How We Build and Test an Internet Safety Lesson Before Anyone Sees It

Every lesson in Internet Safety Essentials begins with something a real person in Lethbridge or the surrounding area has opened on their screen. A learner mentions a text about an undelivered parcel, or an email that claims to be from a bank, and I write it down. Names and numbers are stripped out, but the tone, the pressure and the odd wording stay. Those messages become the raw material for practice, because a made-up example never feels as convincing as one that nearly fooled a neighbour.

I keep these in a plain folder, sorted by the trick they rely on: urgency, a prize, a threat, a request for a code. When the folder shows the same trick several times in a season, that trick earns a place in the next revision. This is slow, unglamorous work, and it is the reason the course speaks about situations our learners actually meet rather than about threats that only exist in headlines.

The hardest decision in building a safety lesson is what not to teach. Internet safety has an endless supply of warnings, and a beginner who hears twenty of them tends to remember none and trust nothing. Gurpreet Sandhu, who teaches the security side of the course and works in information security, and I sit down with the list and cut it until each lesson carries one idea that a learner can use the same evening.

We ask the same question of every item: would someone with a basic email account and a phone act differently tomorrow because of this? If the answer is no, it goes. Technical explanations of how attackers build their tools are interesting, but they do not help a person decide whether to click. What stays is practical: how to read a sender address, how to check a web address before typing a password, and when to stop and phone someone instead.

• One main idea per lesson
• Plain words before technical terms
• Every point tied to a task the learner can do

Before an exercise reaches a learner, one of us works through it from the start, slowly, as if we had never seen the screen. We time how long each step takes, note where the instructions assume knowledge we have not yet taught, and watch for any moment where a person might feel they have done something wrong. A password exercise, for instance, has to let people build a strong phrase without ever asking them to type in a password they really use.

We then hand the draft to someone outside the team, usually a friend or relative who describes themselves as uneasy with computers, and we say nothing while they try it. Their pauses tell us more than any survey. A hesitation at step three means step three is unclear, and we rewrite it. Two or three rounds of this is normal before a lesson is considered ready.

Fear is what scam messages feed on, so the course is designed to lower it. We do not show learners a wall of alarming examples. Instead we practise a short routine: stop, look at who is really writing, and check by another route before acting. Repeating the same small routine across different messages builds a habit that holds up when a new trick appears, which matters more than memorising any single warning sign.

Learners are always told that being caught out once is common and not a mark of carelessness. Many of the people who join have already lost a little money or been rattled by a call, and they arrive embarrassed. The tone of the lessons, and the way questions are answered, is meant to make asking for help feel ordinary. A person who feels safe to say what happened is far more likely to protect their accounts next time.

• Stop before clicking or replying
• Check the sender through a second route
• Tell someone you trust if unsure

Scams follow the calendar. In these autumn weeks, learners tend to bring us messages about parcel deliveries ahead of the holidays, about expiring accounts, and about tax and benefit notices. We review the examples at the start of each term and replace any that feel dated, so the practice always looks like what is actually arriving in inboxes right now.

This also means the course is never quite finished. A lesson that worked last year may need a new example this year, and we would rather revise openly than leave an outdated screenshot in place. Learners sometimes notice a change and ask why, and the answer is usually that someone in an earlier group showed us a message we had not seen before. That feedback loop is the most reliable quality check we have.

By the end of Internet Safety Essentials, a learner should be able to read a suspicious email calmly, recognise a doubtful website address, and set up stronger passwords with a method they can keep using. These are modest, concrete skills, and we describe them that way. The course does not promise that nothing bad will ever happen online, and no honest course could.

What it offers is steadier judgment and a clear next step when something looks wrong. The pace is set by the learner, lessons can be repeated, and practice tasks use made-safe examples rather than live accounts. Anyone with a basic comfort at the keyboard can follow along, and those who need more groundwork can start with Computer Basics for Adults first.

• No technical background needed
• Practice uses safe, prepared examples
• Lessons can be revisited at any pace