Can you spot the scam?
You get eight messages: emails, text messages, instant messages, phone calls and other everyday situations. For each one you decide whether it is genuine or a scam, and you learn right away what gave it away or how it could have been verified. The clock is running, because scams rely on rushing you.
Test your eye
Extended quiz: eight messages with guidance
You get eight messages from different channels. After each one you are asked what gave the scam away or how you would verify a genuine message. The clock is running, and at the end you see which signs went unnoticed.
Your best result on this device:
Message 1 / 4 · · Real or scam?
- Display name
- Address
Situation:
you spotted
/ 8
Result
The next round is a notch harder.
Signs you spotted
These signs went unnoticed
Recap: the messages and the decisive signs
In a real situation one click is all the attacker needs: logging in to your email with a stolen password or installing malware takes less time than this quiz did. That’s why the best security measure isn’t a device but a practised person – and the eye sharpens exactly this way, by practising.
Want the extended quiz?
Eight messages, each followed by guidance: what gave the scam away, or how to verify a genuine message.
For your team
The good news: spotting scams can be taught to your whole team, and technology catches the messages the eye misses.
How to spot a scam
Scam messages change shape, but the signs repeat. When even one of these applies, verify the message before you do anything.
- Urgency and a deadline. A deadline stops you thinking. A genuine matter can wait for a confirmation call.
- A threat or intimidation. Fear makes you act before checking. Services do not lock accounts within minutes.
- A request to keep it quiet from others. Secrecy removes the second pair of eyes. A normal payment can wait while you ask a colleague.
- Entering credentials via a link in the message. A login page behind a link can be a copy. Always sign in yourself the usual way.
- Payment through a link in the message. A small amount and a payment link collect your card details, not a payment.
- Account number changed by message. A supplier’s account number rarely changes. Confirm by calling a number you already know.
- Sender address does not match the display name. Anyone can type a display name. The address line shows where the message really came from.
- The request arrives through an unusual channel. A genuine sender uses their usual channel. An unexpected channel, such as an instant message or a call following a text, is a sign in itself.
- The request bypasses normal procedure. Procedures exist for exactly this. An exception always needs a second confirmation.
- An unexpected attachment asking to enable macros or log in. Enabling macros or logging in because of an attachment is how malware gets installed.
- A sign-in request you did not make. An approval request you did not trigger means someone else knows your password.
- Payment in gift cards or cryptocurrency. Gift card codes cannot be reversed. A company does not pay invoices with them.
- An offer too good to be true. An oversized salary, refund or prize is bait, not luck.
- An unknown sender asking you to act. A request to act from someone unknown is a reason to check, not a reason to act.
How do you verify safely?
Verifying is never wrong. It costs a minute, and a scam costs far more.
- I log in to the service myself the usual way, not via the link.
- I call the sender on a number I already know.
- I ask the sender in person or through another channel.
- I check that the message fits my own situation.
- The message asks nothing of me, so I do nothing.
- I check the sender’s full address and the link target before clicking.
Why is the quiz free?
Because a practised eye is the best security measure a company can get, and it only sharpens through practice. The quiz stores nothing anywhere: your best result stays on your own device. If you want to train the whole team, our training does the same thing with guidance, and our security services catch the messages the eye misses.
Share the quiz with your team
The quiz is free and stores no personal data. Send the address to a colleague or the whole team, so everyone can check their eye at their own pace.