Spot the Phish: Free Phishing Quiz (India)

THE QUIZ

Phish, or genuine?

You work in the office of Sharma Components. Patel Packaging is one of your suppliers. Every name, number and link here is invented.

The links in these messages are drawn as text and go nowhere. The domains end in .example, a name reserved so that it can never be a real website.

Spot the phish: your score

1 Your score

Pass it on

2 Every message, and how to tell

3 What this could not check

How your team would do: the people most often caught are the busiest, in accounts, and the newest
Messages aimed at your company by name, which are harder to spot than these
Calls: many of these scams move to a phone call once you reply
Whether your mail system stops forged mail in your company’s name (the free email security check reads that)

Every message, sender, company and link in this quiz is invented, after the kinds of scam most reported in India. Training material and guidance, not an assessment of anyone; see the terms.

QUESTIONS

Asked often

The questions people search for before they run the check.

How can I tell if an email is a phishing email?

Look at three things before the words: the sender's actual domain (the part just before .com or .in, spelt letter by letter), where a link really goes, and whether the message pushes you to act before you can check. Then ask whether you expected it. A genuine message can usually be checked against something you already know.

What are the most common scams in India right now?

Among those most reported: tax refund messages asking for bank logins, parcels held for a small fee, bank KYC and account-block messages, electricity disconnection texts, the boss on a new WhatsApp number asking for gift cards, part-time job and task offers, and suppliers' bank details changed by email.

What should I do if I clicked a phishing link?

Do not enter anything more. If you typed a password, change it from the real site and turn on a second factor. If you shared bank or card details, call your bank on the number on your card and block them. In India, report financial fraud on the 1930 helpline or at cybercrime.gov.in, and tell your IT team.

Are the messages in this quiz real?

No. They are invented, modelled on the kinds of scam most reported in India, and mixed with ordinary genuine messages. Every sender, company and link is made up, and every domain ends in .example, a name reserved so that it can never be a real website.

Can I use this quiz to train my team?

Yes, send them the page: nothing is recorded and nobody signs up. For a session with examples from your own sector, and a simple way for staff to report a suspicious message, talk to us.

Can you spot the phish?

Phish, or genuine?

Pass it on

Asked often

One slip should not become a breach