Training quiz
Spot the Scam
Ten realistic messages — some are scams, some are perfectly normal. Decide for each one, and learn the tells as you go. Nothing you answer is stored or sent anywhere.
At work, you get a call from "IT support" while notifications buzz on your phone:
Scam. Those prompts are a criminal trying to log in as you right now — your tap is the last lock on the door. Real IT never asks you to approve a sign-in you didn't start. Deny the prompts and report it through your known IT channel.
You financed a car yesterday. Today the credit-monitoring service you subscribe to sends:
Legitimate. It comes from a service you signed up for, matches something you did yesterday, and its default is "no action needed." Alerts like this are the system working — the moment to act is when one describes an inquiry you never made.
You're selling a table on Marketplace, and a buyer messages:
Scam. That code is a Google verification code — send it back and the scammer can take over an account or register services in your name, then run scams that trace back to you. No buyer needs to "verify" you with a code. The rule never bends: codes sent to your phone are for you alone.
Caller ID shows your bank's name, and the agent sounds professional:
Scam. Banks never ask you to move money to a "safe account" — that account belongs to the scammer, and caller ID is easily faked. Hang up and call the number on the back of your card; a real fraud team can freeze the account from their side.
You ask about concert tickets listed on Marketplace, and the seller replies:
Scam. The "other buyer" is a pressure prop to make you pay before thinking. E-Transfers to strangers are gone the moment they're accepted, and the tickets never arrive. Insist on an in-person exchange or the platform's verified transfer.
You receive this email:
Scam. You never placed the order — the fake charge exists to make you call. The phone line is the trap: a "refund agent" will walk you into installing remote-access software or reading out codes. Real concerns? Check your orders by going to the site directly.
After three weeks of daily chats, your new online connection messages:
Scam. This is the long-game romance-investment script: weeks of warmth first, then a "family" trading platform. The relationship is the product; the platform is fake, and withdrawals will require endless fees. Love talk that steers toward investing is the signature.
Mid-month, like every month, this email arrives:
Legitimate pattern. It matches your normal billing cycle, names no scary consequence, and doesn't push a payment link — it tells you to sign in to your own account. Even so, the safe habit applies: type the utility's address yourself rather than clicking.
You receive this email at work:
Scam. The real domain is microsoft.com — "microsoft-security.support" is a lookalike that merely CONTAINS the brand name. Suspension threats with a countdown are pressure tactics; real security alerts let you go check your account yourself.
You donated $50 on a food bank's website last night. This email arrives:
Legitimate. It follows a donation you actually made, includes a charity registration number you can verify on the CRA website, and asks for nothing more. Real charities document; fake ones pressure.
Your result
Scam-spotter! You read messages the way a security analyst does — checking who's asking, what they want, and how hard they're pushing. Keep trusting that process.
Sharp eyes. You catch most tricks — the ones that slip through tend to be the calm, patient ones. When in doubt, verify through a channel you already trust.
Getting there. You spot the obvious pressure tactics; the lookalike domains and "helpful" phone numbers are what to practice. The guides below make those second nature.
Scammers would love you — for now. The good news: the patterns repeat, and twenty minutes with the guides below genuinely changes the odds.