Account takeover (grades 9-12)

What's inside

• Lesson plan: objectives, 5-part sequence with teacher scripts, discussion questions, exit ticket, differentiation (PDF + Word)
• Worksheet 1: Takeover scenarios
• Worksheet 2: Match the term
• Teacher answer key for every worksheet, card and the exit ticket
• 10 cut-apart scenario cards
• 9-slide outline with speaker notes (PDF + editable PowerPoint)
• Family take-home sheet in English and Spanish (PDF + Word)

Learners will be able to

• Explain in plain words how password reuse, credential stuffing, phishing kits, one-time-code social engineering and SIM swaps lead to account takeover
• Rank MFA options from strongest to weakest (passkeys and security keys, authenticator apps with number matching, app codes, text or email codes) and explain the tradeoff of each
• Build a step-by-step recovery plan for a hijacked account that secures email first, uses only official recovery routes and warns contacts
• Create a personal prevention plan: unique passphrases or a password manager, the strongest MFA available and saved recovery codes

Standards alignment

• ISTE Standards for Students 1.2.d
• ISTE Standards for Students 1.2.a
• CSTA PK-12 Computer Science Standards (2026) HS-SYS-SE-31
• CSTA PK-12 Computer Science Standards (2026) HS-SYS-SE-32
• CSTA PK-12 Computer Science Standards (2026) HS-SYS-SE-33
• CSTA K-12 Computer Science Standards (2017) 3A-NI-06
• CSTA K-12 Computer Science Standards (2017) 3A-NI-07

More pages

Files

Supports these rubric areas

• Awareness & Training
• Identity Management, Authentication, and Access Control
• NIST CSF PR.AT
• NIST CSF PR.AA

Part of

• Middle and high school (6-12) classroom kit
• Grades 9-12

Related materials

Cyber Academy course · Students, Teachers

Protect your accounts, your money and your future

Lock down your accounts against takeover, recognize the job, scholarship and registration scams aimed at teens, know exactly what to do if someone threatens to share images of you, verify AI fakes and clean up your digital footprint before applications.

• 18-minute course
• Grades 9-12
• English
• Online course (sign in)

Classroom lesson · Teachers, Students

Real or fake?

Students learn how AI-made audio, video, images and polished scam messages are used in fake emergencies, fake job and scholarship offers and online rumors, practice lateral reading and verification by a known route, sort real-world style messages into Verify first, Red flag scam or Likely legitimate, and write a personal verification routine. The lesson also covers responsible behavior with AI media of real people and, briefly and carefully, where to get help if someone threatens to share an image.

• 50-minute lesson
• Grades 9-12
• English · Español
• DOCX, PDF, PPTX

Flash-n-Flush one-pager · Students

Your code is your key. Don't hand it over.

October student edition for students in grades 6-12. Most account takeovers don't take hacking skills.

• 90-second read
• Grades 6-12
• English · Español
• PDF

Flash-n-Flush one-pager · All staff

Didn't sign in? Don't tap Approve.

October staff edition for all school staff. Your sign-in code or approval prompt is the lock on your account.

• 90-second read
• English
• PDF

Sources

• FTC — Use Two-Factor Authentication To Protect Your Accounts (breached credentials, reuse, SIM swap risk to text codes, security keys)
• FTC — SIM Swap Scams: How to Protect Yourself
• FTC — What's a verification code and why would someone ask me for it?
• FTC — How To Recover Your Hacked Email or Social Media Account
• CISA — Require Multifactor Authentication (MFA methods ranked from most to least secure)
• CISA — Next Level MFA: FIDO Authentication
• CISA Secure Our World — Use Strong Passwords (16+ characters, passphrases, password managers)
• FIDO Alliance — Passkeys
• CSTA — 2026 PK-12 Computer Science Standards
• ISTE Standards for Students