Training quiz
Spot the Scam
Ten realistic messages — some are scams, some are perfectly normal. Decide for each one, and learn the tells as you go. Nothing you answer is stored or sent anywhere.
A website you clicked from search results shows a popup:
Scam. Browsers update themselves from inside the app — no real update ever arrives as a download link on a random website. That file is malware. Close the tab; if you're unsure, check for updates from your browser's own menu.
Your internet provider emails, a month ahead:
Legitimate. Nobody enjoys a price increase, but the shape is honest: a month's notice, no link you must click, no deadline, and any changes happen inside the account you already have. Scams offer to "lock in your old price" through a form that takes your card.
You're selling a laptop online, and an out-of-town "buyer" messages:
Scam. Sellers receive money; they don't pay it. The "courier booking page" is a card-harvesting site, and both the pickup and the reimbursement are fiction. Any deal that requires the SELLER to pay a third party first is a script — insist on in-person exchange.
After a quick chat-only "interview" for a remote job, this email arrives:
Scam. The cheque is counterfeit: it will bounce days after the money you sent the "supplier" is gone, and the bank takes the full amount back out of your account. Real employers ship equipment or reimburse receipts — they never route company money through a new hire.
At work, an email arrives from a supplier you actually use:
Scam. "Our banking details have changed" is the signature of business email compromise — the invoice may be real, but the new account belongs to the fraudster. Verify any banking change by phoning your contact at a number you already have, never one from the email.
You're selling a table on Marketplace, and a buyer messages:
Scam. That code is a Google verification code — send it back and the scammer can take over an account or register services in your name, then run scams that trace back to you. No buyer needs to "verify" you with a code. The rule never bends: codes sent to your phone are for you alone.
You just reloaded your coffee shop app at the counter, and this email arrives:
Legitimate. It arrived seconds after a purchase you made in person, the amount matches, and it asks for nothing. Receipts for things you actually bought are background noise — the scam version invents a purchase and adds a number to call.
Your car insurance renews soon, and the insurer emails:
Legitimate. It matches a policy you actually hold, changes nothing about how you pay, and leaves you to fetch documents from the account you already use. The fraudulent twin claims your payment FAILED and pushes a link to "avoid losing coverage."
At work, you get a call from "IT support" while notifications buzz on your phone:
Scam. Those prompts are a criminal trying to log in as you right now — your tap is the last lock on the door. Real IT never asks you to approve a sign-in you didn't start. Deny the prompts and report it through your known IT channel.
A stranger's account DMs you on Instagram:
Scam. Mass-sent intimidation counts on panic, not real material — and paying never ends it; it marks you as someone who pays. Don't reply, keep screenshots as evidence, block and report. If you're a minor or images are real, tell the police and cybertip.ca.
Your result
Scam-spotter! You read messages the way a security analyst does — checking who's asking, what they want, and how hard they're pushing. Keep trusting that process.
Sharp eyes. You catch most tricks — the ones that slip through tend to be the calm, patient ones. When in doubt, verify through a channel you already trust.
Getting there. You spot the obvious pressure tactics; the lookalike domains and "helpful" phone numbers are what to practice. The guides below make those second nature.
Scammers would love you — for now. The good news: the patterns repeat, and twenty minutes with the guides below genuinely changes the odds.