Phish or Legit

How to play Phish or Legit

Ten messages arrive: emails, texts, calls and pop-ups. Decide whether each is a phishing attempt or a legitimate message. After every answer you see the detail that gives it away.

A correct answer scores 10 XP, a perfect run adds 20, and each wrong answer costs a heart.

The signs of a phishing message

• The sender is slightly wrong. A lookalike domain, a free webmail address in an executive’s name, or a letter swapped for a digit.
• It creates pressure. A deadline, a threat of losing access, or a request to keep it quiet.
• It asks for something valuable. A password, a one-time code, a payment or changed bank details.
• The link or file does not match. A shortened link, a sign-in page on an unfamiliar address, or an attachment ending in .exe.

What to do instead

Do not use the link or number in the message. Open the app or site yourself, or call a number you already have. For any change of bank details, confirm by phone before paying. Report suspicious messages to whoever looks after IT, because the same message has usually reached your colleagues too.

Legitimate messages exist, and treating everything as an attack slows work down. The technology guides cover security basics for small teams.