Phishing Quiz: Test Whether You Can Spot Fake Websites and Emails (2026)

In 2007 I took McAfee SiteAdvisor’s phishing quiz, which showed pairs of real and fake websites, and scored “Safety Guru” with two wrong answers. That quiz is gone, but phishing has only grown. A good phishing quiz is still the fastest way to sharpen your instincts. Here’s where to take one in 2026 and the signs to look for.

Quick answer: Take Google’s free Phishing Quiz by Jigsaw, which shows realistic emails and asks if each is phishing or legitimate, then explains the clues. Key signs of phishing: urgent threats, mismatched sender addresses, lookalike domains, unexpected attachments and requests for passwords, OTPs or payment details.

Free phishing quizzes and tests

• Google Jigsaw Phishing Quiz: eight realistic examples with explanations.
• Your company’s security training: many employers run simulated phishing tests.
• Bank and email provider guides: often include sample scam messages.

Warning signs of phishing

• Lookalike domains: paypa1.com, amaz0n-support.net or extra words in the address.
• Mismatched links: hover over a link (or long-press on mobile) to see where it really goes.
• Urgency and fear: “your account will be closed today”.
• Requests for secrets: passwords, OTP codes or card numbers by email, text or chat.
• Unexpected attachments or QR codes asking you to log in.
• Generic greetings and odd formatting, though AI-written phishing can look polished.

How to protect yourself

1. Go to sites directly by typing the address or using a bookmark, not email links.
2. Use a password manager; it won’t autofill on fake domains.
3. Turn on two-factor authentication, ideally passkeys or an authenticator app.
4. Check suspicious sites with Google Safe Browsing status.
5. Report phishing to your email provider and the impersonated company.

Shopping online? Read our online credit card safety tips too.

FAQ

What should I do if I clicked a phishing link?

Close the page, don’t enter details, run a security scan, and change the password of any account you entered.

Can phishing come by text message?

Yes, called smishing. Fake delivery and bank alerts are common.

Do passkeys stop phishing?

They help a lot, because passkeys only work on the genuine website.