Loading…
Loading…
The world's most common attack fits in a single message.
Phishing means sending a fake message (email, SMS, notification) that imitates a trusted organisation: your bank, a delivery company, a government service, an app you use. The goal is always the same: get you to click a booby-trapped link, open an attachment, or type your credentials into a fake login page.
It works because everything is designed to short-circuit your thinking: a pixel-perfect logo, an urgent tone (“your account will be suspended within 24h”), a sender address that is almost right. Variants keep multiplying: by SMS (smishing), by QR code (quishing), by phone call. Spotting them is a reflex you can train, which is exactly what this theme is for.
Learn how to react to an urgent bank alert received by email.
Urgent alert + a link = never use the link, go to the official site yourself.
10 exercises per level, mixing decision, spotting and quiz. The first 2 levels are free; the next ones open with any subscription.
Each level ends with a mission: what remains to be done once the lesson is understood. Some rely on your report, others on a setting we cannot see: it says so each time.
Open the latest emails from your bank and your usual delivery company. Expand the sender's full address and read the domain after the @. Write it down: a message from any other domain gets checked on the official site, not in the email.
A targeted email uses your name and reaches the right address. Look at what your scan finds on your email address: every piece of data out there can make a fake message personal, and none of it proves who sent it.
Find the official service that collects fraudulent messages in your country and save its address or number in your contacts. Next time a trap text arrives, don't reply: report it, then delete it.
Create a bookmark for your bank and one for your email, typing their address yourself. From today on, that's the only way in, never through a link you received in a message.
In your email account's security settings, open the list of signed-in devices, then the list of authorised apps. Revoke anything you don't recognise: an attacker who got in stays that way, without ever typing your password again.