Your inbox has new emails. Some are phishing, and some are perfectly genuine. Review each one like you would at work, then get your score and a full breakdown. There are no trick questions: every phishing email has warning signs you can check, and you get a different mix each time.
The test itself does not collect or send your answers, and your best score stays in your browser. At the end you can choose to email yourself a report.
All emails are invented for training. Company names shown belong to their owners, and this test is not affiliated with or endorsed by them.
There is no hint after each email, just like at work. You will find out how you did once you have been through them all.
Pick Quick (5 emails), Standard (10) or Hard (10, fewer scans). The first time, a short practice email in your inbox walks you through the controls. It is not scored, and you can skip it.
Check Your situation first: it tells you what you know about the message. Then read it carefully. Hover over (or tap) the sender's name to see their address, and hover over buttons to preview where they go. On a phone, press and hold a button to see where it goes. For the technical details, open the three dots (…) menu and choose View message details.
Switch on Flag evidence and click anything that gives an email away. Each real giveaway earns a mark; a flag on something that is fine costs one, so be sure.
You can open links, attachments and QR codes to check them. On a genuine email that is safe. On a phishing email, opening a dangerous file or typing details into a fake page fails the message and locks it.
Use the Report phishing button for anything suspicious, and Mark as safe for the rest. You can change your mind until you submit.
Your score is how many you got right. You also get a separate investigation score for how well you checked, your skills, what each mistake would have cost, and every email replayed with what gave it away.
Run through these on any email that asks you to do something, and you will stop the large majority of attacks.
Read the part after the @. Lookalikes use a zero for an o, an extra hyphen or the wrong ending.
Hover over a link before you click. If the address does not match the sender, do not use it.
"Within 24 hours" and "your account will be closed" are there to make you rush.
"Dear user" or "Dear customer" from someone who should know your name.
Web pages (.html), zip files and anything you did not expect, even from people you know.
You cannot check where a QR code leads, and it takes you onto an unprotected phone.
Not every email in the test is a trap. Treating everything as a threat is just as unhelpful, so some of them are genuine.