Phishing Awareness Training: Spot the Fake Email

Your path

11 steps · 2 quizzes · about 50 minutes · open any step, or read it here

1. 1
   Phishing awareness training: learn to spot the fake emailStart hereIn this phishing awareness training you learn to spot a fake email before it costs you anything. You practise on realistic messages: you decide first, then see the tells that gave each one away.InteractiveHands-on · 4 min

   Read this step

   In this phishing awareness training you learn to spot a fake email before it costs you anything. You practise on realistic messages: you decide first, then see the tells that gave each one away.

   Phishing is the most reported kind of cybercrime: the FBI's Internet Crime Complaint Center received 193,407 complaints about phishing and spoofing in 2024, more than any other category. It works on careful people too, because it is built to catch you when you're busy.

   Try it: press Show the first tell and go through all four.

   Interactive · Four tells in one email — try it in the lesson

   In this lesson you'll:

   • check who really sent an email, and read where a link really goes
   • name the pressure tricks and the requests that should always make you stop
   • sort an inbox of eight emails, then handle texts, calls and QR codes
   • know exactly what to do in the minutes after a click

   It takes about 50 minutes, with a quiz in the middle and one at the end.

   Takeaway: one tell is enough reason to stop and check.

2. 2
   What phishing is: a message that wants you to act before you thinkPhishing is a message that pretends to come from someone you trust so that you do something for the attacker: type a password, open a file, pay an invoice, read out a code.InteractiveHands-on · 4 min

   Read this step

   Phishing is a message that pretends to come from someone you trust so that you do something for the attacker: type a password, open a file, pay an invoice, read out a code. Email is the most common channel, but the same trick arrives by text, phone call, chat and QR code.

   Most phishing follows the same chain. Each stage needs the one before it, so breaking any single stage stops the attack.

   Try it: press Play the attack, then press each stage to see how it can be broken.

   Interactive · How one click becomes a stolen account — try it in the lesson

   Notice that the attacker never "hacks" anything. Every stage depends on a person taking an action. That is why this training is about habits, not technology.

   Takeaway: phishing needs you to act. The earlier you stop, the less there is to undo.

3. 3
   Check the sender: the domain, not the display nameAn email has two parts in its From line: a display name ("Dana Cohen", "IT Service Desk") and an address (dana.cohen@larkfield.com). The display name is free text: anyone can type any name. Many mail apps, and most phones, show only the name.InteractiveHands-on · 4 min

   Read this step

   An email has two parts in its From line: a display name ("Dana Cohen", "IT Service Desk") and an address (dana.cohen@larkfield.com). The display name is free text: anyone can type any name. Many mail apps, and most phones, show only the name.

   The part that matters is the domain, everything after the @. Read it to its very end and ask: is it exactly the domain I expect? Lookalikes swap letters (rn for m, 1 for l), add words (larkfield-payroll.com) or put your company's name in front of their own domain (larkfield.com.billing-dept.net, which belongs to billing-dept.net).

   Try it: turn on Show the full addresses, then judge each sender.

   Interactive · Real sender or lookalike? — try it in the lesson

   A real domain is not a guarantee. Addresses can be forged, and a colleague's real account can be taken over. So a correct sender is where checking starts, not where it ends: the request still has to make sense.

   Takeaway: tap or hover on the name to see the full address, and read the domain to its end.

4. 4
   Read the link before you press itA link's words and its address are two different things. "Open the document" can go anywhere. To see the address, hold the pointer over the link (on a computer) or press and hold it (on a phone); the address appears at the bottom of the window or in a preview.InteractiveHands-on · 4 min

   Read this step

   A link's words and its address are two different things. "Open the document" can go anywhere. To see the address, hold the pointer over the link (on a computer) or press and hold it (on a phone); the address appears at the bottom of the window or in a preview.

   Then read the host, the part between :// and the next /, from the right:

   1. The last two parts are the domain: secure-login.net in larkfield.com.secure-login.net. A few countries use three, like larkfield.co.uk.
   2. Everything to the left of the domain was chosen by whoever owns it, so larkfield.com. in front proves nothing.
   3. Anything before an @ in the host is thrown away: www.larkfield.com@account-check.io goes to account-check.io.
   4. A bare number like 203.0.113.42 instead of a name is a reason to stop.

   Try it: press each link, then type one of your own.

   Interactive · Where does this link really go? — try it in the lesson

   A padlock in the address bar only means the connection is encrypted. Phishing sites have padlocks too.

   Takeaway: the domain is at the right end of the host. If it isn't the one you expect, don't press.

5. 5
   Pressure: fear, deadlines, secrecy and rewardsPhishing gives you a reason to hurry, because people who hurry don't check. The levers are always the same: Fear: "Final notice", "unusual activity on your account". A deadline: "within 24 hours", "before 3:00 PM today".InteractiveHands-on · 4 min

   Read this step

   Phishing gives you a reason to hurry, because people who hurry don't check. The levers are always the same:

   • Fear: "Final notice", "unusual activity on your account".
   • A deadline: "within 24 hours", "before 3:00 PM today".
   • A threat: "or your account will be suspended".
   • Secrecy: "keep this between us", "don't discuss it with anyone".
   • A reward: "you've been selected", a refund, a prize, a discount.

   None of them proves an email is fake. Real companies set deadlines too. But each one is a signal to slow down, and two or three together in one message almost never happen in honest email.

   Try it: press every phrase that pushes you to act before you think, then check your picks.

   Interactive · Find the pressure — try it in the lesson

   Takeaway: when a message makes you feel rushed, that feeling is the tell. Slow down on purpose.

6. 6
   Requests that break the usual processThe most expensive phishing doesn't need a link at all. It simply asks for something outside the normal way of working: buy gift cards, change a supplier's bank details, approve a sign-in, enable a file's macros, reply with a password.InteractiveHands-on · 4 min

   Read this step

   The most expensive phishing doesn't need a link at all. It simply asks for something outside the normal way of working: buy gift cards, change a supplier's bank details, approve a sign-in, enable a file's macros, reply with a password.

   This is how business email compromise works: the attacker poses as a manager or a supplier and asks for money. In 2024 the FBI received 21,442 complaints about it, with reported losses of about 2.77 billion US dollars.

   The defence is a rule, not a judgement call: when a message asks for money, a password, a code or an approval, verify it through a different channel, using contact details you already have, never the ones in the message.

   Try it: decide whether each request is normal or a red flag.

   Interactive · Normal request or red flag? — try it in the lesson

   Takeaway: an unusual request is checked by phone or in person, on a number you already have.

7. Check: senders, links and pressureFour questions on what you've seen so far.Quiz · 4 questions

   Read the questions

   Four questions on what you've seen so far.

   Question 1. An email from "Dana Cohen" comes from dana.cohen@larkfie1d.com. Your company's domain is larkfield.com. What is it?

   • Dana's personal address
   • A lookalike domain: the l is the digit 1
   • A safe address, because the name matches
   • A new domain IT has set up

   Question 2. Where does `https://larkfield.com.secure-login.net/reset` go?

   • larkfield.com
   • secure-login.net
   • login.net
   • It can't be told from the address

   Question 3. The link has a padlock in the address bar. What does that tell you?

   • The site belongs to the company it names
   • The site has been checked for phishing
   • Only that the connection is encrypted
   • That your company's IT approved it

   Question 4. Your CEO's name emails you: "Buy gift cards for a client today and keep this between us." What do you do?

   • Buy them, it's the CEO
   • Reply to the email to ask if it's real
   • Don't act; check with the CEO on a number or chat you already have, and report it
   • Forward it to your team to warn them
8. 7
   Sort the inboxTime to use everything at once. This inbox has eight emails. Some are real, some are phishing, and one phishing email comes from your company's real domain.InteractiveHands-on · 3 min

   Read this step

   Time to use everything at once. This inbox has eight emails. Some are real, some are phishing, and one phishing email comes from your company's real domain.

   For each one: check the sender's domain, read the link, notice the pressure and ask whether the request is normal. Then decide. After each decision the tells are marked in the email.

   Try it: open each email and decide.

   Interactive · Sort the inbox — try it in the lesson

   Which one was hardest? Usually it's the email from IT's real address. It shows why the request matters more than the sender: no one legitimate asks for your password, whatever address they write from.

   Takeaway: sender, link, pressure, request. Four checks, a few seconds each.

9. 8
   Beyond email: texts, calls and QR codesThe same trick works on any channel, and each has its own name: Smishing is phishing by text message. Texts show no sender domain and short links hide where they go. Vishing is phishing by voice.InteractiveHands-on · 4 min

   Read this step

   The same trick works on any channel, and each has its own name:

   • Smishing is phishing by text message. Texts show no sender domain and short links hide where they go.
   • Vishing is phishing by voice. The caller is friendly and urgent, and often asks you to read out a code.
   • Quishing is phishing by QR code: a sticker over a real code, or a code in an email, leading to a fake page.
   • MFA fatigue is a stream of sign-in approval requests from someone who already has your password, hoping you'll press Approve to make it stop.

   The answer is the same each time: don't use the contact or the link the message gives you. Open the app yourself, call the number you already have, and never share a one-time code with anyone.

   Try it: pick each kind, work out what's wrong, then show the tell.

   Interactive · Phishing beyond email — try it in the lesson

   Takeaway: a code sent to your phone is for you alone. No real colleague, bank or IT team ever asks for it.

10. 9
    You clicked. What now?Anyone can be caught, including security staff. What matters is the next few minutes. The worst reaction is to say nothing out of embarrassment: an attacker with your password can read your mail and send phishing to your colleagues from your real account.InteractiveHands-on · 4 min

    Read this step

    Anyone can be caught, including security staff. What matters is the next few minutes. The worst reaction is to say nothing out of embarrassment: an attacker with your password can read your mail and send phishing to your colleagues from your real account.

    Try it: you typed your password on a fake page. Build your plan, in order.

    Interactive · You clicked: build your plan — try it in the lesson

    Your company's way to report is the one to use: often a Report or Report phishing button in the mail app, or a security address. Reporting a phishing email you did NOT click is just as useful: it lets IT remove it from everyone else's inbox.

    Takeaway: stop, report, change the password, watch. Report even when you're not sure.