Phishing & email fraud
Messages that impersonate someone you trust to get a click, a credential or a payment.
Phishing remains the way most intrusions begin, and it works on capable people having a busy day — not on careless ones. The skill is recognising the shape of the request, not spotting a typo.
Would you get these right?
Real items, not examples written for a brochure — these are the same 24 questions the games draw on for this topic. Answer one and see what a player sees.
Our records show your mailbox has exceeded its storage quota. Sign in within 4 hours to keep your account active. Failure to verify will result in permanent deletion of your messages.
This is a credential harvest. The giveaway is not the wording, which is fine — it is that an outside domain is asking you to sign in under a deadline. Your own IT department never needs you to re-enter a password to stop something being deleted.
RememberSign in from your bookmark, never from a link in a message that is rushing you.
micros0ft-support.com
asking you to sign in
A zero in place of the letter o. Lookalike domains are cheap to register and read as correct at a glance, which is exactly what they are for.
RememberRead the domain right to left: the bit before the final slash is what matters.
A link that looks right in the text of the email
Hover first — the visible text and the real address differ
Hover first — the visible text and the real address differ
The words in a link are decoration. The destination is set separately, and the two have nothing to do with each other.
RememberThe text of a link is not the link.
7 games carry this topic
The same material, in whichever game your people will actually open. That is the whole design: the lesson is content, so it is not tied to one set of rules.
Threat & Defence Match
Match every risk to the habit that beats it.
Link each risk to the habit that defeats it, so the defence comes to mind with the threat.
Cyber Hygiene Run
Dodge the risky habit. Pick up the safe one.
Build the reflex to take the secure option and step around the risky one, at speed.
Spot the Threat
Judge it in the two seconds you actually get.
Tell a hostile message from a genuine one in the two seconds you actually get.
Threat Range
Report the threats. Let real mail through.
Judge before you act: report the real threats and leave legitimate messages alone.
Phishing Triage
Report it, bin it, or trust it.
Decide what to do with a suspicious message in the seconds you really have, and know why.
Security Scenarios
What would you actually do?
Choose the right response to the security situations that actually come up at work.
Cyber Tambola
Dab the control that stops the call.
Know which control stops which attack, and know when a threat is not yours to act on.