12 messages · 3 minutes
Phish or legit?
Trust your eyes.
Emails, texts, phone calls and QR codes, all fictional. Decide whether each one is a scam, then see the clues you might have missed.
Your score
Five habits that beat most phishing
- Pause on urgency. Deadlines, threats and rewards are there to stop you thinking.
- Read the real sender and the real hostname, not the display name. Our link checker shows the actual destination of a link.
- Never share a one-time code, even with someone who says they are from your bank or IT department.
- Verify through a channel you already know: the app, a bookmark, the number on your card.
- Use unique passwords and two-factor authentication, so one mistake does not open every account. Start with the 2FA guide.
Read more about fake IT support calls that bypass MFA and how to check a link received by SMS or email.
Phishing quiz FAQ
Are these real phishing messages?
No. Every message is fictional and every link uses reserved example domains, so nothing in the quiz can be clicked or abused. The tricks themselves are the ones attackers use every day.
Can I use this quiz to train my team?
Yes. It is free, needs no account and works on phones. Share the page link; each person sees the messages in a different order and only the final score can be shared.
Is my score recorded?
Your answers stay in this page. If you accepted analytics, only the final score is counted, without any answer details.
What should I do with a suspicious message in real life?
Do not click, reply or call the number in the message. Open the app or website yourself, or call the organization using a number you already know. Our link checker shows where a link really goes without opening it.
More free security tools
Password generator
Random passwords, passphrases or PINs, created by the Web Crypto API on your device.
Open toolPassphrase generator
Random words you can actually remember, with the entropy of a 16-character password.
Open toolWi-Fi password + QR code
A strong WPA2/WPA3 key and a QR code your guests scan to join, with a card to print.
Open toolStrength test
See your password the way an attacker does: patterns, entropy and four crack-time scenarios.
Open toolBreach checker
Find out if a password already leaked, without ever revealing it (k-anonymity).
Open toolSuspicious link checker
Inspect a URL and its actual hostname locally, without opening the destination.
Open toolPassword policy builder
NIST, PCI DSS and CIS presets with ready-to-run Windows, Active Directory and Linux scripts.
Open toolCrack-time table
How long every length and character mix survives a modern GPU cracking rig.
Open toolPassword audit
Import your password manager export and find reused, weak and breached passwords, all on your device.
Open toolCustom-rules generator
A strong password that still fits picky websites: maximum length, allowed symbols, required types.
Open toolSmall-business security checklist
Score your company's account security in five minutes and print a prioritised action plan.
Open toolTwo-factor authentication guide
Which 2FA method to choose and how to turn it on for Google, Microsoft, Apple and more.
Open tool