Phishing Awareness Quiz
Security awareness training

Can you spot a phishing email?

Test your instincts with realistic scenarios.

You'll see 8 realistic emails. For each one, decide: is it a phishing attempt or a legitimate message? After each answer, you'll learn what the clues were.

Please sign in with your @springbokagency.com, @springbok.group, @joepublic.be, or @joepublic.nl Google account.
Question 1 of 8
Is this email legitimate or a phishing attempt?
0 out of 8
0
Correct
0
Missed
0%
Score

How to catch a phishing email

  • Check the sender's email address, not just the name. The display name is easy to fake — always look at the actual address behind it. Read the domain right to left: the real owner is the root domain (the part just before .com). Lookalikes add hyphens or extra words: google-accounts-verify.com is not google.com.
  • Hover before you click. The link's root domain should match the real brand, not just the text you see. A button labelled “dropbox.com” can still point somewhere else.
  • Be suspicious of urgency and fear. “Act within 24 hours” or “your account will be suspended” are pressure tactics meant to stop you thinking.
  • Watch for unexpected attachments or requests. Real services rarely send surprise PDFs or ask you to confirm passwords, card details, or identity by email.
  • Look for small slips. Odd greetings, typos (“AccounRecovery”), and inconsistent branding often give a fake away.
  • When in doubt, go direct. Don't use the email's link — type the company's address yourself or open its app to check.
  • Verify through another channel. If the email seems to come from someone you know, contact them another way — phone, text, or in person — to confirm they really sent it.