Phishing Practice

Find the problem before you click.

Review each email like it appeared in an inbox. Hover over links to inspect the destination, choose the biggest warning sign, then check your answer.

Scenario 1

Unexpected Vendor Invoice

A staff member receives this message near the end of the month. What is the strongest phishing indicator?

Past Due Invoice - Immediate Action Required

From: Accounts Payable <billing@payables-secure.example>
To: accounting@yourcompany.example
Date: Today, 8:14 AM

Hello,

Your organization has an overdue invoice. To avoid late fees and account suspension, please download the invoice and submit payment today.

Use the secure payment center below:

Review Invoice

Invoice_48219.html

Thank you,
Accounts Payable

What is the biggest warning sign?

Correct answer: suspicious HTML invoice attachment and unverified vendor domain.

HTML attachments can open fake login or payment pages. The sender domain does not match a known vendor, the message uses urgency, and there is no purchase order or normal accounting context. Verify invoices through a known vendor contact or your accounting system.

Scenario 2

Password Expiration Alert

This email appears to come from a cloud email provider. Hover over the button before deciding.

Password Expires in 2 Hours

From: Microsoft Security Team <no-reply@microsoft-alerts.example>
To: employee@yourcompany.example
Date: Today, 10:31 AM

Action required

Your mailbox password is scheduled to expire today. To keep your account active, confirm your current password settings.

Keep Same Password

If you do not complete this step, access to email may be interrupted.

Security Notification Center

What is the biggest warning sign?

Correct answer: look-alike login link plus urgency.

The sender and button URL are not official Microsoft or company domains. Password alerts should be handled by going directly to the known company portal or asking IT, not by clicking an email button.

Scenario 3

Payroll Confirmation Request

This message uses a QR code to move the employee from a work computer to a phone.

Required Payroll Confirmation

From: HR Support <benefits@employee-update.example>
To: all-staff@yourcompany.example
Date: Today, 3:48 PM

All employees must confirm direct deposit details before Friday to prevent payroll delay.

Scan the QR code and sign in with your work email.

Human Resources Support

What is the biggest warning sign?

Correct answer: QR code leading to an unknown payroll domain.

QR codes can hide the destination until after scanning, often moving the user from a protected workstation to a personal phone. Payroll changes should be handled through the official HR portal or a known HR contact.