Skip to content
Utah Community Learning

Materials & extras

Downloads

Handouts, flashcards, and note cards from your instructor. Print any of them.

  • HandoutHandout 1: Supply & Shopping List

    Handout 1: Supply & Shopping List ### Online Safety and Scam Prevention

    You don't need much for this class. Most of what we're doing is habits, not hardware. But a few things make the hands-on parts go smoother, so here's what to bring and what's worth buying. Budget tier gets you everything you need. Nice-to-have tier makes it easier, that's all.

    ---

    Bring to Class (Budget Tier — mostly free)

    • Your phone or laptop, charged. We're setting up a password manager and 2FA in the room. If your battery's at 12 percent we're going to have a problem halfway through.
    • Your Apple ID or Google account password, or at least know how to reset it. If you don't know it and can't reset it that day, we can still work, but you'll want to do the setup at home after.
    • A notebook or a note in your phone. Old-fashioned, I know. I still keep one. Some of what we cover you'll want to jot down, especially the checklist for spotting a scam text.
    • A list of your top 5 accounts you'd be devastated to lose. Email, bank, whatever. We're going to set up 2FA on these first. Doesn't need to be fancy, just written down.

    That's genuinely enough. Fair is fair, I'm not going to make you buy something to learn "hang up and call the number on the back of your card."

    ---

    Nice to Have (if you want to spend a little)

    • A password manager subscription. There are free versions that work fine for this class. If you want the paid tier later for family sharing, expect somewhere in the $30-60/year range. We'll set up the free version together, no pressure to upgrade.
    • A cheap USB drive for backup codes if you're the type who likes a physical copy instead of trusting the cloud. Any big-box store, Costco included, sells a 3-pack for less than a movie ticket.
    • A printed copy of your bank and credit card customer service numbers, taped somewhere near your computer, not saved in an email a scammer could also access if things go sideways. Sounds paranoid. Isn't.

    ---

    Skip These (don't waste your money)

    • A new antivirus subscription. Yours is probably fine already, or your operating system's built-in version is enough. Your habits matter more than your software. I'll explain why in Lesson 3.
    • Any "identity protection" service that cold-called or emailed you to sign up. If it found you instead of the other way around, that's worth being suspicious of on principle.

    ---

    Local-ish Notes

    Nothing on this list requires a special trip. If you're already doing a Costco or Macey's run this week, a cheap USB drive will be sitting near the office supplies or electronics endcap. Otherwise everything here is either already on your phone or free to download.

    If you're coming up from the south end of the valley or crossing the point of the mountain to get to class, leave a few extra minutes. Traffic doesn't care that we start on time. I do, so please try.

    One last thing: if you're not sure whether something on this list applies to your situation, bring the question to class instead of guessing at home. That's what the class is for.

    ~kenneth

  • HandoutHandout 2: Cheat Sheet for Online Safety

    Handout 2: Cheat Sheet for Online Safety

    Print this. Tape it by the computer. That's what my dad's got taped by his, and it's saved him three times that I know of.

    This isn't everything from class. It's the stuff you need when you don't have time to think it through, which is exactly the moment scammers are counting on.

    ---

    The Slow-Down Rule

    If a message makes you feel rushed, that's the tell. Real problems can wait five minutes. Scams can't, because urgency is the whole trick.

    Before you click, tap, or call back, ask: - Is this trying to scare me or hurry me? - Am I being told to keep this a secret from family? - Does this want money, a gift card, or my login, right now?

    Two or more yeses. Stop. Hang up. Close it.

    ---

    Checking a Link Without Clicking It

    Hover your mouse over the link (don't click) and look at the address that pops up at the bottom of the screen. On a phone, press and hold instead of tapping.

    Look for: - Misspelled company names (arnazon, not amazon) - Extra words jammed in (amazon-secure-verify.com) - A string of letters and numbers that doesn't look like a real business at all

    If it doesn't match the real site exactly, it's fake. Fair is fair, they're getting good at close.

    ---

    Passwords

    Sooo, here's the part people argue with me about. A password you can remember is already too weak. Use a password manager. It generates and stores long random passwords so you only remember one master password.

    Setup, roughly: 1. Pick one (I'm not going to name a specific product here, ask me in class) 2. Set one strong master password, write it down somewhere physical, not on the computer 3. Let it fill in your logins going forward 4. Change your worst repeated password first, today, not "eventually"

    Two-Factor Authentication (2FA)

    Turn this on for email and banking, minimum. It means a code gets sent to your phone when you log in somewhere new.

    Do this before anything else: save your backup codes. When you set up 2FA, it'll offer you a set of backup codes. Write them down and put them somewhere you'll actually find them. I locked myself out of my own email for an hour because I skipped this step. Learn from me instead of the hard way.

    Text-message codes are fine. Don't let anyone talk you out of using 2FA just because it's not the fanciest version. Something you'll actually use beats something perfect that you turn off.

    ---

    Phrases That Mean Hang Up

    • "We need you to move your money to protect it."
    • "Pay with gift cards" (no real agency ever asks this, none)
    • "Don't tell your family about this"
    • "This call is being recorded for your protection" (from someone claiming to be the IRS or Social Security)

    Your bank will never call and ask you to transfer money to "keep it safe." Full stop. If you're worried, hang up and call the number on the back of your card yourself.

    ---

    The "Unsubscribe" Trap

    If you don't recognize the sender, don't click unsubscribe. It just confirms your email address is real and active, and you'll get more, not less. Delete it or mark it as spam instead.

    ---

    One-Line Version, For The Fridge

    Slow down. Check the address. Use a password manager. Save your backup codes. Hang up and call back yourself.

    That's most of it. The rest is just practice.

    ~kenneth

  • WorksheetHandout 3: Scam Checkpoint — Fill This Out As We Go

    Handout 3: Scam Checkpoint — Fill This Out As We Go

    Sooo this one's yours to keep. Tape it by your computer, stick it in a drawer, whatever. When something feels off, pull it out and run through it before you do anything else.

    ---

    Part 1: The Five Questions (ask every time)

    Fill in your own words as we go through examples in class.

    1. Am I being rushed? What did the message say that made it feel urgent? _______________________ (If you can't answer this, that's good. If you can, that's the tell.)

    2. Does the contact info match? Hover over the link (don't click). Where does it actually go? _______________________ Is the phone number the one printed on your card or bill? Y / N

    3. Would this organization actually ask for this? Banks don't call asking you to move money "to keep it safe." Full stop. Write one thing your bank has told you they will never ask for: _______________________

    4. Am I being asked to feel something before I'm asked to do something? Fear, love, guilt, a great deal. Name the emotion the message is using: _______________________

    5. Have I checked with a real person yet? Who's your second opinion? Write a name here now, while you're calm: _______________________

    ---

    Part 2: Your Household Contacts List

    Fill this in during class. This is the sheet you actually use during a scare, not a nice idea you never finish.

    If this happens...Call this number/personNot this
    Bank calls about "suspicious activity"Number on back of cardNumber they gave you
    "Microsoft" says your computer has a virusHang up. Call: _________Never let them remote in
    Text about a package or parking ticketCheck the app/site directlyDon't click the link
    Anything that scares you and you're alone_________ (a family member)—

    ---

    Part 3: Two-Minute Password Manager Check

    We set this up in class. Confirm before you leave:

    • [ ] I have a password manager installed
    • [ ] I've changed at least one weak or reused password
    • [ ] I wrote my master password down somewhere that is NOT taped to the monitor
    • [ ] I know how to look up a password when I need it

    If any of these are unchecked, find me before you go. We're not leaving until yours works.

    ---

    Part 4: Two-Factor Backup Codes

    Do this part now, in class, not later at home. I locked myself out of my own email for an hour doing this wrong. Backup codes first.

    • [ ] Two-factor is turned on for my email
    • [ ] I have written down my backup codes
    • [ ] I know where those backup codes are (not just "on my phone")

    ---

    Part 5: One Thing You're Taking Home

    Write one message, call, or email you're going to double-check when you get home tonight, before you touch it again.

    _______________________________________________

    ---

    That's it. Nothing fancy. Slow down, check the number, ask somebody. Fair is fair — most of the scams in this class only work if you skip a step, and now you've got the steps written down.

    ~kenneth

  • HandoutHandout 4: Troubleshooting Guide — Common Beginner Problems

    Handout 4: Troubleshooting Guide — Common Beginner Problems

    You're going to hit snags. Everybody does. Here's the list of what actually trips people up in this class, and what to do about it. Fair is fair, most of these happened to someone I know.

    ---

    1. "I can't tell if a link is safe." Don't click it to find out. Hover your mouse over it (or press and hold on a phone) and look at the actual address that pops up. If it says something like "amaz0n-security.net" instead of amazon.com, that's your answer. When in doubt, don't click, type the website address in yourself.

    2. "The password manager wants me to make a master password and I can't think of one." Use a short sentence with a couple of words swapped out, something like a phrase you'd actually remember. Length matters more than weirdness. Write this one down somewhere physical and safe, because it's the one password you can't afford to lose. This is the only password you should ever write down.

    3. "I forgot my two-factor codes and I'm locked out." This happened to me. Save your backup codes before you need them, not after. When you set up two-factor, it'll offer you a list of one-time backup codes. Print them or write them down and put them somewhere you'll actually find later, not a sticky note on the monitor.

    4. "I clicked unsubscribe and now I get more spam, not less." If the email was already spam, clicking unsubscribe just tells them your address is real and somebody's home. My dad did this three times before it stuck. For real spam, don't unsubscribe. Mark it as spam/junk in your email and let the filter learn.

    5. "Someone called claiming to be my bank and said my money isn't safe." Hang up. Every time. Your bank will never ask you to move money to "protect" it. Call the number on the back of your card yourself and ask if anything's wrong. That number is the only one you trust in that moment.

    6. "I already gave out some information before I realized it was a scam." Don't sit on it. Call your bank or card company right away, they can freeze things fast if you catch it quick. Then change that password everywhere you used it. Kylie let a fake "Microsoft" tech onto her computer and we spent an afternoon fixing it. It's fixable. Just don't wait a week to say something.

    7. "I reuse the same password everywhere and I don't want to change them all." I know. My brother Kelly said the same thing. Start with your email, that's the one that resets everything else if a scammer gets it. Then your bank. You don't have to fix all of it today, but fix that one.

    8. "I'm not sure text message codes for two-factor are secure enough." They're not perfect, no. But they're a hundred times better than no two-factor at all. Turn it on now. Worry about upgrading to an app-based code later, if ever. Don't let the "perfect" version talk you out of the "good enough and you'll actually use it" version.

    9. "The email looks like it's from my church or work, so I trusted it." This is low key the most common trick right now, spoofing something familiar. Tiffany caught a fake ward donation email because the tone felt off before anyone noticed the address was wrong. Trust that gut feeling. If something you'd normally trust is suddenly asking for money or login info, verify it a second way, a phone call, a text to someone you know is real.

    10. "I feel dumb that I almost fell for one." Don't. I almost paid a fake parking ticket once, right up to the payment page. The people who get caught aren't foolish, they're busy or tired or having a bad day, same as the rest of us. That bothered me for a while, that it could've been me. It's why I tell that story on purpose. Nobody in this room gets to feel superior about it, me included.

    ---

    If you hit something not on this list, bring it in. That's what the notebook's for.

    ~kenneth

  • podcast_scriptClass podcast — episode 1

    Audio coming soon — show notes below.

    JESS: —so I said, Kenneth, you can't just tell people "hang up" as the whole lesson plan, we need at least an hour of content.

    KENNETH: It's most of the lesson plan, though. Hang up, check the number, don't click. That covers a lot of it.

    JESS: Okay, fair, but stay with me for the podcast anyway. This is episode one of the class podcast, Online Safety and Scam Prevention, I'm Jess, I run the podcast side of things for Community Learning, and this is Kenneth, who teaches the class Tuesday nights at the rec center.

    KENNETH: Handle it once, in a room. That was the whole idea.

    JESS: Tell people how you ended up doing this. Because you didn't set out to be the scam guy.

    KENNETH: No. It started because I'm home during the day, so I was the one who picked up when the "IRS" called my mother.

    JESS: Wait, an actual call, to your mom's house.

    KENNETH: Yeah. I listened to the whole script. Guy was good, honestly. Urgent tone, said there was a warrant out, said she needed to settle it right then with gift cards.

    JESS: Gift cards. Every time it's gift cards.

    KENNETH: Every time. I hung up, drove over, and it turned out she'd already gotten as far as opening her purse. Hadn't given them anything yet, but she was close.

    JESS: That's — I mean that's the whole class right there.

    KENNETH: That bothered me for weeks. Not that she almost fell for it. That it was that close and I only caught it because I happened to be the one who answered the phone.

    JESS: So now you check her call log when you visit.

    KENNETH: I do. I don't tell her that part.

    JESS: [laughs] Okay, this is going in the podcast, sorry.

    KENNETH: Fair is fair, it's a good story.

    JESS: So give people one thing. Somebody's listening to this in their car, they're not taking the class, what's the one move.

    KENNETH: Sooo, here's the one that covers the most ground. If a message or a call makes you feel rushed, that's the tell. Doesn't matter what it's about. Bank, IRS, grandkid in jail, package stuck at the border. Real problems can wait five minutes for you to verify. Scams can't, because if you slow down, you win.

    JESS: Slow down and you win.

    KENNETH: That's the whole class in six words, if you want to leave now.

    JESS: I'm not leaving now. Tell them what the actual class covers, because I know it's more than "hang up."

    KENNETH: It is. We do passwords, we do two-factor, we do the ones that come by text pretending to be a delivery notice, we do the romance ones, which nobody wants to talk about but I make us talk about it. And we set things up in the room. You're not leaving my class without your password manager actually working. I walk the rows.

    JESS: You do walk the rows. I've seen it.

    KENNETH: If you skip the practice step, I notice.

    JESS: He notices. Okay, so next session, what are we covering, because I want people to come back.

    KENNETH: Next time is passwords and two-factor, start to finish. I know it sounds dry. It's the one people resist the most and then thank me for later, though I'd rather they just did it than thanked me.

    JESS: He hates being thanked. It's a whole thing.

    KENNETH: It's nothing. It's a text code and twenty minutes.

    JESS: See, right there.

    KENNETH: What.

    JESS: Nothing, nothing. Okay — anything people can do between now and then, without waiting for the class?

    KENNETH: One thing. Go look up whether your email's ever been in a breach. There's a site for it, I'll put the name in the show notes so I don't butcher it out loud. Type in your email, it tells you which sites lost your password. If yours shows up, and it probably will, go change that password, and don't reuse it anywhere else.

    JESS: That's a fifteen-minute homework assignment nobody assigned you.

    KENNETH: My brother Kelly's in there. Showed him his own password on the breach list, sitting right next to his name. He changed one account.

    JESS: One.

    KENNETH: One out of probably twenty. Fair is fair, it's progress.

    JESS: I love that for Kelly.

    KENNETH: Kelly doesn't love it, but he's not wrong to be annoyed with me either.

    JESS: Okay. So next episode we'll have Kenneth back talking passwords and two-factor, and honestly if you only do the homework from today's episode, check your email on that breach site, that alone is worth ten minutes of your evening.

    KENNETH: And if the code doesn't come through on your phone when you set up two-factor, don't panic and don't call me at eleven at night. I did that to myself once and I'll tell that story next time.

    JESS: Ooh, teaser.

    KENNETH: It's not a very good story. I just locked myself out of my own email for an hour.

    JESS: Perfect, see you next time.

    KENNETH: ~kenneth. Sorry, that doesn't work out loud.

    JESS: It's fine, we'll put it in the notes.

  • podcast_scriptClass podcast — episode 2

    Audio coming soon — show notes below.

    JESS: —okay but that's the part people don't believe, that it wasn't some obviously fake email with bad spelling. It looked normal.

    KENNETH: Right, that's the whole problem. People are still picturing scams from ten years ago. Bad grammar, weird formatting, a prince who needs your bank account. Sooo that stuff still exists, but the ones that actually get people now look clean. Look official. That's what makes them work.

    JESS: For anyone just joining us, this is episode two of the podcast that goes with Kenneth's class, Online Safety and Scam Prevention. If you missed episode one, go back, it's short. This week we're talking about the emotional side of it, which surprised me honestly, I figured this whole class was going to be about passwords.

    KENNETH: Passwords are in there. But if I only taught the technical stuff I'd be missing most of what actually gets people. I want to tell one from class today. It's not a funny one, so bear with me.

    JESS: Go ahead.

    KENNETH: There was a widow in our ward. Sweet lady, kept to herself a little more since her husband passed. She started talking to someone online, one of these accounts, seemed like a real person, military guy stationed overseas, real charming, wrote her every day. Went on for about a month before her family noticed something was off.

    JESS: A month.

    KENNETH: A month. And by the time they caught it, it wasn't about money yet, not really, it was more that she'd started organizing her whole day around this person. Waiting for messages. That bothered me. Still does.

    JESS: What do you do with that? In class, I mean. You can't exactly teach someone to spot loneliness.

    KENNETH: No, but I can tell people what to watch for. If someone you've never met in person is moving fast emotionally, telling you they love you within a couple weeks, that's not romance, that's a script. And I tell the class, if you notice your parent or your neighbor lighting up over someone new online that nobody's met, ask about it. Gently. Don't wait a month.

    JESS: That's the tip, then. Notice, and ask early.

    KENNETH: That's one of them. Here's the other one, and this is the one anybody listening right now can use today, don't even need to take the class. If a message makes you feel like you have to act right now, that's the tell. Doesn't matter what it's about, a bank alert, a package, a grandkid in trouble. Scams run on urgency. Slow down and you win. Hang up, close the email, call the person back on a number you already have, not one they gave you.

    JESS: Five minutes late instead of one click wrong.

    KENNETH: That's the one.

    JESS: I like that you keep saying that.

    KENNETH: Because it's true every time. Fair is fair, most of what we cover is just that idea wearing a different hat.

    JESS: Okay, before we wrap, I want people to know what's coming next session, because I think it's the one everyone actually needs.

    KENNETH: Passwords. We're doing password managers, live, in the room. Everybody sets one up on their own phone or laptop while I walk the rows. We're not leaving until yours works.

    JESS: You say that like a threat.

    KENNETH: It's not a threat. It's a schedule.

    JESS: Fair enough. Anything people should bring?

    KENNETH: Just your phone, and whatever your current password situation is, even if it's embarrassing. Especially if it's embarrassing. I've heard worse than yours, whatever it is.

    JESS: Kenneth's brother reuses one password for everything.

    KENNETH: Kelly knows who he is. He's welcome to come defend himself.

    JESS: Alright. That's episode two. Go check your junk folder for something you almost clicked today, just to see it with new eyes.

    KENNETH: And don't click unsubscribe on spam. That's next episode's other favorite topic, we'll get into why.

    JESS: See everyone next session.

    KENNETH: ~kenneth

  • podcast_scriptClass podcast — episode 3

    Audio coming soon — show notes below.

    KENNETH: ...and by the time she got to the payment page, I'd already typed my card number in. That's the part people don't expect.

    JESS: Wait, we're jumping in mid-story. This is you, right? Not Kylie, not your dad. You.

    KENNETH: Me. Fake parking ticket text. "Unpaid fine, pay now to avoid penalty." I was in a hurry, I clicked it, I got all the way to the payment screen before I looked at the actual web address up top.

    JESS: And it didn't match.

    KENNETH: Didn't match at all. Some string of letters, nothing to do with any city or county. I closed it right there. But I want people to know I got that far. Because I hear from folks all the time who feel dumb for almost falling for something, and I tell them, look, I teach this class and I almost paid a stranger forty dollars over a text.

    JESS: I love that you tell that one on purpose.

    KENNETH: On purpose, yeah. Nobody learns anything sitting in a room feeling stupid. They just stop listening.

    JESS: Okay, so today's episode, we're talking about the two-factor stuff. Backup codes specifically.

    KENNETH: Right, and I teach this one first now, before anything else, because of my own mistake with it. I set up two-factor on my email on a Saturday, felt real proud of myself, real secure. Then I got a new phone a few weeks later and lost my codes in the process. Locked myself out of my own email for an hour.

    JESS: An hour.

    KENNETH: An hour. On a Saturday, of course, when nobody's picking up a support line. That bothered me. Not because it was some huge disaster, it wasn't, but because I'd done the responsible thing and then hadn't finished the job.

    JESS: So now backup codes come first in class.

    KENNETH: First thing. Before we even talk about which app to use. You set up two-factor, you get a stack of backup codes, and you put them somewhere that isn't your phone. Write them down. Tape them in a drawer, whatever. If your phone's the only place those codes live, and your phone's the thing that breaks or gets lost, you've locked yourself out same as I did.

    JESS: Okay, that's the tip, right? That's the thing someone listening right now, not even in the class, can go do today.

    KENNETH: Sooo, here's the thing anybody can do this afternoon. Open up whatever email or bank app you use most. Look for two-factor or "two-step verification" in the settings. Turn it on if it's not on. And whatever you do, when it offers you backup codes, don't skip that screen. Save them somewhere physical.

    JESS: Even text message two-factor? I know some of the security people online say text is weak.

    KENNETH: They're right that it's weak compared to some fancier app. They're also missing the point. Text two-factor is a hundred times better than no two-factor. It's the one your uncle will actually turn on and actually use. Perfect security that nobody sets up protects nobody. I'd rather you have the okay version turned on than the great version sitting unused because it felt like too much hassle.

    JESS: Fair is fair.

    KENNETH: Fair is fair.

    JESS: Okay, before we wrap, tell people what's coming next session, because I think this next one's a good one.

    KENNETH: Next time we're doing the emotional side of it. Romance scams, fake charity asks, that kind of thing. It's less about hovering over links and more about noticing when somebody's working on your feelings instead of your logic. It's a quieter class. I don't do a lot of jokes in that one.

    JESS: You mentioned once, off mic, there was someone in the ward this happened to.

    KENNETH: I bring that up in class, not really here. It wasn't funny, and I don't want to turn it into a podcast moment. But yeah, that's part of why I don't just teach the technical checklist stuff. Sometimes the tell isn't a bad URL. Sometimes the tell is just, this is moving too fast, and I care about this person more than they've earned yet.

    JESS: Heavy note to end on.

    KENNETH: It's an honest one. Slow down, either way. Whether it's a fake parking ticket or somebody telling you they love you after two weeks of texting, the rush is the tell.

    JESS: Alright. Backup codes today, feelings next session.

    KENNETH: That's the class.

    ~kenneth

Around the web

Sites we keep coming back to. Some picked by your instructor, some shared in class.

Videos worth your time

Hand-picked by your instructor, with notes on what to watch for.

Practice corner

6 quizzes and 2 games. Playable by anyone, no account needed.

Open the practice corner →