← Awareness Hub

Spot the Phish: phishing simulator

Choose your difficulty level. Can you tell real from fake?

How the phishing simulator works

  1. Pick a level. Beginner (8 scenarios) has obvious red flags, Intermediate (8) uses subtle spoofing and plausible pretexts, Expert (6) covers adversary-in-the-middle login pages, OAuth consent abuse and deepfake pretexts.
  2. Each scenario shows a realistic message: an email, a text message, a QR code, an app consent screen, a calendar invite or a phone call script. Scenarios come in random order.
  3. Decide: PHISH or LEGIT. Most scenarios are phishing, but every level includes legitimate messages too.
  4. For a phish, tick the red flags you noticed, such as a sender domain like micros0ft-security.com with a zero in place of the letter o, then submit.

Scoring and the breakdown

A correct verdict on a phish earns 10 points, and each red flag you spot earns 5 more, even when your verdict was wrong. Correctly trusting a legitimate message earns 15; wrongly flagging one costs 5. After each answer the breakdown explains every red flag, lists the manipulation techniques used (urgency, fear, authority and others), gives an estimated NIST Phish Scale detection difficulty for phishing messages, a key takeaway and what to do when you meet such a message. At the end of a level you see your points, correct verdicts, accuracy, red flags spotted and a rank.

For the background on each attack type, from smishing to MFA bypass, read the phishing field manual.

Frequently asked questions

Is this phishing test free, and is my score stored?

It is free and needs no account. The simulator runs entirely in your browser and uses no cookies or local storage: your answers and score are not sent anywhere and are gone when you reload the page.

Can I use it for phishing awareness training at work?

Yes, as a self-paced exercise: share the link and let people play the level that fits them, Beginner for general staff, Expert for IT and security teams. It does not send simulated phishing emails to inboxes or report results to an administrator; it is a quiz, not a campaign platform.

What is the NIST Phish Scale shown after each scenario?

The NIST Phish Scale (NIST Technical Note 2276) rates how hard a phishing email is to detect. It counts the visible cues, such as a misspelled domain or an urgent tone, and judges how well the message fits the reader's work, then combines the two into Least difficult, Moderately to Least difficult, Moderately difficult or Very difficult. Each phishing scenario here shows our estimate on that scale, so you can see whether you missed an obvious lure or a genuinely hard one. The scale was designed for email; for texts, calls and consent screens the rating is applied by analogy.

Why are some of the messages legitimate?

Because real inboxes contain real password resets and invoices. Flagging everything as phishing is not a useful skill; the goal is to tell them apart, which is why a correct call on a legitimate message scores more than a correct call on a phish.

I received a suspicious link for real. How do I check it?

Do not click it. Copy the link and paste it into the phishing link checker, or paste the full headers of the email into the email header analyzer to see who really sent it. Then report it to your IT or security team.