Key figure: Reported cybercrime losses in the United States reached $16.6 billion in 2024, up 33% from 2023 (FBI IC3, 2024 Internet Crime Report).
Phishing is still the most common way attackers break in — not through firewalls, but through inboxes. This 10-question quiz shows real-world style lures: targeted emails, fake login pages, QR code scams, and smishing texts. Each answer explains the tell, so you leave knowing what these attacks actually look like in 2026.
It is a social-engineering attack where the attacker impersonates someone you trust — your bank, your boss, a vendor — to steal credentials or trigger a malicious action. The targeted variant aims at you specifically, using details scraped from social media or breaches, which makes it far harder to spot than bulk spam. Quizzes focus on it because targeted lures cause the costliest breaches, and recognition is the only defense that scales.
It is an attack personalized for one victim or organization, using real names, roles, or context to appear legitimate. Unlike bulk campaigns, it is researched and deliberate — and it works far more often.
A free 10-question phishing quiz with answers: 10 realistic scenarios drawn from real-world attack patterns. For each one, pick Phish or Legit — then learn the exact tell. Nothing leaves this page. No signup.
Each scenario is built from a documented, real-world attack pattern — spear-phishing, lookalike domains, QR-code phishing ("quishing"), MFA fatigue, SMS package scams, AI-cloned voice calls, job-offer scams, and the fake-CAPTCHA malware trick. Two scenarios are legitimate, so "everything is a phish" won't get you 10/10. The explanations teach the tell, not just the answer.
They are realistic reconstructions of documented attack patterns, not copies of any single real message. Every scenario reflects techniques security teams have actually observed in the wild — the domains and names are fictional.
Because in real life, most messages are fine — and treating everything as hostile trains the wrong reflex. The skill is telling the difference, which is what the quiz scores.
No. Everything runs in your browser. No account, no tracking of your score, nothing sent anywhere.
Act fast: change the password from a clean device, revoke sessions, enable two-factor authentication, and if money moved, call your bank immediately. Then report it — to your IT team, or to your country's phishing-report address.
The classic signs: a sender address that doesn't match the claimed brand, links whose real destination differs from the label, manufactured urgency or threats, unexpected attachments, and requests for credentials, payments, or MFA codes. The quiz above trains you to spot each one.
Don't click links or open attachments. Verify the sender through a separate channel — type the site's address yourself or call a known number — then report it to your IT team or your country's phishing-report address, and delete it.
It depends on what happens next: merely loading a page rarely compromises a device, but entering credentials hands the attacker your account. Act fast — change the password from a clean device, revoke sessions, enable two-factor authentication, and alert IT so they can check for lateral movement.
Scenarios are teaching reconstructions of real attack patterns. No real brands' login pages are reproduced here, and nothing on this page will harm your device.