Spot the scam before you click.
Short, realistic incidents in five attack types: a fake email, a phone call, a video call, a QR code and a direct message. Decide whether each one is real, point to the evidence, and learn exactly what gave it away.
No sign-up needed to try one. Nothing you do is saved.
- 1 The sender's domain is not the company's real one
- 2 A deadline and a threat, to rush you
- 3 The button leads somewhere other than it says
How it works
1. Look closely
Each incident looks like real software: open the email headers, hover over a link, answer the call, scan the code.
2. Make the call
Say whether it is phishing or genuine. Some messages are real, so flagging everything does not pay.
3. See where it was
Feedback points to the exact detail behind every red flag, with short training cards to learn from.
Five kinds of attack
Email Phishing
Inbox triage: sender, headers, links and attachments.
Voice-Based Phishing (Vishing)
A phone call you did not expect. Decide before you give anything away.
Deepfake Video/Voice Simulation
A video call from someone senior. Is it really them?
QR Code Phishing
Scan, then read the address before you trust the page.
Angler / Social Media Phishing
A direct message from a support account you never contacted.