FREE CYBERSECURITY PRACTICE

Spot the Phishing: a free phishing awareness game

A phishing awareness game gives you a safe place to practise deciding which messages to trust. Spot the Phishing presents 30 fictional emails, with 15 phishing attempts and 15 legitimate messages across three difficulty levels. Inspect the evidence, make a decision and read the explanation. It is free to play in your browser and requires no account.

Opening the investigation desk. You can also read the rules or compare explained examples.

What is a phishing awareness game?

The point is to practise a repeatable decision: does this request match something you independently know? A phishing attempt might ask for a recovery code, a new payment beneficiary or permission to read all your email. A legitimate notification might sound urgent, but its details match a service or task you already verified.

Thirty investigations. Three levels. Two possible answers.

BEGINNER

Start with everyday messages

Work through bank alerts, parcel notifications, password resets and ordinary account messages. Ten cases include five attacks and five legitimate emails.

INTERMEDIATE

Follow the workplace context

Investigate executive requests, supplier changes, attachments and unexpected MFA prompts. Existing business procedures become part of the evidence.

EXPERT

Examine subtler requests

Check targeted event invitations, app permissions, session secrets and verified incident notices. Accurate personal details and fluent writing do not settle the answer.

All three levels are available immediately. Each contains ten cases, and the order changes when you start a new mission. Read the complete rules and scoring guide.

What you can practise

Compare a complete sender address with an independently known contact.

Read the full hostname behind a link without opening it.

Inspect an attachment’s final extension and the task it supposedly supports.

Protect passwords, recovery codes, authentication approvals and session tokens.

Question a payment change or a request to skip normal approval.

Recognise when a message is legitimate because independent checks support it.

The game supports keyboard controls, text-based inspection and optional sound. Progress can be saved locally on the same browser. A training grade measures performance in these scripted cases; it is not a professional certification.

Start with an example

A fictional bank says your account will be suspended in 30 minutes and asks for your password and one-time code at an unfamiliar address. In this case, the secret request and destination mismatch establish the danger. The deadline supports the concern, but urgency alone is not proof.

Now compare a parcel notification that matches an order you placed and a delivery status independently confirmed in the carrier app. The decision is different because the verified facts are different.

Questions before you play

Is Spot the Phishing free?

Yes. You can play all 30 cases without registration, payment or an email address.

Can a simulated email open a dangerous website?

No. The game’s inspection controls show text within the simulation. All scenario destinations use reserved example domains, and attachment inspection never downloads or executes a file.

How many phishing and legitimate messages are there?

There are 15 of each. Every difficulty contains five phishing attempts and five legitimate messages.

Does the timer penalise slow reading?

No. There is no countdown or time penalty. A small optional time bonus is off by default; accuracy is based on correct classifications.

Does the game tell whether an email was written by AI?

No. Writing style does not reliably establish authorship. The game teaches you to judge the request and the independently verified context.

Can I use this for a group learning session?

You can open the free browser game and discuss the explanations as a group. This release has no classroom roster, organisation dashboard, certificate or centrally stored learner results.