Short answer: ten realistic example emails. For each one, decide whether it is phishing or legitimate, then see the clues that give it away. All companies, people and addresses are made up. The quiz runs in your browser and nothing is recorded.
The five checks that catch most phishing
- Read the sender’s real domain. Ignore the display name. Look at what comes after the @, reading from the right.
- Hover before you click. The link text and the real destination are often different.
- Notice pressure. Deadlines, threats, secrecy and “quick favors” are there to stop you thinking.
- Watch what is being asked for. Passwords, MFA codes, card numbers, gift cards and bank detail changes are the usual targets.
- Verify through a channel you already trust. Call a known number or type the website address yourself.
CISA’s guidance on recognizing and reporting phishing covers the same signs. If you clicked something, report it to your IT team right away and change the password on that account. Phishing-resistant sign-in methods such as passkeys and security keys stop most credential phishing even when someone does click; our MFA guide explains the options, and our guide to what phishing emails have in common goes deeper. You can test password strength with our password strength checker.
Phishing quiz FAQ
What is the most common sign of a phishing email?
A sender domain or link that does not belong to the organization it claims to be, combined with pressure to act fast. Checking the real domain catches most attempts.
Are the emails in this quiz real?
No. They are written to look like common phishing patterns, but every company, person and address is fictional.
What should I do if I clicked a phishing link?
Do not enter anything else. Report it to your IT or security team, change the password for that account from a trusted device, and turn on multi-factor authentication.
Can phishing get past MFA?
Yes for codes sent by text or app prompts, which attackers can relay in real time. Phishing-resistant methods such as passkeys and FIDO2 security keys are bound to the real website, so they stop most of it.