Learn / Cybersecurity
Cybersecurity · 2 min read
Spot the phish: a quick game
Six messages. Which ones are real? Practice on harmless examples so the real ones feel familiar.
Phishing works because it borrows trust and adds pressure. The scammer wants you to act before you think. Try the messages below. Everything here is invented.
Real or phish?
Score: 0 / 6
Your bank: Unusual sign-in detected. Verify now at secure-bankk-login.com within 24 hours or your account will be suspended.
Urgency, a threat, and a look-alike address with an extra k. Open your bank's app yourself instead.
Mom (new number): Hi it's me, I lost my phone. Can you buy 4 gift cards for me? I'll explain later.
A "family member" on a new number asking for gift cards is a classic. Check with them another way before doing anything.
Dental office text from the number you always use: Reminder, cleaning Tuesday 3pm. Reply C to confirm.
No link, no urgency, no money. If still unsure, call the office on the number you already have.
IT Helpdesk: Your password expires today. Click here and enter your current password to keep your account.
Real IT teams do not ask for your current password. Go to the official site yourself.
Courier: We could not deliver your parcel. Pay a $1.99 redelivery fee: parcel-fix.example/track
A small fee is the hook; the real goal is your card details. Check the carrier's own app.
Jordan (your friend, in your usual chat): Dinner Sunday? Mom's making the lasagna.
A normal message from a known person on a channel you already use.
The pattern behind most scams
- Urgency: "within 24 hours," "act now."
- Fear or greed: account locked, prize waiting.
- An unusual ask: gift cards, codes, wire transfers, new payment details.
- A look-alike: a link or address one letter off from the real one.
What to do instead
- Do not click. Open the app or type the address yourself.
- Call back using a number you already trust, not the one in the message.
- If a family member asks for money from a new number, check with them on a channel you know.
- Never share a one-time code with anyone. Real companies do not ask.