Spot the Phish

Nice catch.Not quite. Phish — a classic credential-harvesting email.

1. The sender’s domain is m365-account-security.com, not microsoft.com. Anyone can register a name like that.
2. “Dear user” — a real system notice from your own company would usually use your name.
3. A two-hour deadline is there to rush you past thinking.
4. “Keep my current password” isn’t a real Microsoft option. The button leads to a fake sign-in page that captures your password — and often your MFA code too.

Nice catch.Not quite. Legit — this one’s safe.

1. You were expecting it: you placed the order yesterday.
2. It comes from the carrier’s real domain (ups.com), not a look-alike.
3. It asks for nothing — no payment, no sign-in, no “redelivery fee” — and points you to the app or site you already use.

Nice catch.Not quite. Phish — the “CEO gift card” scam.

1. An unknown number claiming to be your boss. Scammers pull names and titles from LinkedIn and your website.
2. “Can’t talk” stops you from calling to check — which is exactly what you should do.
3. Gift cards are untraceable cash. No legitimate business pays clients this way.
4. Secrecy is a red flag on its own. Verify any unusual money request by calling the person on a number you already have.

Nice catch.Not quite. Phish — business email compromise (BEC).

1. Look closely: your real vendor uses pacificcoastsupply.com. This is pacificcoast-supply.co — one hyphen and a missing letter.
2. Bank changes by email are the single most expensive scam businesses face. Always confirm by phone, using a number you already had.
3. Pressure to pay today, with a late fee as the threat.
4. “Don’t call” is the giveaway: they need you to avoid the one step that would catch them.

Nice catch.Not quite. Legit — you asked for this code.

1. You just signed in, so a code arriving now is expected.
2. It doesn’t ask you to reply, click anything or share the code with anyone.
3. Rule of thumb: a code you requested is fine to type into the sign-in screen you’re on. Never read it to anyone or text it back.

Nice catch.Not quite. Phish — fake document share.

1. A generic e-signature-sounding domain, not the real service and not your company.
2. A file name designed to make anyone curious. Were you expecting a bonus schedule from Kristen?
3. Being asked to sign in with your work account just to view a file is the trap: the page steals your password. Check with the sender another way first.

Nice catch.Not quite. Phish — the fake delivery text.

1. A random personal number. Delivery notices you signed up for come from short codes or the carrier’s app.
2. A tight deadline to make you act before you think.
3. The link ends in .top — it isn’t usps.com. These pages ask for a small “redelivery fee” to steal card details.

Nice catch.Not quite. Phish — the attacker already has your password and needs your MFA code.

1. Your IT team will never text you from a personal number asking for anything.
2. Nobody legitimate ever needs your verification code. If someone asks for it, your password is probably already stolen — change it and call IT.
3. Urgency again. Real IT work can wait five minutes while you call to check.

Nice catch.Not quite. Legit — you asked for this.

1. You requested the reset a moment ago, so this email is expected.
2. It comes from Zoom’s real domain (zoom.us).
3. No pressure: if you didn’t ask for it, it tells you to simply ignore it. Rule of thumb — a reset email you didn’t request is a warning sign; one you did is fine.

Nice catch.Not quite. Phish — “quishing” (QR-code phishing).

1. A benefits notice from an unfamiliar outside domain — not the HR team or benefits portal you already use.
2. A threat of losing coverage to make you hurry.
3. QR codes hide where they lead and move you to your phone, outside your company’s email and web protection. If a QR code asks you to sign in, stop and check.

Nice catch.Not quite. Phish — a “ClickFix” fake fix that gets you to run malware yourself.

1. docusign-securemail.net isn’t DocuSign’s domain (docusign.net / docusign.com).
2. No real website or document service ever asks you to press Windows + R and paste anything. The “verification code” is a command that downloads malware — and because you ran it yourself, it slips past many protections.
3. A one-hour deadline is there to rush you.

Nice catch.Not quite. Phish — a fake help desk “vishing” call over Teams.

1. The notice itself is real Teams email — but the chat is from an External account, not your own IT team. Attackers create look-alike “help desk” accounts in their own Microsoft tenant.
2. They often send a burst of spam first, then “help” fix it. Asking you to accept a Quick Assist or other remote-control request hands them your computer.
3. If someone contacts you claiming to be IT, hang up and call your help desk on the number you already know.