How the quiz works
You play Sam, who works at a small design firm. Each round shows one email in a plain mail reader, with a short note on what Sam already knows, such as the bank Sam uses or the colleague Sam is waiting to hear from. Read it the way you would read your own mail, then choose phishing or legit.
Links in the emails never open. Hover over one, or tap it on a phone, and the bar under the email shows where it really goes. That is the same check you can do in any mail app before you click.
After each answer the tells light up inside the email, numbered, and each one is explained underneath with the guidance it is based on. At the end you get your score, a list of what you got right and what you missed, and a link or image to share.
Every company, person and address in the quiz is made up. Every domain ends in .example, a name set aside so that it can never belong to a real website.9
Why some of the emails are real
Most of the email you get is fine. A quiz where every message is a trap teaches you to distrust everything, and that is not a habit anyone keeps for long. Some of the ten emails are ordinary messages that pass every check: they are expected, specific, calm and they link to the sender’s own site. Telling those apart quickly is half the skill, so you can save your suspicion for the emails that need it.
The tells the quiz trains
- The address, not the name. The display name can say anything. Read the address itself and compare it with the domain you know. Look-alikes change or add a few characters, such as a zero for an o, or a hyphen.23
- Where the link really goes. Check the destination before you click. If it is not the site you expect, or it hides behind a link shortener or a QR code, do not use it.17
- Pressure. Deadlines, threats to close an account, “only 3 left” and requests to keep a secret all exist to rush you. The NCSC names authority, urgency, emotion and scarcity as the tricks to watch for.7
- What it asks for. Passwords, card numbers, new bank details for a supplier and gift card codes are what the attacker is after. The FTC says only scammers will tell you to buy a gift card.5
Using the quiz as a phishing test for your team
Send the link to your team and ask everyone to play on their own device. It takes about five minutes and needs no accounts. People can share a link or an image with their score, so you can compare results and then walk through the emails that caught people out. CISA suggests teaching staff exactly these checks: hover over links, be wary of unexpected requests, and confirm odd requests through a contact method you already know.1
If a real email looks like phishing
- Do not click, reply or call any number in it. That includes the unsubscribe link.2
- Check through a channel you already trust. Type the company’s address yourself, open its app, or call the person on a number from your own records.6
- Report it. In the US, forward phishing emails to reportphishing@apwg.org, as the FTC suggests.4 In the UK, forward them to report@phishing.gov.uk, the NCSC’s reporting service.8 At work, follow your company’s process.
Email that doesn’t report back
Secria Mail is free to start. Tracking pixels are removed automatically and senders never see your IP address. Your mailbox is stored with zero-access encryption, locked with a key made from your password on your device.
Questions about the phishing quiz
Is this phishing quiz free?
Yes. There is no sign-up and no email address to give. Open the page, press Start and judge ten emails. It takes about five minutes.
Are the emails in the quiz real?
No. Every company, person and address is made up, and every domain ends in .example, a name reserved so that it can never be a real website. There are no real logos. The emails copy the patterns of real phishing, so the habits you build carry over to your own inbox.
Does the quiz save my answers?
No. The quiz runs in your browser. Your answers are not sent anywhere, saved or logged, and the links inside the emails never open. Nothing else leaves the page unless you share it yourself: a link with your score, or the score image.
Can I use this quiz as a phishing test for employees?
Yes, as a training exercise. Send your team the link and ask everyone to play on their own device. Each person can share a link or an image with their score, which is enough to compare results and talk through the emails people missed. It is not a phishing simulation: nobody is sent a fake email without warning.
What is a good score?
Ten out of ten is possible if you check every sender address and every link. Most people miss one or two, usually by trusting the name on the From line or the look of the email. The legitimate emails count as much as the phishing ones, because treating every email as a scam is not the goal either.
Where do the tips in the quiz come from?
Every tell is based on public guidance from CISA, the US Cybersecurity and Infrastructure Security Agency; the FTC, the US Federal Trade Commission; and the NCSC, the UK National Cyber Security Centre. Each tell names the guidance it comes from, and the full list is in the sources on this page.
Keep learning
Sources
- CISA, Teach employees to avoid phishing.
- CISA, Recognize and report phishing (marked archived by CISA).
- CISA, Avoiding social engineering and phishing attacks (February 2021, marked archived by CISA).
- FTC, How to recognize and avoid phishing scams (September 2022).
- FTC, Avoiding and reporting gift card scams (July 2023).
- FTC, Cybersecurity for small business: phishing (fact sheet, PDF).
- NCSC, How to spot a scam email, text message or call (reviewed September 2022).
- NCSC, Report a scam email (reviewed September 2022).
- IETF, RFC 2606: Reserved top level DNS names (June 1999).
Sources and reporting addresses checked in October 2026.