Phishing Quiz: Can You Spot the Fake Email?

Short answer: ten realistic example emails. For each one, decide whether it is phishing or legitimate, then see the clues that give it away. All companies, people and addresses are made up. The quiz runs in your browser and nothing is recorded.

Free phishing test for employees and teams

You can use this phishing test in security awareness training. Share the link before a team meeting, ask everyone to take it, then go through the emails people got wrong together. Nothing is recorded and there is no sign-up, so it works as a quick, low-pressure warm-up. It is not a phishing simulation: if you want to send realistic test emails to staff and track who clicks, use a dedicated simulation platform and get approval from HR and leadership first.

Want more examples? The CyberExperts Daily Brief covers new phishing and scam campaigns in five minutes every weekday morning.

Phishing test answers: all 10 emails in text form (spoilers)

  1. Email 1: “Unusual sign-in blocked: verify within 24 hours”
    From: Northwind Bank Security <al****@*******************re.co>
    We blocked a sign-in to your account from a new device in Lagos. To keep your account active, verify your identity within 24 hours or online banking will be suspended. [Verify my account] (link goes to http://northwind-bank-secure.co/verify)

    Answer: Phishing. The sender domain is northwind-bank-secure.co, not the bank’s real domain. Lookalike domains with extra words like “secure” are a classic trick. A 24-hour deadline and a threat to suspend the account push you to act before thinking. Hover the button: it goes to the lookalike domain over plain http.

  2. Email 2: “Delivery failed: $1.99 redelivery fee”
    From: ParcelPoint <no******@******************ry.info>
    Your package could not be delivered because the address was incomplete. Pay the $1.99 redelivery fee to schedule a new attempt. [Pay and reschedule] (link goes to https://pp-redeliver.top/pay)

    Answer: Phishing. Small “redelivery fees” are a common card-harvesting scam; carriers do not usually collect fees by email link. The link goes to an unrelated .top domain. No tracking number, recipient name or order details.

  3. Email 3: “Quick favor”
    From: Dana Whitfield (CEO) <da****************@***il.com>
    Are you at your desk? I’m in back-to-back meetings and need you to buy four $250 gift cards for a client thank-you. Send me the codes by email. Keep this between us for now.

    Answer: Phishing. Executive name on a personal Gmail address. Gift cards plus secrecy plus urgency is the standard business email compromise script. Verify by calling the person on a known number, never by replying.

  4. Email 4: “Planned maintenance Saturday 10 p.m. to midnight”
    From: Brightline IT Service Desk <se*********@*************rp.com>
    Email and VPN will be unavailable Saturday from 10 p.m. to midnight while we apply security updates. No action is needed. Questions? Open a ticket in the IT portal you normally use or call extension 4400.

    Answer: Legitimate. Comes from the company’s own domain (brightline-corp.com in this example). Asks for nothing: no link, no login, no attachment. Points you to the portal and phone extension you already know.

  5. Email 5: “Jordan shared “Q3 Salary Adjustments.xlsx” with you”
    From: CloudBox <sh***@************es.net>
    Jordan Price shared a file with you. Q3 Salary Adjustments.xlsx [Open in CloudBox] (link goes to https://cloudbox-files.net.login-session.ru/auth) You need to sign in to view this file.

    Answer: Phishing. Hover the link: the real domain is login-session.ru. Read domains from the right: everything before the last two labels is decoration. A tempting file name (salaries) is bait to make you click. Asking you to sign in to view a shared file is how credentials get stolen.

  6. Email 6: “Action required: confirm direct deposit details”
    From: Payroll <pa*****@***************************te.net>
    We are migrating to a new payroll provider. Confirm your direct deposit account by Friday or your next paycheck may be delayed. [Update deposit details] (link goes to https://brightline-corp.com.hr-update.net/form)

    Answer: Phishing. The domain is hr-update.net; “brightline-corp.com” is just a subdomain label on the attacker’s domain. Payroll diversion is one of the most common BEC losses. A paycheck threat creates pressure. Check with HR through a known channel.

  7. Email 7: “Your receipt for October”
    From: Orbit Streaming <bi*****@*********am.com>
    Thanks for your payment. Plan: Standard. Amount: $11.99. Card ending 4417. You can view your billing history any time by signing in to orbitstream.com directly. We will never ask for your password by email.

    Answer: Legitimate. Consistent sender domain, specific details (plan, amount, last four digits). No link to click and no request; it tells you to go to the site yourself. Still unsure? Open the app or type the address yourself rather than using any link.

  8. Email 8: “Mailbox 98% full: incoming mail will be rejected”
    From: MailSuite Admin <ad***@********************er.com>
    Your mailbox has reached its storage limit. Messages sent to you will bounce after 6:00 p.m. today. Click below to increase your quota at no cost. [Increase storage] (link goes to https://mailsuite-quota-center.com/upgrade)

    Answer: Phishing. Uses a familiar product name on a domain the vendor does not own. “Increase storage” links that ask you to sign in are classic credential phishing. Real storage warnings come from your own IT team or inside the product itself.

  9. Email 9: “Agenda for Thursday’s project review”
    From: Taylor Reyes <ta**********@*************rp.com>
    Hi all, attached is the agenda for Thursday. We’ll start with the timeline, then budget. If anything needs adding, reply by Wednesday noon. Attachment: Project-review-agenda.docx (34 KB)

    Answer: Legitimate. Expected, internal and specific; it matches a meeting already on the calendar. Plain .docx attachment, with no request to enable macros or editing. If a “colleague” email ever asks you to enable macros, log in, or pay something, verify first.

  10. Email 10: “Did you make this purchase?”
    From: Fraud Prevention <fr***@************nk.com>
    We noticed a $742.18 charge at ELEC-WORLD ONLINE. If this wasn’t you, reply with your full card number, expiry date and the 3-digit code on the back so we can cancel the card immediately.

    Answer: Phishing. No bank asks for your full card number and security code by email, even from a domain that looks right (display names and domains can be spoofed). A scary charge amount is meant to rush you. Call the number on the back of your card instead of replying.

The five checks that catch most phishing

  1. Read the sender’s real domain. Ignore the display name. Look at what comes after the @, reading from the right.
  2. Hover before you click. The link text and the real destination are often different.
  3. Notice pressure. Deadlines, threats, secrecy and “quick favors” are there to stop you thinking.
  4. Watch what is being asked for. Passwords, MFA codes, card numbers, gift cards and bank detail changes are the usual targets.
  5. Verify through a channel you already trust. Call a known number or type the website address yourself.

CISA’s guidance on recognizing and reporting phishing covers the same signs. If you clicked something, report it to your IT team right away and change the password on that account. Phishing-resistant sign-in methods such as passkeys and security keys stop most credential phishing even when someone does click; our MFA guide explains the options, and our guide to what phishing emails have in common goes deeper. You can test password strength with our password strength checker.

Phishing quiz FAQ

What is the most common sign of a phishing email?

A sender domain or link that does not belong to the organization it claims to be, combined with pressure to act fast. Checking the real domain catches most attempts.

Are the emails in this quiz real?

No. They are written to look like common phishing patterns, but every company, person and address is fictional.

What should I do if I clicked a phishing link?

Do not enter anything else. Report it to your IT or security team, change the password for that account from a trusted device, and turn on multi-factor authentication.

Can phishing get past MFA?

Yes for codes sent by text or app prompts, which attackers can relay in real time. Phishing-resistant methods such as passkeys and FIDO2 security keys are bound to the real website, so they stop most of it.