Security Awareness Campaign

One click can cost a company everything.

Phishing is one of the most common ways attackers break into organizations — and it works by fooling people, not machines. This 5-minute interactive guide shows you how to spot it, stop it, and report it. No technical background needed.

Try the phishing simulator See the warning signs
68%
of breaches involve a human element, such as phishing or a mistake (Verizon DBIR 2024)
~21s
median time for a user to click a phishing link once the email is open — plus ~28s to enter data (Verizon DBIR 2024)
$4.8M
average cost of a breach that started with phishing, the most common entry route in 2025 (IBM Cost of a Data Breach 2025)

Figures are from the reports named above; see Sources. They change each year.

Part 1

The 6 warning signs of a phishing email

Most phishing emails give themselves away. Open each one to learn what to look for — with a real-world example.

Attackers create panic so you act before you think — warnings that your account will be closed, a payment failed, or you'll face a penalty.
⚠ “Your account will be suspended in 24 hours unless you verify immediately.”

The display name looks legit, but the actual domain is subtly wrong — a swapped letter, extra word, or public email service.
From: IT Support <support@micros0ft-helpdesk.com> ← zero instead of “o”

The visible text and the real destination don't match. Hover (or long-press) to preview the true URL before clicking anything.
Text says: office365.com → real link: http://0ffice-verify.ru/login

Mass phishing can't use your name. Real companies you deal with usually address you personally and reference specific details.
“Dear Customer,” / “Dear User,” instead of your actual name

Attachments you weren't expecting — invoices, scans, “secure documents” — can carry malware or open fake login pages.
📎 Invoice_scan.html · Payment_Details.zip

Legitimate IT and banks will never email you to “confirm your password,” MFA code, or full card number. That request is the attack.
“Reply with your username and password to keep your access active.”

Phishing isn't only email

📱 Smishing (SMS)
Fake delivery, bank or toll texts with a short link. Don't tap — open the real app or site yourself.
📞 Vishing (voice)
A caller “from IT or your bank” creates urgency. Hang up and call back on a number you already trust.
🔳 QR phishing
A QR code hides its link. Treat unexpected codes in emails, posters or parking meters like unknown links.
🤖 AI & deepfakes
AI writes flawless emails and can clone a voice or face. Typos are no longer a reliable clue — verify the request, not the polish.
Part 2 · Interactive

Spot the phish

Here's an email just like one that could land in your inbox. Click every part you think is a red flag. Find them all, then reveal the answers.

0 of 6 red flags found
    Part 3 · Interactive

    Build a password attackers can't crack

    Phishing often succeeds because the stolen password was weak and reused. Length beats complexity. Everything below runs privately in your browser — nothing is sent anywhere.

    🔍 Strength checker

    Type a sample password (never your real one) to see how it holds up.

    Waiting…

    🎲 Passphrase generator

    A random passphrase is easier to remember than random characters — its strength comes from how many truly random words it has.

    click generate →

    Store unique passphrases in a password manager so you only remember one.

    Part 4 · Interactive

    Why multi-factor authentication matters

    Even if an attacker steals your password, the right second factor stops them. Click each option to see what happens when a thief tries your stolen password.

    Password only

    One secret protects everything.

    ❌ Breached — the stolen password is all they needed.

    Password + SMS / push

    A code or “approve” prompt on your phone.

    ⚠️ Risky — codes can be phished and push prompts spammed until you tap “approve.”

    Passkey / security key

    Phishing-resistant (FIDO2).

    ✅ Blocked — the key only works on the real site, so the attacker is stuck.

    Turn on MFA everywhere it's offered. Prefer an authenticator app or a passkey over SMS — and never approve a prompt you didn't start.

    Part 5

    Think you've been phished? Report it.

    Reporting fast limits the damage — for you and everyone else. You will never be blamed for reporting, even if you clicked.

    1
    Don't interact further.
    Don't click, reply, open attachments, or enter anything. Leave the email as-is.
    2
    Report it.
    Use the “Report Phish” button in your mail app, or forward to your IT / security team.
    3
    If you already clicked, say so.
    Tell IT immediately and change your password from a device you trust. Speed beats embarrassment.

    One-click reporting

    Most organizations add a “Report Phishing” button to Outlook/Gmail. Know where yours is before you need it.

    Where to report (outside your workplace)

    • At work: use your mail app's “Report Phish” button or forward to your IT / security team.
    • Anti-Phishing Working Group: forward phishing emails to reportphishing@apwg.org.
    • US Federal Trade Commission: reportfraud.ftc.gov. Forward spam texts to 7726 (SPAM).
    • CISA: cisa.gov/report for incidents at organizations.
    Part 6 · Test yourself

    Knowledge check

    Six quick questions. Answer every one, then score yourself. Answer order is shuffled each try.

    Sources & further reading