Phishing Quiz: Choose the Safest Verification Step

Phishing messages are not always misspelled, and real companies sometimes write alarming emails. This quiz is about choosing a safe verification step, not guessing from appearance.

1. Your streaming payment failed. Update now.

The message uses the right logo and your first name. The button points to a look-alike address.

Trust the logo Open the saved app or type the address you already know Inspect the message link, then use it if it looks close

Answer and explanation

Open the saved app or type the address you already know. Do not use the embedded link. Check the account through a channel you reached independently.

2. A text claims to be your bank's fraud team

It asks you to call a number in the message and read back a one-time code.

Call the supplied number Reply STOP Contact the bank through the number on your card or official app

Answer and explanation

Contact the bank through the number on your card or official app. Use an independently obtained channel and never provide a one-time code because a caller asked.

3. A coworker shares a cloud document unexpectedly

The sender address looks normal, but the sign-in page opens on an unfamiliar domain.

Sign in because the sender looks familiar Verify with the coworker through a separate channel Forward it to another coworker to test

Answer and explanation

Verify with the coworker through a separate channel. A familiar sender does not make an unfamiliar sign-in domain trustworthy. Confirm the share separately and use the organization's reporting process.

4. A delivery message says a small fee is due

You are expecting a package, and the message includes the correct city.

Pay because the context matches Check the tracking number in the carrier's official app or site Trust it because the fee is small

Answer and explanation

Check the tracking number in the carrier's official app or site. Context and amount do not replace independent verification. Reach the carrier through a channel you already know.

5. A security alert appears in email and the official app

The official app shows the same new-login event as the email.

Use the app's security page Click the email because the event is real Ignore both

Answer and explanation

Use the app's security page. The trusted app confirms the event, not every link in an email. Review and secure the account inside the app.

6. The message has no obvious mistakes

What is the strongest habit?

Look for bad grammar Decide whether the request is expected, then verify through a known channel Trust messages that know personal details

Answer and explanation

Decide whether the request is expected, then verify through a known channel. Verification is stronger than appearance, grammar or personal details.

Your choices are not stored. Use each answer disclosure to review the verification method.

Sources & methodology3 sources - evidence for this revision

The records below show what each source supports in this published revision.

How to recognize and avoid phishing scamsFederal Trade Commissionprimary - Retrieved Jul 11, 2026
What it supportsUrgency and requests to click links or disclose sensitive information are common phishing warning signs. - Suspicious requests should be verified through known contact information or a public company website rather than contact details in the message.
Phishing guidanceNISTprimary - Retrieved Jul 11, 2026
What it supportsUrgency and requests to click links or disclose sensitive information are common phishing warning signs. - Suspicious requests should be verified through known contact information or a public company website rather than contact details in the message.
Never move your money to protect it. That's a scam.Federal Trade Commissionprimary - Retrieved Jul 11, 2026
What it supportsA caller who asks for a verification code may be attempting to take over an account or authorize a transaction.

Can You Verify These Six Messages Safely?

Keep the good rabbit holes coming.

More worth reading

Scan a QR Code Without Handing It Blind Trust

An Unfamiliar Sign-In Alert Arrived: Check This First

Chrome Memory Saver Is Not a Tab Killer—Here Is What It Actually Does