10 realistic scenarios drawn from real-world attack patterns. For each one, pick Phish or Legit — then learn the exact tell. Nothing leaves this page. No signup.
Each scenario is built from a documented, real-world attack pattern — spear-phishing, lookalike domains, QR-code phishing ("quishing"), MFA fatigue, SMS package scams, AI-cloned voice calls, job-offer scams, and the fake-CAPTCHA malware trick. Two scenarios are legitimate, so "everything is a phish" won't get you 10/10. The explanations teach the tell, not just the answer.
They are realistic reconstructions of documented attack patterns, not copies of any single real message. Every scenario reflects techniques security teams have actually observed in the wild — the domains and names are fictional.
Because in real life, most messages are fine — and treating everything as hostile trains the wrong reflex. The skill is telling the difference, which is what the quiz scores.
No. Everything runs in your browser. No account, no tracking of your score, nothing sent anywhere.
Act fast: change the password from a clean device, revoke sessions, enable two-factor authentication, and if money moved, call your bank immediately. Then report it — to your IT team, or to your country's phishing-report address.
Scenarios are teaching reconstructions of real attack patterns. No real brands' login pages are reproduced here, and nothing on this page will harm your device.