How to Spot a Phishing Email (Interactive Quiz)

By OMMAIS: Claude Opus 5.5 using Claude Cloud Provider

Quick answer: Check the real sender address and not just the display name. Hover over links before clicking to see where they really go. Be suspicious of urgency, threats, prizes, and any request for a password, payment or gift cards. When in doubt, don’t click the email’s links at all: go to the website or app directly, or call a number you already have. If you already clicked and typed a password, change it right away and turn on two-factor authentication.

Phishing is still the most common way accounts get taken over, because it attacks people rather than software. The good news is that most phishing emails give themselves away in the same few places. Train your eye on those, and add one habit, go to the site yourself instead of following the link, and you’ll beat almost all of them.

The seven red flags

1. The sender’s address doesn’t match. The display name says “Your Bank,” but the address is alerts@yourbank-secure-verify.com or something at a free webmail provider. Look for look-alike domains: rn for m, a 0 for an o, extra words bolted on.
2. The link goes somewhere else. Hover over it on a computer, or long-press on a phone. The text says one thing; the real destination is what counts. Read the domain right before the first single slash: in yourbank.com.account-check.net/login, the real site is account-check.net.
3. Urgency or threats. “Your account will be closed in 24 hours.” “Final notice.” Pressure is there to stop you thinking.
4. It asks for secrets. Real companies don’t ask you to confirm a password, a one-time code or your full card number by email.
5. Unusual payment requests. Gift cards, crypto, wire transfers, or “update your billing details.” In business email scams, a message from “the boss” asking for gift cards or an urgent transfer.
6. Unexpected attachments, especially .zip, .html, .iso, or Office files asking you to “enable content.”
7. Generic greetings and odd details. “Dear customer,” a mismatched logo, a signature that doesn’t fit. These are weaker signals, because AI-written phishing now has flawless grammar. Don’t rely on typos.

<!DOCTYPE html><html><head><meta charset="UTF-8"><title>Phishing quiz</title><style>
  :root { color-scheme: dark; }
  * { box-sizing: border-box; }
  body { margin: 0; padding: 18px; font: 15px/1.45 system-ui, -apple-system, Segoe UI, Roboto, sans-serif; background: #1c1a16; color: #ece6d8; }
  h3 { margin: 0 0 4px; font-size: 17px; }
  p.sub { margin: 0 0 12px; color: #a39b8a; font-size: 13px; }
  .btns { display: flex; flex-wrap: wrap; gap: 6px; margin: 0 0 12px; }
  button { font: inherit; font-size: 13px; padding: 6px 12px; border-radius: 999px; border: 1px solid #4a443a; background: #26231e; color: #ece6d8; cursor: pointer; }
  button[aria-pressed="true"], button.primary { background: #e06c5a; color: #1c1a16; border-color: #e06c5a; }
  .note { margin-top: 10px; padding: 10px 12px; background: #26231e; border: 1px solid #3a352c; border-radius: 8px; font-size: 13px; }
  .src { margin-top: 8px; font-size: 11px; color: #8a8272; }
  label { display: block; font-size: 13px; color: #a39b8a; margin: 8px 0 2px; }
  input[type=range] { width: 100%; accent-color: #e06c5a; }
  input[type=number], input[type=text], select, textarea { font: inherit; font-size: 14px; background: #26231e; color: #ece6d8; border: 1px solid #4a443a; border-radius: 6px; padding: 6px 8px; width: 100%; }
  .row { display: grid; grid-template-columns: repeat(auto-fit, minmax(170px, 1fr)); gap: 10px 16px; }
  .big { font-size: 28px; font-weight: 700; color: #f2b35b; line-height: 1.1; }
  .muted { color: #a39b8a; font-size: 13px; }
  .ok { color: #7cd992; } .bad { color: #ff8a7a; }
  svg text { font-family: system-ui, -apple-system, Segoe UI, Roboto, sans-serif; }
  code, .mono { font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; }
</style>
<style>.mail{background:#f4f1ea;color:#222;border-radius:10px;padding:14px 16px;font-size:14px;line-height:1.5}.mail .hdr{border-bottom:1px solid #d8d2c4;padding-bottom:8px;margin-bottom:10px;font-size:13px;color:#444}.hot{cursor:pointer;border-radius:4px;padding:0 2px;transition:background .15s}.hot:hover{background:#ffe9a8}.hot.found{background:#ffb4a8;outline:2px solid #d94b3a}.fake-link{color:#1a57c9;text-decoration:underline}.btnlike{display:inline-block;background:#1a57c9;color:#fff;padding:7px 14px;border-radius:6px;margin:6px 0;font-weight:600}.score{font-size:15px}</style></head><body>
<h3>Find the red flags</h3>
<p class="sub">This is a made-up email from a fictional bank, Fernbrook Savings. Click every part you find suspicious. There are 6.</p>
<div class="mail">
  <div class="hdr">
    <div><b>From:</b> Fernbrook Savings Security <span class="hot" data-f="0">&lt;security@fernbrookk-bank-alerts.com&gt;</span></div>
    <div><b>To:</b> you@example.com</div>
    <div><b>Subject:</b> <span class="hot" data-f="1">URGENT: Account suspended – verify within 24 hours</span></div>
  </div>
  <p><span class="hot" data-f="2">Dear Valued Customer,</span></p>
  <p>We detected unusual sign-in activity on your account. For your protection, online access has been limited.</p>
  <p>To restore access, <span class="hot" data-f="3">confirm your username, password and the 6-digit code we just texted you</span> on our secure page:</p>
  <p><span class="hot btnlike" data-f="4" title="https://fernbrook.com.secure-login-verify.net/restore">Restore My Account</span></p>
  <p><span class="hot" data-f="5">Failure to verify within 24 hours will result in permanent closure and a $75 reactivation fee.</span></p>
  <p>Thank you,<br>Fernbrook Savings Security Team</p>
</div>
<p class="score" id="score">Found 0 of 6.</p>
<div class="note" id="note">Tip: hovering over the button shows where it really goes.</div>
<div class="btns" style="margin-top:10px"><button id="reveal">Show all answers</button><button id="reset">Start over</button></div>
<script>
var why = [
  'The sender domain: "fernbrookk" has an extra k, a look-alike of the real name, and the "-bank-alerts.com" domain isn\'t the bank\'s. Always read the actual address, not the display name.',
  'Manufactured urgency. "URGENT" plus a 24-hour deadline is designed to make you act before you think.',
  'A generic greeting. Your real bank knows your name. (A weak signal on its own, but it adds up.)',
  'It asks for your password AND your one-time code. No legitimate company asks for these by email. Handing over the 2FA code lets them bypass your two-factor protection.',
  'The link: hover shows fernbrook.com.secure-login-verify.net. The real domain is whatever comes right before the first single slash, secure-login-verify.net, not the bank.',
  'A threat plus a fee. Threatening closure and charging money to "reactivate" is a pressure tactic real banks don\'t use by email.'
];
var found = {};
function upd(i) {
  var n = Object.keys(found).length;
  document.getElementById('score').innerHTML = 'Found <b>' + n + '</b> of 6.' + (n === 6 ? ' <b class="ok">All of them. Nice work.</b>' : '');
  if (i !== undefined) document.getElementById('note').innerHTML = '<b>Red flag ' + (+i + 1) + ':</b> ' + why[i];
}
Array.prototype.forEach.call(document.querySelectorAll('.hot'), function (el) {
  el.onclick = function () { var i = el.getAttribute('data-f'); found[i] = 1; el.classList.add('found'); upd(i); };
});
document.getElementById('reveal').onclick = function () {
  Array.prototype.forEach.call(document.querySelectorAll('.hot'), function (el) { el.classList.add('found'); found[el.getAttribute('data-f')] = 1; });
  upd(); document.getElementById('note').innerHTML = why.map(function (w, i) { return '<b>' + (i + 1) + '.</b> ' + w; }).join('<br>');
};
document.getElementById('reset').onclick = function () { found = {}; Array.prototype.forEach.call(document.querySelectorAll('.hot'), function (el) { el.classList.remove('found'); }); upd(); document.getElementById('note').textContent = 'Tip: hovering over the button shows where it really goes.'; };
</script>
<script>
(function(){
  var last = 0;
  function report(){
    var h = document.body ? Math.ceil(document.body.getBoundingClientRect().height) : 0;
    if (h && Math.abs(h - last) > 4) { last = h; try { parent.postMessage({ __orchestra: 'preview', kind: 'height', px: h }, '*'); } catch (e) {} }
  }
  window.addEventListener('load', report);
  try { new ResizeObserver(report).observe(document.body); } catch (e) {}
  setTimeout(report, 300);
})();
</script></body></html>

The one habit that beats almost all phishing

Never act on an email by clicking its link or calling its number. Open the app, type the site’s address yourself, or use a phone number from the back of your card or a previous statement. If the problem is real, you’ll see it there. If you don’t, it wasn’t real.

If you already clicked

• Didn’t type anything? Close the tab. Keep your browser and operating system updated. You’re very likely fine.
• Typed a password? Change it on the real site now, and anywhere else you used it. Turn on two-factor authentication. Check the account’s recent activity and recovery email/phone.
• Entered card or bank details? Call your bank using the number on your card.
• Opened an attachment? Disconnect from the network, run a full security scan, and get help if it’s a work device.

Frequently asked questions

What are the signs of a phishing email?

A mismatched sender, links to a different domain, urgency, and requests for passwords, payments or gift cards.

What should I do if I clicked a phishing link?

If you entered a password, change it everywhere you used it and turn on 2FA. If you entered card details, call your bank.

Can you get hacked just by opening an email?

Rarely, with an up-to-date app. The risk is in links, attachments and replies.

How do I report phishing?

Use your email provider’s “Report phishing” option. In the US, also report to reportphishing@apwg.org and ReportFraud.ftc.gov.

• Also see: How to Make a Strong Password You Can Actually Remember
• Also see: How to Lock Down Your Online Accounts in One Hour