Courses Phishing Phishing Forensics

Phishing Forensics: Investigate and Report Like a Pro

Go beyond recognition and verification. Learn the TRACE framework — Take a snapshot, Reveal the real, Authenticate the sender, Check the landing, Escalate. Designed for non-technical people who want to contribute evidence, not just avoid attacks.

Investigate and Report Like a Pro — Without the Tech Background.

Go beyond recognition and verification. Learn the TRACE framework — Take a snapshot, Reveal the real, Authenticate the sender, Check the landing, Escalate. Designed for non-technical people who want to contribute evidence, not just avoid attacks.

This advanced course builds on the foundations from Spot the Scam and Security Champion and takes you into the world of phishing investigation — from preserving evidence to reading email headers to writing reports that actually help security teams stop campaigns.

"You can't always spot a fake. But you can always preserve the evidence, read what a message actually carries, and report it in a way that protects thousands of other people."

What You'll Learn

  • Take a snapshot — preserve suspicious messages without destroying the evidence most people delete
  • Reveal the real — find the "View Original" button every email client hides, and the three lines that matter
  • Authenticate the sender — SPF/DKIM/DMARC as one question: pass, fail, or missing?
  • Check the landing — safely investigate where a link really goes (homograph attacks, redirects, sandboxes) without clicking
  • Escalate — report in a way that actually helps IT, APWG, brands, and law enforcement stop the campaign
TRACE Field Guide

5 steps, 3 header lines, one reporting decision tree.

View Field Guide
TRACE Sandbox — A Day in the SOC

Practice the full framework on a six-message simulated shift. Per-letter scorecard at the end.

Start your shift

Course Curriculum

1

The Forensic Mindset

35 min 3 lessons + quiz
Why Investigate at All? 10 min What You Can't See vs. What You Can 10 min Introducing TRACE 10 min Module 1 Quiz 5 min
2

Take a Snapshot (T)

35 min 3 lessons + quiz
The Delete Mistake 10 min Screenshots Done Right 10 min Forward-as-Attachment 12 min Module 2 Quiz 5 min
3

Reveal the Real Sender (R + A)

50 min 4 lessons + quiz
"View Original" — The Button Nobody Uses 12 min Three Lines Worth Reading 15 min Did It Actually Come From Them? 12 min When Authentication Lies 10 min Module 3 Quiz 5 min
4

Check the Landing (C)

40 min 3 lessons + quiz
Hover, Copy, Never Click 10 min Where Does This Link Really Go? 15 min Let a Robot Click for You 12 min Module 4 Quiz 5 min
5

Escalate (E)

35 min 3 lessons + quiz
Who to Tell 10 min Writing a Report That Helps 12 min The Ripple 10 min Module 5 Quiz 5 min

Final Assessment

10 min Certificate upon passing
Final Assessment 10 min Certificate & Completion 5 min

Who Is This Course For?

Security Champions

Completed the previous courses and want to contribute evidence, not just avoid attacks.

Team Leads & Managers

Receive phishing reports from their teams and want to respond with the right next step.

The Curious

Anyone curious about what actually happens after you hit "Report" — and how to make that report matter.

Ready to Investigate Like a Pro?

Learn the TRACE framework and go from someone who reports phishing to someone who helps stop campaigns. About 4 hours of self-paced learning.

Begin Module 1