First Investigation
Complete your first case.
PRIVACY NEEDLE PLAY · LEARNING RESOURCES
How to play Spot the Phishing
Choose a difficulty, read the verified case context, inspect the sender and destination, select supported warning signs, then classify the message as phishing or legitimate. A mission contains ten cases. You can read at your own pace: there is no countdown and taking longer never removes points.
Your five-step investigation
Read the verified case context
You are Amara, investigating messages for fictional Northstar. The context beneath the email records information already checked outside the message. It may establish an expected order, a known address or a payment-approval requirement.
Inspect the message
Use Inspect to see the complete sender identity. Preview the entire link destination and examine attachment metadata where present. These controls remain inside the game.
Select evidence you can support
Choose warning signs that apply to this particular case. A verified legitimate message may have none. Selecting every option does not maximise the evidence bonus.
Make the decision
Choose Phishing or Legitimate. The game records one decision for each case, awards points where applicable and displays the correct classification.
Read the explanation
Check why the answer follows from the facts, which clues were missed and whether any selected clues were unsupported. Continue through all ten cases to receive your mission report.
How scoring works
| Component | Rule |
|---|---|
| Correct decision | 10 points in Beginner, 20 in Intermediate, 30 in Expert. |
| Supported warning sign | 2 evidence points for each correctly selected sign. |
| Unsupported warning sign | Subtracts 2 from the evidence bonus, to a minimum evidence bonus of zero. |
| Legitimate message with no warnings | A correct legitimate decision with no selected signs earns 4 evidence points. |
| Consecutive correct decisions | A small streak bonus increases to a maximum of 3 points. |
| Optional time bonus | 2 points for a correct decision after 30–180 active seconds and at least two inspection types. Off by default. |
| Incorrect decision | Zero points. The explanation is still shown. |
There is no negative score for taking your time. Classification accuracy is separate from total points: selecting extra clues cannot turn an incorrect answer into a correct one.
What your training grade means
- 90–100%: Elite Cyber Investigator.
- 80–89%: Advanced Defender.
- 70–79%: Security Analyst.
- 50–69%: Junior Investigator.
- Below 50%: Needs More Training.
These are game feedback labels, not professional qualifications. The results screen also shows decisions, score, active time, strongest categories, areas to revisit and a review of every case.
Eight achievements you can earn
Phishing Spotter
Correctly identify five phishing attempts.
Perfect Ten
Finish a level with ten correct decisions.
Steady Defender
Make five correct decisions in a row.
Link Inspector
Inspect link destinations in five different cases.
Expert Defender
Finish expert level with at least 80% accuracy.
Cybersecurity Graduate
Complete all three difficulty levels.
Privacy Needle Champion
Score at least 90% in all three levels.
Keyboard, pause and progress
Use Tab and Shift+Tab to move between controls. Enter or Space activates a button, Space changes a checkbox, and Escape closes an inspection dialog. Sound is optional. You can pause an investigation and return to it; active time stops while the page is hidden or the game is paused.
With Remember progress enabled, the current mission, preferences and earned badges are stored in this browser. Switching devices or browser origins does not transfer that local record. Settings lets you clear it. Read how local progress and article requests work.