Security Awareness Training

KNOW YOUR
ENEMY

Phishing attacks account for over 90% of successful cyberattacks. Learn to recognize, resist, and report them before they compromise your organization.

0
Billion Phishing Emails / Day
0
% Attacks Start w/ Phishing
0
Seconds Between New Phishing Sites
⚡ Try Interactive Demo 📋 Take the Quiz
Interactive Demo

Spot the Red Flags

Click on any underlined element in the email below to learn why it's a warning sign. Can you find all 6 red flags?

Social Engineering

How Attackers Manipulate You

Phishing isn't just technical — it exploits fundamental human psychology. Understanding these tactics is your first line of defense.

⚡
Urgency & Scarcity
Attackers create artificial time pressure — "Your account will be deleted in 24 hours" — bypassing rational thinking and pushing you to act before you check.
Fear of Loss Time Pressure FOMO
👔
Authority Impersonation
Emails appear to come from the CEO, IT department, IRS, or a major bank. People are conditioned to comply with authority figures without questioning them.
CEO Fraud Brand Spoofing Gov Impers.
🎣
Spear Phishing
Highly targeted attacks using personal details scraped from LinkedIn, social media, or previous breaches. The email seems to know who you are, building false trust.
OSINT Personalization Whaling
🤝
Reciprocity & Trust
Attackers offer something valuable — a free gift, helpful information, a document you "requested" — before asking for something in return, exploiting natural social reciprocity.
Pretexting Trojan Free Offers
😱
Fear & Intimidation
"We have your browsing history." "Pay now or face legal action." Extortion-style phishing hijacks your fight-or-flight response, clouding critical thinking.
Sextortion Ransomware Blackmail
🔗
URL Obfuscation
Lookalike domains (paypa1.com, g00gle.com), URL shorteners, or trusted redirect services mask malicious destinations. Even tech-savvy users can be fooled at a glance.
Typosquatting IDN Homograph Redirects
Case Studies

Real-World Attack Patterns

Study these annotated examples from actual phishing campaigns. Hover over highlighted text to see the warning signs.

Banking Credential Harvest
Critical
From: alerts@chase-secure-banking.com
Subject: ⚠ Important: Verify Your Identity to Avoid Account Suspension
Dear Chase Customer,

Your account requires immediate verification. We have detected suspicious login attempts and your account access has been restricted.

Please click here to verify: http://secure-chase-verify.ru/login within 12 hours.
  • 1Domain "chase-secure-banking.com" is NOT chase.com — legitimate banks use their primary domain
  • 2The link points to a .ru (Russia) domain — Chase would never use this
  • 3Vague threat of "suspicious activity" without specifics is a hallmark tactic
  • 412-hour deadline creates artificial urgency to prevent careful verification
IT Help Desk Credential Theft
Critical
From: IT-Support@your-company-helpdesk.com
Subject: Action Required: Your Password Expires in 24 Hours
Hi [Employee],

Your network password will expire today. To avoid disruption, reply with your current password and we will extend it for 90 days. Alternatively, reset it via the link below.

Reset Now: http://bit.ly/3xK9pQ2
  • 1Legitimate IT will NEVER ask for your password via email — this alone is a definitive red flag
  • 2URL shorteners hide the true destination; always hover before clicking
  • 3Generic greeting [Employee] instead of your actual name
  • 4Domain "your-company-helpdesk.com" is external, not your company's actual domain
Package Delivery Scam
High
From: delivery-notification@fedex-tracking-update.com
Subject: 📦 Your Package is On Hold — $2.99 Fee Required
Your package #FX-48291-US could not be delivered due to an unpaid customs fee.

Pay $2.99 to release your package: www.fedex-customs-payment.net/pay

Failure to pay within 48 hours will result in package return.
  • 1FedEx official domain is fedex.com — any variation is fraudulent
  • 2Small fee requests ($2.99) are used to harvest credit card details, not just the amount
  • 3If you're not expecting a package, this is almost certainly a scam
  • 4Verify by visiting fedex.com directly and entering any tracking number provided
Fake Job Offer / Advance Fee Fraud
High
From: hr-recruiting@linkedin-jobs-global.com
Subject: Exclusive Opportunity: $8,500/week — Work From Home
Congratulations! Your profile was selected for a premium remote position.

To proceed, please pay a $75 background check fee and provide your Social Security Number, bank details, and passport scan to complete onboarding.
  • 1Legitimate employers never charge candidates for background checks
  • 2$8,500/week for unspecified "remote work" is unrealistically high — a classic lure
  • 3Requesting SSN, bank details, and passport scan before employment is identity theft
  • 4LinkedIn communicates from @linkedin.com, never third-party domains
Defense Strategies

Your Phishing Defense Playbook

Adopt these security habits to dramatically reduce your risk of becoming a phishing victim.

01
🔐
Enable Multi-Factor Authentication
MFA blocks 99.9% of credential-based attacks. Even if attackers steal your password, they cannot access your account without the second factor.
Critical Defense
02
🔍
Verify Sender Addresses
Hover over the sender's name to reveal the actual email address. Check for subtle misspellings, extra words, or wrong domain extensions.
First Check
03
🔗
Hover Before You Click
Always hover over links to preview the destination URL. Navigate directly to websites by typing the address rather than clicking email links.
Essential Habit
04
📞
Verify Out-of-Band
If an email claims to be from your bank or a colleague requesting action, verify via a separate channel — call their known number, don't use contact info in the email.
Trust Nothing
05
🛡️
Use a Password Manager
Password managers auto-fill credentials only on the correct domain. They won't fill your password on a fake site, providing a powerful anti-phishing layer.
Smart Defense
06
📧
Report Suspicious Emails
Use your email client's "Report Phishing" button. Reporting helps protect your entire organization and trains filtering systems to catch future attacks.
Protect Others
07
🔄
Keep Software Updated
Phishing links often exploit browser and OS vulnerabilities. Enable automatic updates to close security gaps that attackers rely on.
Patch Often
08
🧠
Pause Before Reacting
Urgency is an attacker's primary weapon. Take a breath. A real emergency never requires you to bypass security measures or act without verifying.
Stay Calm
Knowledge Assessment

Test Your Awareness

10 questions. Score above 80% to earn your Certificate of Completion.

🎯
Ready for the Challenge?
Test your phishing awareness with 10 questions. The timer only starts once you begin — so read the rules first.
Your Full Name * (appears on certificate)
⚠ Please enter your name to continue
❓ 10 multiple-choice questions
⏱ 30 seconds per question
🏆 Score ≥80% to earn a certificate
💾 Results saved automatically
0
out of 10
0
Correct
0
Wrong
0%
Score
— Verified & Issued
🏆
✦ Achievement Unlocked ✦
Congratulations!
0
Correct
0%
Score
0
Missed
Certification Authority

Verify a Certificate

Enter a Certificate ID to instantly verify its authenticity. All certificates issued by PhishGuard are stored and verifiable.

Format: CERT-YYYY-NNNN  ·  IDs are case-insensitive