Free Tool
Phishing Spotter Quiz
Phishing works because the messages look ordinary — a delivery notice, a bank alert, a prize you almost believe. This quiz shows you five fictional messages and asks you to judge each one, then explains the exact red flag you should have spotted. Every brand here is made up; the tricks are the real ones.
All examples are fictional and sanitised. The brands, senders and links in this quiz are invented for teaching. Never practise on a real suspicious message — report it instead, and never click a link in a message you do not trust.
What this tool does
Phishing is a message that pretends to be from someone you trust — a bank, a delivery company, a streaming service — in order to get you to click a link, open an attachment or hand over a password. Modern phishing is rarely full of spelling mistakes any more: artificial intelligence writes clean, convincing text, so the old advice to look for bad grammar no longer protects you. What protects you now is checking the sender, the link and the pressure in the message.
This quiz gives you five messages to judge. Each one is a short email, text or shopping notice built from the most common real-world tricks: a fake delivery problem, a bank account warning, a too-good prize, a subscription renewal you never bought, and a crypto investment promise. For each message you decide whether it looks genuine or like a phish, and the quiz then explains the red flags — the mismatched sender address, the shortened link, the urgency, the request for a password — and what the safe response would have been.
You get a score at the end, but the score is the least important part. What matters is learning to pause before you click and to check the message through a channel you trust, such as the company's own app or website, typed in by you. That one habit defeats most phishing, including the examples in this quiz.
Try it
Read each message, then judge it. The correct answer and the red flags appear after you choose.
Message 1 of 5
Choose an answer to see the red flags.
Score: 0 of 5
How it works
Each message in the quiz is built around one or two real red flags. The delivery notice comes from a sender address that does not match the company name, and its link is shortened so you cannot see where it leads. The bank warning creates urgency — act now or your account closes — because rushed people click first and check later. The prize message asks you to pay a small fee to claim a large reward, which is the classic advance-fee shape. The subscription renewal uses a real-sounding service name with a support number that leads to scammers. The crypto message promises guaranteed returns, which no honest investment ever does.
The safe response is the same in every case: do not click the link, do not call the number in the message, and do not reply. If the message claims to be from a company you use, open that company's app or type its web address yourself and check there. If it claims to be from a delivery company, check the tracking number on the company's own site. And if you are unsure, ask someone you trust or report the message through the company's official reporting channel.
The quiz keeps your score in this page only. Nothing is submitted, nothing is stored, and your answers disappear when you close the page. It is a learning exercise, not a test of your intelligence: even careful people miss well-made phishing, which is why the habit of pausing matters more than any single spot-the-difference skill.
Limitations
This quiz teaches recognition, not certainty. Real phishing changes constantly, and some real attacks — a message from a compromised account you genuinely know, or a cloned website with a near-identical address — are hard to spot by reading alone. A good quiz score does not mean you are safe, and a low score does not mean you are careless: it means you now know which red flags to practise checking.
- All five messages are fictional. Real phishing may use different wording, different brands and different tricks.
- The quiz cannot check a real message for you. If you receive a suspicious message about your bank or an account, contact the company through its official app or website.
- Nothing here is financial or legal advice. Reporting routes differ by country; our phishing guide lists the official ones.
Examples
Example 1 — the delivery notice. A text says your parcel is held and asks you to tap a shortened link to pay a small redelivery fee. The red flags: you were not expecting a parcel, the sender is a random number, the link hides its destination, and a small fee is used to make the request feel harmless. The safe move is to check the tracking number on the delivery company's own site — never through the link.
Example 2 — the bank warning. An email says unusual activity was detected and your account will be closed in 24 hours unless you verify now. The red flags: urgency designed to stop you thinking, a link to a login page, and a sender address that is almost — but not exactly — the bank's domain. Banks do not ask you to log in through an emailed link. Open the bank's app yourself instead.
Example 3 — the guaranteed investment. A message promises doubled money in a week from a new crypto platform, with screenshots of other people's profits. The red flags: guaranteed returns, pressure to act before the offer closes, and profits shown as screenshots rather than verifiable records. No legitimate investment guarantees returns, and promised profits are the oldest fraud signal there is.
Frequently asked questions
Can I trust a message just because it looks professional?
No. AI-written phishing looks polished, uses correct logos and proper grammar, and copies real message formats. Appearance is no longer a reliable signal — check the sender address, the link destination and whether the message pressures you to act.
What should I do with a phishing email?
Do not click anything in it. Report it through your email provider's report function, and if it pretends to be from a company you use, forward it to that company's official phishing reporting address. Then delete it.
Is a link safe if it starts with https?
Not necessarily. HTTPS only means the connection to that site is encrypted — it says nothing about who runs the site. A phishing site can have a valid padlock. Check the domain name itself, character by character.
What if I already clicked a link?
Stay calm and do not enter anything. Close the page, and if you downloaded a file, do not open it. If you entered a password, change that password and any account that reused it, and turn on two-factor authentication. Our clicked-a-phishing-link triage tool walks you through it step by step.
Why do the quiz brands look fake?
Because they are. Every brand in this quiz is invented so the quiz teaches the tricks without imitating a real company or a real message. Real phishing imitates real brands — which is why checking the sender and the link matters more than recognising a logo.