Practice status

{{ summaryValue }}

{{ summaryLine }}

Build a practice round

Practice recognizing cues and choosing safer actions in 30 original, inert scenarios. No real messages or credentials are requested. This is independent education, not a live phishing detector or certification.

Optional. Leave blank for the default round, or use up to 128 characters to reproduce a challenge. Avoid personal information; the seed and answers appear in shared links.

{{ seedNotice }}

{{ quizSetupValidation }}

{{ answeredCount }} of {{ questionCount }} answered · {{ progressLabel }}%

{{ progressStatusLine }}

Question {{ quizCursor + 1 }} of {{ questionCount }}

{{ currentQuestion.stem }}

{{ currentQuestion.accessible_clue }}

Answer recorded. Explanations will appear after you finish the round.

{{ currentResultRow.feedback }}

{{ currentResultRow.explanation }}

Source: {{ currentResultRow.source.reference }} · {{ currentResultRow.source.version }} · {{ currentResultRow.source.license }}

Review what to practice next

{{ resultLead }}

This score describes only this practice round. Follow your organization’s incident process for real messages. Source guidance was checked on 11 September 2026; coverage is curated and does not establish phishing immunity.

This is a focused replay. Same and new seeds keep this item scope; choose Change setup to return to the full selected pool.

{{ learningReviewTitle }}

{{ learningReviewLine }}

{{ card.label }}
{{ card.value }}
{{ card.note }}

Missed answer review

  1. {{ item.prompt }}

    Your answer: {{ item.selected_answer_label }}

    Correct answer: {{ item.correct_answer_label }}

    {{ item.explanation }}

    Source: {{ item.source.label }} · {{ item.source.version }} · {{ item.source.license }}

Cues and safer actions

Which cue or response topics need another look? Bars count answers in this round only; an untested topic is not evidence of proficiency.

Loading topic-performance chart…

{{ quizChartStatus }}

{{ quizChartExportStatus }}

Answer ledger

Question ID Prompt Topic Your answer Correct answer Outcome Explanation Source Copy
{{ row.question_id }} {{ row.prompt }} {{ row.category_label }} {{ row.selected_answer_label }} {{ row.correct_answer_label }} {{ row.outcome_label }} {{ row.explanation }} {{ row.source ? `${row.source.label} · ${row.source.version}` : '—' }}

{{ quizLedgerExportStatus }}

Email Header Analyzer Inspect raw email headers locally to trace relay delays and compare recorded SPF, DKIM and DMARC evidence while spotting sender mismatches.
Blacklist Checker (DNSBL/RBL) Check a mail host or sender IP across selected DNSBLs, distinguish policy listings from resolver errors, and inspect provider evidence.
Password Strength Calculator Check a password against predictable patterns and attack scenarios, compare estimated crack times, and keep the candidate in your browser.
Secure Password Generator Generate a unique password in your browser with adjustable character rules, unbiased random selection, and clear strength estimates.

A delivery text can arrive while a parcel is genuinely on the way, and a false account alert can name a bank you really use. Those coincidences make a story believable without proving who sent it. Phishing uses that misplaced trust to persuade someone to disclose sensitive information, open harmful content, make a payment or give another person access to an account or device.

The requested action often matters more than the message's appearance. An unfamiliar invoice asks you to open a file, a supposed manager wants employee records sent to a new address, or a caller claims that sharing a sign-in code will stop an attack. These are forms of social engineering, meaning attempts to manipulate a person's decisions. The small fee advertised in a delivery scam does not limit the harm if the payment form captures card details.

Email is only one route. Similar requests arrive through text messages, telephone calls and social accounts. A quick response (QR) code can carry a website address in a scannable pattern, including on a printed notice or a sticker placed over payment instructions. Moving from a message to a call or website does not establish trust when the suspicious sender supplied that destination too.

Warning cue
A detail that calls for caution, such as an unexpected payment request, an urgent deadline or instructions not to contact anyone else. A cue is a reason to verify, not conclusive proof of fraud.
Independent verification
Checking the specific request through a contact or service you already trust, rather than through a link, number or transfer supplied by the person making the request.
Exposure
Information or access already given away, such as a submitted password, disclosed card number or permission to control a device. Exposure changes the response needed.

Familiar names, logos and grammatically correct writing are not reliable identity checks. Caller ID can be falsified, and even a familiar-sounding voice can be imitated. A message may also misuse the identity of a person you know. Looking only for poor spelling misses the more consequential question of whether the request and its destination have been checked independently.

Verification does not require ignoring every unexpected notice. Opening a bank's known app yourself may reveal that an account task really does need attention. Continuing inside that app addresses the task without relying on the original message. Finding a genuine notice there does not prove that the original link, caller or future messages are trustworthy.

Once information has been submitted, closing the page or deleting the message cannot take it back. Prompt reporting and account-protection steps then matter more than further investigation of the suspicious destination. Awareness exercises are educational practice, not certification or professional incident-response advice. Real incidents require the affected service's trusted support route and, where applicable, the organization's incident process.

How to Use This Tool:

Practice on fictional text scenarios rather than submitting messages from your inbox. The initial setup selects six questions across all channels, both practice focuses and mixed difficulty, with explanations after each answer.

  1. Choose a Message channel, Practice focus and Scenario difficulty. You can concentrate on email, text messages, phone calls, QR codes, or web and social messages, then practice recognizing a cue or choosing a safer response.
  2. Select a Question count from the offered choices. With all filters unrestricted, the choices are 2, 4, 6, 10, 15 and 30. Narrower selections offer counts that fit, including the full smaller pool. An unavailable count is adjusted when the filters change. If Start practice is unavailable, choose an offered combination and count.
  3. Choose Feedback timing. After each answer reveals correctness and an explanation immediately. At the end records the answer without revealing correctness in the question view, then provides the explanations when the round is complete.
  4. Enter a nonsensitive Replay seed under Advanced when you need a repeatable challenge. Leaving it blank uses a fixed default, not a newly randomized round. Surrounding spaces are ignored. The limit is 128 characters as counted by the browser; some symbols, including emoji, count as two. An overlong value produces a notice and uses the default seed.
  5. Select Start practice and choose one of the four responses to each scenario. Selecting an answer records and locks it immediately. Use Next question to advance and View results after the last answer. Questions cannot be skipped to obtain an early final result.
  6. Read Missed answer review and the Answer ledger before replaying. Retry missed starts a new attempt containing only wrong answers. Replay same seed repeats the challenge, while Try a new seed requests another selection or ordering.
    After Retry missed, both same-seed and new-seed replays remain restricted to that focused set. Choose Change setup to clear the attempt and return to the full pool allowed by your filters. A new seed does not guarantee unseen questions.

Interpreting Results:

During a round, Practice status counts questions answered. At completion it shows correct answers out of the selected total. Reaching 100% progress means that every question was answered, not that every answer was correct. Perfect round means no misses in that attempt, so there is no missed-answer retry to offer.

The Cues and safer actions chart counts Correct and Missed answers by teaching topic. These are counts from the current round, not proficiency percentages. Topics can have different numbers of questions, and an untested topic provides no evidence of skill. Review focus identifies a topic with the most misses, not a statistically established weakness.

Use each explanation to identify the cue or safer action you overlooked. The Answer ledger includes both correct and incorrect answers with their explanations and source information, so a correct guess can still be worth reviewing. A high score does not establish that you can identify every real phishing attempt.

Technical Details:

A fraudulent request may let the same sender control both the claim and the way it is supposedly checked. Calling a fraud hotline printed in a suspicious text, replying to its sender or accepting a caller's transfer does not provide independent evidence. A known app, saved portal or established contact breaks that dependence.

Verification before and after exposure

The appropriate response depends on whether a request has been verified and whether information or access has already been disclosed. Suspicion, exposure and confirmed account activity are different conditions; none should be inferred from a quiz score.

Condition and meaning Safer response
An unexpected request has not been independently checked
A familiar name, logo or plausible account story does not authenticate it.
 Withhold sensitive information and avoid its links or attachments. Check the request through a known contact or service.
A page was opened, but no information was entered, permission granted or software installed
Opening the page alone does not prove that a password was stolen. It also does not establish that the device is safe.
 Close the unexpected page and stop interacting. Keep software updated and seek trusted support if a download or device warning appears.
A password was entered at a suspicious destination
The password should be treated as exposed even without a visible account problem.
 Change it promptly through the genuine service, replace it anywhere it was reused and notify the responsible security team for a work account.
An unexpected caller requests a one-time sign-in code
The code is an authentication secret, not proof that the caller is genuine.
 Keep it private, end the call and check the account independently. If it was already shared, contact the account provider promptly.
Card details were disclosed or money was sent
Deleting the message does not undo the disclosure or payment.
 Contact the card issuer or bank through its trusted app or established number, report what happened and follow its protection advice. Review transactions.
The same account task is found inside an independently opened, known app
The task has been corroborated through that route, not the original message.
 Continue through the known app's normal account process without returning to the unverified link.

Authentication means checking identity. A display name or caller ID can be spoofed, meaning made to look as though it belongs to someone else. Personal details, polished writing and copied branding may support an impostor's story without authenticating the person making a request. Pressure to stay on a call or avoid other contacts makes independent checking harder.

Multifactor authentication (MFA) uses more than one type of sign-in evidence, such as a password and an authenticator code. It can help protect an account after a password is exposed, but a one-time code must still be kept private. Giving a code to an unexpected caller may help that person sign in before it expires. Enabling MFA does not erase information already disclosed.

QR codes and link captions require the same caution. The words displayed beside a link do not determine its destination, and a code attached to a payment machine is not automatically authorized by the operator. An unfamiliar destination is a reason to use the established service instead; it is not, by itself, a complete technical finding about that destination.

Reporting should use the controls supplied by the messaging service or the organization's approved incident route, not an unsubscribe link supplied in the suspicious message. There is no need to open an attachment, send a test payment or enter invented credentials to prove that a report is justified. Workplace procedures determine how evidence should be retained or deleted.

Correctness and completion

Each question has one keyed correct answer among four choices. A correct answer earns one point and an incorrect answer earns zero. Topic and difficulty do not change the points, and there is no partial credit or penalty. Let C be the number correct, A the number answered and N the number selected for the round. The point total is C out of N possible points. C, A and N are counts of questions and are integers satisfying 0 ≤ C ≤ A ≤ N, with N ≥ 1. Points count correct answers; accuracy and progress are percentages.

The accuracy percentage uses the full selected round as its denominator.

Accuracy (%) = 100 × C N

Progress counts recorded answers regardless of whether they are correct.

Progress (%) = 100 × A N

N stays fixed during an attempt. Unanswered questions remain in that denominator but are not counted as incorrect or included in Retry missed. Completion requires all N answers. Scores range from zero to N points, with no official pass mark, proficiency bands or risk thresholds.

Counts and points remain exact whole numbers. Accuracy retains its unrounded calculated value; the completed headline shows the exact correct/selected fraction. Only the visible progress label rounds to the nearest whole percent, with half-percent ties upward. After two answers in a six-question round, with one correct and one incorrect, progress is about 33.33% and is shown as 33%. The full-round accuracy calculation is about 16.67%, not 50%. Four questions remain unanswered, so no final result is ready.

Coverage and comparisons between rounds

The 30 original scenarios include six each for email, text messages, phone calls, QR codes, and web or social messages. All are text questions, including the telephone and QR situations. Filters restrict the eligible scenarios before seeded selection without replacement, so a question does not repeat within one round. Short rounds do not guarantee balanced topic coverage.

Teaching topic Decision being practiced Scenarios
Pressure & incentives Recognize deadlines, threats, isolation and unexpected rewards. 4
Identity & trust Question familiar names, caller ID, account identities and requests for secrets. 7
Links & attachments Assess unexpected files, destinations and requests for device access. 5
Independent checks Verify a claimed task through an established contact or service. 8
Reporting & recovery Report suspicious requests and respond after information is disclosed. 6

An exact replay depends on the same seed, filters, question count, feedback mode, focused scope and question-bank version. A new seed may reuse scenarios, and selecting the full pool necessarily reuses its questions. Changing difficulty, narrowing the pool, viewing immediate explanations or remembering a previous answer changes the comparison. A score increase is not a measured reduction in real-world phishing risk.

Limitations and Privacy Notes:

This is independent practice, not an official question set or a message detector. It does not inspect real messages, calls, QR images, websites or accounts. Coverage is curated, not exhaustive. The question bank is dated 11 September 2026 and records source-guidance checks on that date; it is not a continuously updated threat feed. Citing public guidance does not imply endorsement or affiliation.

  • Reporting and recovery routes vary by organization, provider and country. The references include United States guidance; national reporting numbers or procedures should not be assumed to apply elsewhere.
  • Scoring happens in the browser. Attempt data in the URL is not encrypted or private progress storage: setup, seed, answers and position in the round are carried in the page and share URL, including partial attempts. Anyone receiving such a link can restore the recorded choices. URLs may enter browser history or be transmitted when loaded or shared. Keep personal information out of the seed, and do not treat an attempt link as confidential.
  • Chart display can require an additional network download. Browser scoring does not establish an offline guarantee or a site-wide promise about logging and retention. The quiz provides no account-based progress history.
  • Change setup clears the current attempt and its current URL state, not copies already shared or retained. An incompatible or invalid saved attempt produces Saved attempt unavailable; choose a current setup and select Start practice to begin a new attempt.

Worked Examples:

A code request and a familiar voice

Choose Phone calls, Choose a safer response and Layered situations. This two-question round covers a caller requesting a one-time sign-in code and a familiar-sounding relative requesting an urgent transfer. Suppose you incorrectly choose to read out the code because it expires soon, but correctly choose to contact the relative or another trusted family member through a number you already have. The completed score is 1/2, and Missed answer review contains the code scenario. Its safer response is to keep the code private, end the call and check the account independently. Retry missed then creates a one-question round. Correcting it produces 1/1 for that new attempt, not a revision of the original 1/2 or proof of broader competence.

A portal name that hides a different destination

Select Web and social messages, Recognize the cue and Everyday cues for the two-question selection. In its portal scenario, the saved address is campus.example, while a message labelled “Campus portal” names campus-login.example as its destination. Choosing the answer that calls for verification through the saved portal is marked Correct. The two names are different; familiar display text does not make them equivalent. This is a reason to check through the established route, not a live finding that the other destination is malicious. The .example names are reserved illustrations, not services to visit or test.

References: