S1-S6 Information Technology: impersonation and AI-assisted scams — four signals and three steps

• StageS1-S6
• SubjectInformation Technology
• Learning strandreflection on the application of AI
• Official documentsBlueprint for Digital Education Development in Primary and Secondary Schools · AI Literacy Learning Framework for Primary and Secondary Schools · Guide to Using AI in Teaching in Primary and Secondary Schools · EDBCM No. 156/2026
• Time to prepareOne 60-minute lesson; about 10 minutes to print beforehand

Someone claims to be somebody and asks you for something — that request is the thing to judge, not the picture. Four signals tell you to stop; three steps tell you what to do next: stop, reach the person by another route, and hand it to an adult with a record. Includes two fictional situations, a one-page four-column card and a 60-minute lesson.

• AudienceTeachers Students
• ThemeResponsible AI use

• Equipmentthe four-signals and three-step worksheet (one per pupil); a one-page four-column record card (copied as needed); a projector or a whiteboard
• Version1.0
• Last updated2026-11-10

A scam rarely begins with a suspicious picture. It begins with a request that sounds perfectly normal: this is who I am, and here is what I need you to do. The request is what has to be judged.

What this solves

When pupils meet this, the difficulty is rarely that they have never heard of scams. It is that nothing tells them at which moment to stop. The name is familiar, the tone is familiar, the reason is ordinary, and the request is small — send a sum of money, read out a code you have just received, install something. By the time it feels wrong, it has been done.

This page is about exactly that situation: someone claims to be a particular person and asks you for something. It does not cover recognising deepfake images (another resource does), and it does not restate the four-level handling of personal data (another resource does). It offers one thing that is usable in the moment, and that does not require the pupil to play along with the other party.

The four signals are questions to ask, not labels; the three steps are actions, not an argument. Any one signal means stop and work the steps. No signal at all is not proof of safety — the steps still apply. Both points must appear on the page and on the worksheet.

Three things to read first:

1. The names “four signals”, “three steps” and “record card” are this resource’s suggestion; the Education Bureau’s documents do not use them. They rest on three things those documents do require: critical thinking, cross-checking from more than one direction, and cyber safety. No document prescribes a number of signals, an order of steps or the columns on a card.
2. This page is not legal advice and does not replace the school’s information-security or incident procedures. Whether to report to the police, when to tell a parent, and which member of staff coordinates all follow the school’s existing arrangements; the page sets out only what a pupil can do in the moment.
3. The Primary Information and Technology Curriculum Framework is a primary pilot. This page is for S1-S6; the secondary years use the same vocabulary, but no equivalent official framework exists for them, so nothing here is presented as a secondary requirement and none of its items are quoted.

The page describes technical capabilities only — no causes, no figures. What can be said is that a voice can be synthesised, a displayed number can be disguised, an account can be impersonated and a picture can be altered. These are things the technology can do. This page does not claim that AI has increased the number of scam cases, and quotes no case figures: a claim of that kind needs a checkable source, and this page has none.

Learning objectives

By the end, pupils can:

1. Say what each of the four signals is asking, and that any one of them means stop.
2. Explain that no signal at all does not mean safety, and that the three steps still apply.
3. Describe, in order, what each of the three steps does and does not involve: stop, reach the person by another route, hand it to an adult with a record.
4. Explain that the “other route” must use a number or an in-person route they already had — never a number or link supplied by the other party.
5. Fill in the four columns of the record card for a fictional situation and say who it was handed to.

The page addresses reflection on the application of AI, one of the three learning strands, and sits between cyber safety and protecting privacy. Three values are practised: critical thinking means not treating “it sounds like them” as “it is them”; responsibility means letting an adult know rather than handling it alone; using technology at the right time means not verifying everything in ordinary conversation, but always stopping at the moment somebody asks you for something.

Teaching steps

One 60-minute lesson. There are four signals and no more, three steps and no more, and four columns on the card; nothing is added or removed and no sub-items are created. The order of the steps is fixed.

The four signals (fixed at four)

The four signals are questions. Ask each one; if any answer is yes, stop.

Two points to make explicitly:

• Any one signal means stop and work the three steps. There is no need to collect all four, and no need to decide which one is “most serious”.
• None of the four appearing is not proof of safety. The three steps still apply. The signals prompt you to stop; they do not certify anything.

The three steps (fixed at three, in this order)

Three things to spell out:

• Step one is about not acting, not about doing something. Stopping means the conversation ends there: no follow-up question, no reply, no pressing any button. Engaging only lengthens the contact and can lead to being steered into the next thing.
• The “other route” must be one you already had. The school’s published number, walking to the staff room, or a number already saved in your phone. A number, link or “call this instead” supplied by the other party is never used.
• The screenshot in step three is a record only. It is not forwarded, not posted in a group, not shown to classmates; personal data in a screenshot must be covered, including your own and anyone else’s name, face, phone number, account number and class.

The one-page four-column card (fixed at four)

One page, four columns, for the pupil to record. A record only: not marked, not ranked, and never a conduct record. Whether it is collected at all is the teacher’s decision — a class may keep it as discussion material instead.

Two fictional situations

Both are entirely fictional: no real school, person, phone number, account number, link or payment code appears, and there is no usable sample material. The examples on this page and in the worksheet exist only to show the format.

Situation 1: a voice that sounds like a parent, asking for a transfer. A pupil receives a voice message that sounds very like an older relative, saying there is an emergency away from home, asking for money to be sent first, and adding “do not tell anyone else”. Four signals: pressure (immediately, tell nobody), what is asked for (money), does it add up (the background and the time do not match), where it came from (the number is not the one normally used). Three steps: stop (no reply, no transfer); take another route (use the number already saved, or ask a family member in person); hand it to an adult with a record (screenshot not forwarded, given to a parent or teacher).

Situation 2: a payment code from a classmate’s account. A pupil receives a message from an account that looks like a classmate’s, saying “take this payment for me, just scan the code”, with a payment code attached. Four signals: what is asked for (money, a scan), pressure (“now”), does it add up (the tone is not how that classmate writes), where it came from (the account may be impersonated). Three steps: stop (no scan, no receiving money on someone’s behalf); take another route (find that classmate in person or on the number already saved); hand it to an adult with a record (cover the personal data, then give it to a teacher).

Both situations end with the same question: “which step did you stop at?” The answer is not “was I taken in”; it is “how far did I get”.

Three points of teacher control

1. No scripts, and no asking pupils to engage the other party. Nothing in the lesson rehearses “how to draw them out” or “how to stall them”, and no reply is drafted. Step one is not replying.
2. No organisation name, hotline number or police reporting number is written anywhere. None appears on this page or in the worksheet, because no such number can be checked on this machine. Whether to report, and who decides, follows the school’s guidance.
3. Money or personal data goes to the school at once. If a pupil raises a real case in class, the teacher records only that it has been handed to the school, does not ask for details in front of the class, and does not require anyone to share a conversation.

Three closing sentences (read together)

1. “I stop first.”
2. “I take another route and reach the person themselves.”
3. “I hand it to an adult, and I write it down.”

Where this joins other resources

Interfaces only — neither is redone here:

• The deepfake response game covers recognising and responding to deepfake images, with gamified practice. This page covers “someone claims to be somebody and makes a request”; it does not redo image recognition and teaches no detection tool.
• The personal-data scenarios pack covers personal data itself and sets out a four-level ladder. This page borrows only the vocabulary of that ladder (the same four levels, from can keep to no AI at all); it does not restate the levels or change its columns.

Answer key and marking notes

One completed four-column card (fictional example, to show the format)

Reasonable answers for the two situations

Four marking and feedback points:

• Order. Are the three steps written as stop, take another route, hand it to an adult with a record? Skipping step one and going straight to “contact the person” means the pupil is still acting inside the original channel.
• Was the other route one the pupil already had? A saved number or an in-person route, or something the other party supplied. This is the most important column in the lesson.
• Any engagement at all. The card should not contain “I talked to them”, “I tested them” or “I kept them going”. Any of those means step one was not taken.
• Who it went to. Column 4 is a category, not a name; “handed it in” with no category is unfinished.

What counts as finished: all four columns filled in (column 2 may hold more than one signal), and step three naming the category of person it was given to. The card is a record: not marked, not ranked, never a conduct record, and whether it is collected is the teacher’s decision. Both statements belong on the page and on the card.

Files

Impersonation and AI-assisted scams: four signals and three steps (editable Word document)

Six sections, each usable on its own: the five header facts, the four signals (one page), the three steps (one page, including a “what not to do” column), the two fictional situations with the four-column card example (one page), a 60-minute lesson with the three points of teacher control (one page), and a review checklist (one page). Every situation is fictional, with no real number, account, link or payment code.

Impersonation and AI-assisted scams: one-page four-column record card (editable Word document, copied as needed)

One side: four columns and a blank row. The card states that it is a record only — not marked, not ranked, never a conduct record — and that whether it is collected is the teacher’s decision. A line at the foot reminds the reader that a screenshot is a record only and must have personal data covered, their own and anyone else’s.

Each file carries a version record in its footer.

Official documents

Every resource in this library is written to the AI Literacy Learning Framework for Primary and Secondary Schools and falls within the policy scope of the Blueprint for Digital Education Development in Primary and Secondary Schools.

This resource maps to:

• Blueprint for Digital Education Development in Primary and Secondary Schools (three-fold leaflet, p.2): requires digital and AI education to be planned in the School Development Plan and the arrangements explained to teachers, pupils and parents; reducing “what to do when a request looks wrong” to three steps is part of explaining those arrangements.
• AI Literacy Learning Framework for Primary and Secondary Schools (p.1-4): sets out the three learning strands; this resource addresses reflection on the application of AI, within cyber safety and protecting privacy.
• Guide to Using AI in Teaching in Primary and Secondary Schools (p.2-4): asks teachers to exercise professional judgement and to guide pupils towards critical thinking, compliance with the law and safety; the teacher chooses which situations to use and how far to take them.
• EDBCM No. 156/2026 (Supplement I, section 4): critical thinking, cross-checking, and cyber safety; the four signals, the three steps and the four-column card are one school-level way of meeting all three, but the names, the counts and the sequence are this resource’s suggestion.

Learning strand: reflection on the application of AI

A note on curriculum wording: the Primary Information and Technology Curriculum Framework is a primary pilot. This page is for S1-S6; the secondary years use the same vocabulary, but no equivalent official framework exists for them, so nothing here is presented as a secondary requirement and none of its items are quoted.

Official documents page: https://www.edb.gov.hk/en/edu-system/primary-secondary/applicable-to-primary-secondary/it-in-edu/debp.html

This page is an independent Beets teaching resource, not an official EDB document. The names “four signals”, “three steps” and “record card”, together with the signals, the order of the steps and the columns, are this resource’s suggestion and not an Education Bureau requirement. This page is not legal advice and does not replace the school’s information-security or incident procedures; whether to report and when to tell a parent follow the school’s existing arrangements. Both situations on the page and in the attachments are fictional: no real or usable phone number, account number, link, payment code or QR code appears, and no tool or procedure for synthesising a voice, swapping a face or altering a picture is described. The page states technical capabilities only and makes no causal or numerical claim about AI increasing scam cases.

Feedback

If you have any comments or questions about this resource, or an idea for the next one, tell us on the feedback page.