Learning track 03 · about 5 minutes
Phishing
Challenge
Work through five common phishing decisions across email, QR codes, sign-in pages and unexpected MFA prompts.
Start this trackView all learning tracks →Phishing Challenge
Make the call
Payment needed today
[email protected]To: You · Today, 9:41 AM
Hi, I’m between meetings. Please arrange this payment before 10 AM.
$8,450.00
New supplier · Updated bank details
▤ Invoice_1048.pdf 142 KBPlease use the new account below. No time for a call — confirm once sent.
Review payment detailsScenario 1 of 5 · Check identity
A familiar display name
An email says it is from your finance director. Which detail best verifies who actually sent it?
Select an answer to continue.
Display names, logos and tone are easy to copy. Inspect the full address and verify unusual requests separately.
Remember: a familiar display name is not proof of identity.
Action required: reset your password
[email protected]To: You · Today, 9:41 AM
Your password expires today. Reset it to keep access to your work email.
Reset passwordhttps://signin-update.invalid/reset
Scenario 2 of 5 · Check destination
The button and link disagree
A password-reset button points to an unrelated hostname when inspected. What is the safest action?
Select an answer to continue.
Navigate using a trusted bookmark or known address. Do not use the suspicious message to verify itself.
Remember: reach important services through a known route.
Approve sign-in?
Work account
Browser · WindowsRequest received just now
Are you trying to sign in?
Scenario 3 of 5 · Protect MFA
An unexpected approval prompt
Your authenticator asks you to approve a sign-in you did not start. What should you do?
Select an answer to continue.
An unexpected MFA request may mean someone already has the password. Deny it and use the official recovery process.
Remember: never approve an authentication request you did not initiate.
Scan to keep your account active
[email protected]To: You · Today, 9:41 AM
Use your phone to scan this code and confirm your work account.
https://mobile-verify.invalid/login
Scenario 4 of 5 · Question the QR
A code moves you to your phone
A poster’s QR code asks for your work credentials on a mobile page. What is the safest response?
Select an answer to continue.
QR codes hide the destination until after scanning. Use the organisation’s known app or manually entered address.
Remember: treat QR destinations like any other untrusted link.
Sign in
Your sign-in could not be completed. Try again.
Scenario 5 of 5 · Recover quickly
Credentials were submitted
You entered a password, then noticed the site was fake. What is the strongest immediate response?
Select an answer to continue.
Use a trusted route to secure the account and contact security. Other sessions, tokens or reused passwords may also need review.
Remember: act through the real service and report without delay.
Challenge complete
You read the signals.
This-device leaderboard
Your best attempts
Names and scores stay in this browser. A secure cohort leaderboard can be added with the future training platform.
Keep learning