Skip to content

Spot the phish

Can you tell a fake email from a real one? Look at 8 emails, pick phishing or safe for each, and see the clues behind every answer. It takes about five minutes.

Every company and address here is fictional. Nothing you answer is stored or sent to GlobeVM.

Email 1 of 8

Score so far: 0

Email 1: Your package is on hold: unpaid fee of $1.99

From
Parcel Notice Center <notices@parcel-notices.example>
To
you@yourcompany.example
Received
8:14 AM

We tried to deliver your package today but a customs fee of $1.99 is unpaid.

Pay within 24 hours or the package will be returned to the sender.

Phishing or safe?

Five checks before you click

  1. Read the full sender address, not just the name. Watch for free email services and domains that are one letter or hyphen off.
  2. Check the real link destination. Hover on a computer or long-press on a phone. The part that matters is the domain right before the first single slash.
  3. Notice pressure. Deadlines, threats, secrecy and "are you at your desk?" are there to stop you thinking.
  4. Treat money and password requests as suspect, especially gift cards and new bank details. Confirm them by phone using a number you already have.
  5. Report it, don't just delete it. If one person got it, others did too.

These match the warning signs in CISA's guide to recognizing and reporting phishing (opens in a new tab). Attackers also use AI now, so perfect spelling and grammar are no longer a sign that an email is real.

Our security awareness training turns these checks into habits with short lessons and practice emails, and our email security service catches phishing before it reaches inboxes. Want to see if attackers could fake your own domain? Try the fake-domain check.

Questions about the phishing quiz

Are these real phishing emails?

No. Every email, company, person and web address in the quiz is made up, and the domains use .example, which is reserved and can never be a real website. They're built from the patterns real attacks use: fake delivery fees, boss gift-card requests, fake file shares, lookalike domains and supplier bank changes.

Can I use this quiz to train my team?

Yes. Send them the link; it needs no sign-up and nothing is recorded. It's a good conversation starter, but it isn't a full training program. Regular practice phishing emails and short lessons work better over time.

What's the single best habit for spotting phishing?

Check where a message really comes from and where its links really go, before you act. Look at the sender's full address, hover over or long-press links to see the real destination, and confirm any request for money, gift cards or passwords using a phone number you already have.

What should I do if I already clicked a phishing link?

Tell your IT team or provider right away. If you typed a password, change it from a device you trust and make sure multi-factor sign-in is on. If you shared payment details, call your bank. Reporting quickly matters more than feeling embarrassed.

Train your team on real-world phishing

Get a free IT assessment. We look at your email protection and how your team handles suspicious messages, then give you a plain-English plan.

Get a free IT assessmentCall (818) 405-9930