Practice
Two short exercises: six messages and eight web addresses. Decide, then read why.
The quiz needs JavaScript. Without it, the answers are shown under each message.
Phishing or fine?
- From
- Cloudbox Accounts <no-reply@cloudbox-alerts.example>
- Subject
- Unusual sign-in activity on your account
We detected a sign-in from a new device. If this was not you, verify your identity within 24 hours to avoid suspension.
Phishing. Cloudbox does not send security notices from cloudbox-alerts.example; its real domain is cloudbox.example. The deadline and the threat of suspension are pressure. Check recent sign-ins by opening your account page yourself.
- From
- Maria from Accounts <maria.koval@yourcompany.example>
- Subject
- Expense reports due Friday
Reminder: please submit this month’s expenses in the usual system by Friday. No action is needed if you have none.
Fine. The address is your company’s own domain, the request is routine, and it points to the system you already use without a link or an attachment. Nothing here asks you to bypass a normal process.
- From
- Director <ceo.office@freemail.example>
- Subject
- Are you at your desk?
I am in a meeting and cannot talk. I need you to buy gift cards for a client today and send me the codes. Keep this between us for now.
Phishing. A manager writing from a personal mailbox, asking for gift card codes and for secrecy, is the standard pattern of payment fraud. Confirm by calling the person on a number you already have.
- From
- Parcel Delivery <track@post-redelivery-fee.example>
- Subject
- Your parcel is waiting: pay a small fee
We could not deliver your parcel. Pay a redelivery fee of 1.99 to release it. The parcel will be returned in 48 hours.
Phishing. A small fee is bait for your card details. Carriers do not use domains such as post-redelivery-fee.example. If you are expecting a parcel, check its status on the carrier’s site with the tracking number you were given.
- From
- Your bank <alerts@bank.example>
- Subject
- Your monthly statement is ready
Your statement for last month is available. To view it, sign in to online banking in the app or by typing our address in your browser.
Fine. The message contains no link, asks for no details and tells you to sign in the way you always do. That is how a careful organisation writes. Signing in through the app is safe whether or not the message is real.
- From
- Shared Documents <share@docs-viewer-online.example>
- Subject
- Anna shared “Salary review 2026.xlsx” with you
Open the document to view it. You will be asked to sign in with your work email and password.
Phishing. A tempting file name, an unfamiliar sharing domain and a request to sign in with your work password together describe a credential-phishing page. Ask Anna through another channel whether she shared anything.
Real address or fake?
Each line shows who a link claims to be from and where it really goes. Northbank, QuickPost and Cloudbox are made-up companies whose real sites are northbank.example, quickpost.example and cloudbox.example.
- Claims to be
- Northbank
- Address
- https://northbank.example.account-verify.example/login
Fake. The domain is whatever stands right before the first single slash: account-verify.example. “northbank.example” here is only a label in front of it.
- Claims to be
- Northbank
- Address
- https://www.northbank.example/cards
Real. “www” is a subdomain of northbank.example. Whatever is added on the left still belongs to the owner of the domain.
- Claims to be
- QuickPost
- Address
- https://quickpost-delivery.example/track?id=4471
Fake. A hyphen makes a different domain. quickpost-delivery.example can be registered by anyone and has nothing to do with quickpost.example.
- Claims to be
- Cloudbox
- Address
- https://accounts.cloudbox.example/signin
Real. “accounts” is a subdomain; the domain is cloudbox.example.
- Claims to be
- Northbank
- Address
- https://northbank.example@198.51.100.23/secure
Fake. Everything before @ is a user name, not an address. The browser goes to 198.51.100.23.
- Claims to be
- Cloudbox
- Address
- https://cl0udbox.example/reset
Fake. A zero stands in for the letter o. Look-alike characters are the oldest trick there is.
- Claims to be
- Cloudbox
- Address
- https://cloudbox.example/shared/login.northbank.example
Real. Anything after the first single slash is a path on the site and can say whatever it likes. The domain is cloudbox.example.
- Claims to be
- Northbank
- Address
- https://nоrthbank.example/login
Fake. The second letter is a Cyrillic “о”, so this is a different domain. A password manager would refuse to fill your password here, which is one more reason to use one.