Security moment
Can you spot the scam?
You get eight messages: emails, text messages, instant messages, phone calls and other everyday situations. For each one you decide whether it is genuine or a scam, and you learn right away what gave it away or how it could have been verified. The clock is running, because scams rely on hurry.
How to spot a scam
Scam messages change shape, but the signs repeat. When even one of these applies, verify the message before you do anything.
- Urgency and a deadline. A deadline stops you thinking. A genuine matter can wait for a confirmation call.
- A threat: account locked, parcel returned. Fear makes you act before checking. Services do not lock accounts within minutes.
- A request to keep it quiet from others. Secrecy removes the second pair of eyes. A normal payment survives you asking a colleague.
- Entering credentials via a link in the message. A login page behind a link can be a copy. Always sign in yourself the usual way.
- Payment through a link in the message. A small amount and a payment link collect your card details, not a payment.
- Account number changed by message. A supplier's account number rarely changes. Confirm by calling a number you already know.
- Sender address does not match the display name. Anyone can type a display name. The address line shows where the message really came from.
- The request arrives through an unusual channel. A CEO does not request payments on WhatsApp. The wrong channel is a sign in itself.
- The request bypasses normal procedure. Procedures exist for exactly this. An exception always needs a second confirmation.
- An unexpected attachment asking to enable macros or log in. Enabling macros or logging in because of an attachment is how malware gets installed.
- A sign-in request you did not make. An approval request you did not cause means someone else knows your password.
- Payment in gift cards or cryptocurrency. Gift card codes cannot be reversed. A company does not pay invoices with them.
- An offer too good to be true. An oversized salary, refund or prize is bait, not luck.
- An unknown sender asking you to act. A request to act from someone unknown is a reason to check, not a reason to act.
How do you verify safely?
Verifying is never wrong. It costs a minute, and a scam costs far more.
- I log in to the service myself the usual way, not via the link.
- I call the sender on a number I already know.
- I ask the sender in person or through another channel.
- I check that the message fits my own situation.
- The message asks nothing of me, so I do nothing.
- I check the sender's full address and the link target before clicking.
Why is the quiz free?
Because a practised eye is the best security measure a company can get, and it only sharpens through practice. The quiz stores nothing anywhere: your best result stays on your own device. If you want to train the whole team, our training does the same thing with guidance, and our security services catch the messages the eye misses.
Share the quiz with your team
The quiz is free and stores nothing. Send the address to a colleague or the whole team, so everyone can check their eye at their own pace.