Key figure: Reported cybercrime losses in the United States reached $16.6 billion in 2024, up 33% from 2023 (FBI IC3, 2024 Internet Crime Report).
What is phishing? A fraudulent message designed to steal credentials or money by impersonating someone you trust. This 10-round quiz tests your instincts against real-world phish patterns, then teaches the tells you missed.
Phishing is a fraudulent message designed to steal credentials or money by impersonating someone you trust — a bank, a boss, a delivery service. The tells are consistent: urgency, spoofed senders, mismatched links, and requests you'd never get by email. This 10-round quiz tests your instincts against real-world phish patterns, then teaches the tells you missed.
Phishing is a cyberattack in which criminals impersonate trusted senders — banks, employers, delivery firms — to trick victims into revealing passwords, payment details, or installing malware.
A free 10-round phishing quiz with answers: ten realistic scenarios. You call it — phish or legit — then you get the full breakdown of what gave it away.
10 rounds · about 3 minutes · shareable score at the end
Yes. All 10 rounds, the red-flag breakdowns, and your score card are free with no signup and nothing installed.
No. Every scenario is an original simulated example written for training. Real phishing emails are never reproduced, and no real brands' messages are copied.
The most reliable signals are a sender domain that does not match the claimed brand, a link whose real destination differs from its label, manufactured urgency or threats, and requests for credentials or payments through the message itself.
Disconnect, do not enter anything, change the password from a known-good device starting with your email account, enable two-factor authentication, and report the message to your IT team or email provider.
Don't click links or open attachments. Verify the sender through a separate channel — type the site's address yourself or call a known number — then report it to your IT team or your country's phishing-report address, and delete it.
It depends on what happens next: merely loading a page rarely compromises a device, but entering credentials hands the attacker your account. Act fast — change the password from a clean device, revoke sessions, enable two-factor authentication, and alert IT so they can check for lateral movement.