🎣
Spot the Phish
Which message should make you stop?
Choose the message carrying the strongest warning signs.
60 Second Cyber Check
What would you do?
Choose the answer you would genuinely pick. There is no login and these exercises do not ask for or store real passwords.
1. A website you just opened says: “Give me your password.”
Never give a real password to an unexpected page. Check the exact domain and why the password is being requested.
2. Your manager urgently asks for an OTP code over WhatsApp.
Urgency is a classic social-engineering technique. OTP and MFA codes are credentials too.
3. Which address deserves extra suspicion?
Attackers often use look-alike names. Read the real domain from right to left before the first slash.
4. Your laptop is encrypted by ransomware. Which preparation helps most?
A backup attackers can encrypt with the computer is not enough. Keep independent copies and test restoration.
5. A padlock/HTTPS proves a website is trustworthy.
HTTPS encrypts the connection. A fraudulent site can also have a valid HTTPS certificate.
6. A supplier emails a changed bank account for an urgent payment.
Payment-detail fraud often begins with a compromised mailbox. Verify through a trusted channel, not the contact details inside the suspicious message.
7. Your phone receives an MFA approval request you did not initiate.
Unexpected MFA prompts can mean someone already knows the password. Deny the request, secure the account and report it.
8. Which backup result proves your recovery plan works?
A successful job log is encouraging, but only a tested restore confirms that the data is usable.
9. You find an unknown USB drive outside the office.
Unknown removable media can contain malicious files or emulate a keyboard. Do not connect it to a business device.
Your score will appear here.
Training rule #1: never type a genuine password, OTP, bank detail or confidential information into a demonstration.
Interactive Lessons
Small exercises. Real-world consequences.
Each lesson runs entirely in your browser and uses fictional information.
🔗
Read That URL
Which domain actually belongs to Microsoft?
Focus on the registered domain immediately before the first slash.
💾
Backup Survival
Ransomware encrypts the laptop and its connected USB disk. What survives?
Choose the copy isolated from both the device and its credentials.