Baitaphish
Security intelligence
SearchLatest briefing
Phishing learning

Make the decision before you see the answer.

Practice with synthetic messages, then use concise guides to verify the same situations through known channels. Strong evidence is kept separate from weak heuristics.
6 decision-first exercises7 practical guidesReviewed through 2026-08-02
Interactive practice

Start with a decision

Keyboard-ready · No learner data collected

Exercise 1

Amazon refund text: decide before you tap

Evaluate a synthetic refund message using the destination, payment request, and independent account verification—not polish or grammar.

Make the call →Exercise 2

Microsoft unusual sign-in email: inspect the real destination

Decide how to handle a synthetic sign-in alert by separating a real alert pattern from a lookalike sender and domain.

Make the call →Exercise 3

Unexpected MFA prompt: approve, deny, or wait?

Practice the immediate response to an uninitiated authentication prompt without assuming what caused it.

Make the call →Exercise 4

Vendor bank-details change: stop the payment detour

Practice handling a synthetic vendor payment-change request with independent verification and dual approval.

intermediate · Finance · Procurement · Small-business operatorsMake the call →Exercise 5

OAuth consent: read the permissions before granting access

Practice denying, reporting, and recovering from a synthetic cloud application consent lure.

intermediate · SaaS users · Cloud administrators · Help deskMake the call →Exercise 6

Callback support scam: refuse remote access

Practice ending a synthetic support call, using the official IT route, and responding if remote-management software was installed.

advanced · Workforce · Help desk · Small-business operatorsMake the call →
Question-led guidance

Verify, inspect, and respond

Verify a message

Answer a real question without trusting the message itself.

Is this Amazon email or text message real?Verify Amazon delivery, refund, Prime renewal, order, and account-lock messages without trusting the message itself.Is this Microsoft unusual sign-in email phishing?Distinguish a real Microsoft sign-in alert from impersonation by checking the account’s own activity rather than trusting the email.Why did I receive a Microsoft 365 password-expiration warning?Understand Microsoft 365 password-expiration warnings and verify them without following an email link.

Inspect safely

Separate strong evidence from contextual clues.

How can I inspect a sender, link, attachment, or QR code safely?Safely evaluate sender addresses, destination domains, attachments, QR codes, and login pages without supplying sensitive data.What is MFA fatigue, and what should I do with an unexpected authentication prompt?Respond safely to unexpected MFA push notifications, authentication codes, and repeated approval requests.How can I verify a possible voice-cloning emergency call?Verify a distressed-family, executive, or urgent-payment call without treating a familiar-sounding voice as identity proof.

Respond after an action

Match the response to what was opened, entered, approved, downloaded, or paid.

What should I do after clicking a phishing link?Use a calm, evidence-based response after a suspected phishing click, credential entry, download, consent grant, or payment.