Can You Spot the Scam? Phishing & BEC Awareness Quiz

For each message, decide: is it legit, or a scam? You’ll get instant feedback explaining the tell-tale signs, then a score and rating at the end. Go with your gut — that’s the muscle you’re training.

Legit or scam?
Email
From Microsoft 365 Security <no-reply@micros0ft-secure.com>
Subject [Action required] Unusual sign-in — verify within 2 hours
We detected an unusual sign-in to your account. Your access will be suspended in 2 hours unless you re-verify your password now. Confirm your identity to keep your mailbox active.
Button links to: micros0ft-secure.com/verify-login
LegitScam
—This one was: Scam — credential harvesting
A classic phishing page designed to steal your Microsoft password. Microsoft never asks you to "re-verify" a password through an emailed link, and the deadline is there purely to make you panic.
- Look-alike sender domain — micros0ft-secure.com uses a zero, not the letter “o”.
- Manufactured urgency: a 2-hour deadline and threat of suspension.
- Link goes to a non-Microsoft domain that harvests your login.
- Legitimate providers never email you to “re-verify your password”.
Legit or scam?
Email
From Sarah Chen (CEO) <sarah.chen.ceo@gmail.com>
Subject Quick favour — are you at your desk?
I’m stuck in back-to-back meetings and can’t call. I need you to grab five $100 Apple gift cards for a client thank-you. Buy them now and send me the codes — I’ll reimburse you. Please keep this between us until it’s done.
LegitScam
—This one was: Scam — gift-card fraud
Impersonating a senior leader to pressure a staff member into buying gift cards is one of the most common Business Email Compromise (BEC) scams. Gift-card codes are untraceable and non-refundable.
- The “CEO” is emailing from a free Gmail address, not the company domain.
- Secrecy — “keep this between us” — to stop you verifying with anyone.
- Urgency plus an unusual request (gift cards) you’d never normally get.
- Payment by a method that can’t be reversed or traced.
Legit or scam?
Email
From Accounts — Bright Timber Co <accounts@brighttimber-co.com>
Subject Updated remittance details for invoice #4471
Please note our bank has recently changed. Kindly update your records and pay the outstanding invoice #4471 to our new account: BSB 062-000, Acc 1234 5678. Apologies for the short notice — payment is due today.
Your supplier’s real domain is brighttimber.com.au
LegitScam
—This one was: Scam — invoice / bank-change fraud
A textbook BEC “payment redirection” attack. An attacker (often from a compromised or look-alike account) tells you the bank details have changed so your payment lands in their account instead of the supplier’s.
- Sudden change of bank account — the single biggest BEC red flag.
- Look-alike domain: brighttimber-co.com, not the real brighttimber.com.au.
- Pressure to pay “today” before you can check.
- Always verify a bank-detail change by phoning a known contact — never a number in the email.
Legit or scam?
MFA prompt
From Microsoft Authenticator
Subject Approve sign-in?
Someone is trying to sign in to your Microsoft account. Approve or deny this request. You have received 6 of these prompts in the last 10 minutes, even though you aren’t signing in.
LegitScam
—This one was: Attack — MFA fatigue (deny it)
Repeated approval prompts you didn’t trigger mean an attacker already has your password and is spamming your phone, hoping you tap “Approve” out of habit or annoyance. Deny every one and change your password.
- You’re getting MFA prompts you never started — the attacker has your password.
- A flood of requests is designed to wear you down into approving.
- Deny, then change your password and tell IT — your credentials are compromised.
- Never approve a login you didn’t personally initiate.
Legit or scam?
Email
From IT Helpdesk <helpdesk@peritusdigital.com.au>
Subject Scheduled maintenance this Saturday, 8–10pm
Our email servers will be briefly unavailable during planned maintenance this Saturday between 8pm and 10pm. No action is needed on your part. If you have any questions, reply to this email or call the helpdesk on our usual number.
LegitScam
—This one was: Legitimate — internal notice
A normal, low-pressure internal announcement. It asks for nothing sensitive, has no links to click, and points you to a contact channel you already know. When in doubt you can still confirm on a known number.
- Sender matches your real internal domain exactly.
- No urgency, no threats, and it explicitly says “no action needed”.
- Asks for no password, payment or personal details, and has no login link.
- Offers a known way to verify — reply or call the usual helpdesk number.
Legit or scam?
SMS
From Unknown (+61 4XX XXX XXX)
AusPost: Your parcel is on hold due to an unpaid $1.85 delivery fee. Reschedule and pay within 24 hours to avoid it being returned: auspost-redelivery.info/track
LegitScam
—This one was: Scam — smishing (SMS phishing)
A “package on hold, pay a small fee” text is one of the most common smishing scams. The tiny fee makes it feel plausible, but the link leads to a fake page built to steal your card details.
- Australia Post doesn’t text payment links for a $1.85 “fee”.
- Unofficial domain (.info), not the real auspost.com.au.
- A small amount plus a 24-hour deadline to rush you into paying.
- Check any delivery yourself in the official app or website — never via a texted link.
Legit or scam?
Email
From David Okoro <d.okoro@peritusdigital.co>
Subject Confidential — urgent payment before 4pm
I’m finalising a confidential acquisition and need a supplier deposit paid before 4pm today. It’s time-sensitive, so please don’t discuss it with the team. Reply and I’ll send you the account details. Can you action this within the hour?
Your company’s real domain is peritusdigital.com.au
LegitScam
—This one was: Scam — CEO fraud / BEC
CEO impersonation for an urgent, secret wire transfer is the highest-cost form of BEC. The confidentiality request exists purely to stop you verifying with anyone who would recognise it as fake.
- Look-alike domain: peritusdigital.co, not the real peritusdigital.com.au.
- Urgency + secrecy: “before 4pm” and “don’t discuss with the team”.
- Actively discourages the verification that would expose it.
- Confirm any urgent payment in person or on a known number before acting.
Legit or scam?
Email
From Xero Billing <billing@post.xero.com>
Subject Your monthly subscription invoice is ready
Your subscription invoice for June is now available in your account. Nothing has changed since last month, and no payment action is needed if your card is up to date. Log in the usual way at xero.com to view or download it.
LegitScam
—This one was: Legitimate — expected supplier notice
A routine billing notice from a service you already use. It doesn’t change any bank details, doesn’t pressure you, and directs you to log in the usual way rather than through an embedded link. Still safest to navigate to the site yourself.
- You have an existing subscription relationship with this sender.
- No change to bank details and no request for payment out of the blue.
- No urgency or threats, and it says nothing has changed.
- Directs you to log in the normal way — always reach the site yourself, not via an email link.

0 of 8 answered

0/100

Your scam-spotting score

—

Four habits that stop most scams

Verify
Confirm money & bank changes on a known number
Any request to change bank details, pay an invoice or make an urgent transfer gets verified by phoning a known contact — never by replying to the email or calling a number it provides.
Inspect
Read the sender’s domain, character by character
Look-alike domains are the giveaway — micros0ft.com with a zero, a .co instead of .com.au, or an extra hyphen. Hover links before clicking and check where they really go.
Slow down
Treat urgency, secrecy and pressure as red flags
“Do it now”, “keep this confidential”, “before 4pm” — pressure exists to stop you checking. The more urgent and secret a request, the more it deserves a second look.
Protect
Never approve a login or enter a password you didn’t trigger
Unexpected MFA prompts mean your password is already out — deny them and reset it. And never type your password into a page you reached from an email link.

Can you spot the scam?

—

Four habits that stop most scams

One person clicking is all it takes — train your team to spot the scam.