?
Grade 5 Safety
Simple rules: "Don't talk to strangers" and "Use a strong password with a capital letter."
Grade 6 Deep Dive
Understanding how attackers trick people using urgency, spoofed addresses, malware payloads, and data tracking.
Case Study
The Free 10,000 Robux Trap
Rami gets a Discord message from a friend's account: "Hey! Click here fast to get 10,000 free Robux before the link expires in 10 mins: http://roblox-claim-free.net/login"
Smartboard Prompt: Why did Rami's friend send this? Did Rami's friend actually send it, or was their account hijacked?
Core Concept #1
Social Engineering & Phishing
Social Engineering tricks people into revealing confidential information by exploiting trust, fear, curiosity, or artificial urgency.
URGENCY
Time Pressure
"Act in 5 minutes or your account will be deleted forever!"
AUTHORITY
Fake Admins
Pretending to be game developers, teachers, or IT support staff.
CURIOSITY
Free Rewards
Promising gift cards, free skins, or exclusive game mods.
Attack Mechanism
How a Phishing Scam Spreads
STEP 1
Phishing Link Sent
Attacker sends fake link via DM or email.
STEP 2
Fake Login Page
Victim enters username & password on spoofed site.
STEP 3
Account Stolen
Credentials harvested instantly by attacker.
STEP 4
Auto-Spam
Hijacked account sends scam to all contacts.
Key Vocabulary
Cybersecurity Terminology
Domain Spoofing
Creating fake web addresses that look almost identical to real ones (e.g. rnicrosof.com vs microsoft.com).
Malware & Payloads
Malicious software downloaded hidden inside fake game mods or attachments to spy on typing or lock files.
URL Inspection
Comparing Web Addresses
🚨 Fake Phishing URL
http://login.account-security-update-roblox.com/check
Red Flags: Uses HTTP (unencrypted), actual root domain is account-security-update-roblox.com, not roblox.com!
✅ Genuine Official URL
https://www.roblox.com/login
Safe Signs: Uses HTTPS (encrypted padlock), official domain name is directly before the .com/ extension.
Smartboard Voting
Scenario 1: Real email or Phishing?
Sender: support@security-google-verify.net
Subject: 🚨 CRITICAL: Your Google Account has been hacked! Click to verify immediately!
Cast your vote: Raise your hand — Is this REAL or PHISHING? Identify the 3 red flags in 15 seconds.
Smartboard Voting
Scenario 2: Real email or Phishing?
Sender: no-reply@classroom.google.com
Subject: New assignment posted in Computer Science: "Chapter 1 Exercises"
Cast your vote: Is this REAL or PHISHING? Check domain google.com and expected sender behavior.
Core Concept #2
Passwords vs Passphrases
Length beats complexity! Standard passwords like P@ssw0rd! can be cracked in seconds by computer scripts.
Short & Complex (Weak)
Tr0u$8 (6 chars) — Cracked in under 1 second by brute-force programs.
Long Passphrase (Strong)
blue-dolphin-jumps-over-mars! (28 chars) — Takes billions of years for computers to guess!
Layered Security
Two-Factor Authentication (2FA)
2FA requires two separate proofs of identity before granting access to an account.
FACTOR 1
Something You Know
Your password or passphrase.
FACTOR 2
Something You Have
An authenticator app code or physical security key.
RESULT
99.9% Protection
Even if an attacker steals your password, they cannot log in without your 2nd factor!
Myth Buster
Misconception: Incognito Mode
❌ Myth: "Incognito = 100% Invisible"
Students think Incognito mode hides their identity from websites, Wi-Fi routers, schools, and hackers.
✅ Reality: Browser History Only
Incognito only prevents local history from saving on that single computer. School admins, ISPs, and websites STILL see your IP address and traffic!
Scenario Analysis
The Oversharing Dilemma
Lila posts a selfie celebrating her birthday: "Finally 12! Party at Sunshine Park at 4 PM! 🎂" She is wearing her school jersey showing the school logo.
Think-Pair-Share: What sensitive data did Lila reveal without realizing it? (Location, school, birth date, age). How can this be used by bad actors?
Core Concept #3
Your Permanent Digital Footprint
- Metadata: Photos store hidden data (GPS coordinates, camera model, timestamp).
- Internet Archives: Deleting a post does not mean it is gone — web scrapers and screenshots preserve content forever.
- Data Brokers: Free apps collect and sell browsing habits, location patterns, and app usage data.
Spot The Mistakes
Find 4 Red Flags in this DM
// Discord DM from: Roblox_Admin_Official_99
"Hello player! Your account is flagged for cheating. Send your password and current 2FA code immediately to prove your innocence, or your account will be banned in 30 minutes! Click: http://roblox.mod-admin-check.org"
Class Challenge: Name the 4 red flags (1. DM instead of official ticket, 2. Asking for password/2FA, 3. Artificial 30 min urgency, 4. Unofficial URL domain).
Class Activity
The 5-Second Link Inspection Protocol
CHECK 1
Pause & Breath
Don't react to panic or excitement.
CHECK 2
Inspect Domain
Look at the domain name right before .com or .org.
CHECK 3
Verify Channel
Go directly to official app/site, never via DM link.
CHECK 4
Ask Adult
Show trusted adult if in doubt.
Interactive Quiz · Question 1
Which domain is the REAL official website for Epic Games?
Aepicgames.free-vbucks-claim.com
Bstore.epicgames.com
Clogin-epicgames-support.net
Depicgames.verify-account-now.info
Click to reveal answer
Interactive Quiz · Question 2
Why is Two-Factor Authentication (2FA) far safer than a password alone?
AIt automatically changes your password every hour
BIt makes your internet connection twice as fast
CIt requires a second physical device/code even if password is stolen
DIt deletes all public posts from your digital footprint
Click to reveal answer
Interactive Quiz · Question 3
True or False: Incognito mode stops websites and school Wi-Fi from tracking you.
ATrue — You become 100% anonymous online
BFalse — Incognito only prevents local browser history from saving
Click to reveal answer
Lesson Recap
Summary of Key Takeaways
- Be skeptical of urgency: Scams rely on rush tactics so you skip thinking.
- Check domains carefully: Always inspect the root domain before entering credentials.
- Protect accounts: Use long passphrases and enable 2FA on every account.
- Footprint is forever: Metadata and archives mean what goes online stays online.
Exit Ticket
Before You Leave
On a sticky note or index card, write down:
1. Name one red flag that reveals a phishing email.
2. Give an example of a strong 4-word passphrase.
Next Chapter: Logic Gates Refresher & Transistor Mechanics!