Phishing Without Typos or Bizarre Promises: Would You Spot It?

If a “long-lost” uncle from Nigeria contacted you today with news of a million-dollar inheritance in broken English, you would probably delete the message immediately. Would you do the same with a work email from a colleague? AI-powered phishing campaigns can now convincingly imitate everyday workplace communication. Test yourself in ten different scenarios and see whether you can spot them.

A scam can look like part of your working day

Phishing is a social engineering technique used to trick you into disclosing sensitive information or taking an action that benefits the attacker. You might enter your password on a fake website, open a malicious attachment or provide your payment card details. Modern phishing no longer needs to contain typos, awkward wording or unrealistic promises.

A creative attacker will build a scenario that makes perfect sense to you. You may be expecting an invoice, working with a shared document or trying to restore access to an account. The message arrives at the right time, looks familiar and offers a simple next step. The attacker needs you to take that step before checking who is asking you to do it.

Email is only one of the possible channels. A skilled attacker can send a text message that your phone places in the same conversation as recent legitimate messages from a trusted institution. Information we voluntarily share on social media also helps attackers recreate familiar contexts and convincingly impersonate colleagues or managers.

Why recognising the warning signs is not enough

It is nine o’clock in the morning and you have just received a message from your manager. They apparently need you to review a document quickly before a meeting. The link opens a login page that looks like a company service you use every day. At the usual pace of a working day, you may not hesitate before treating the login request as routine.

The attack uses familiar psychological triggers such as authority, time pressure and the desire to help. That is why even someone who has completed security training may hesitate despite knowing the basic rules. Being able to explain phishing and recognising it during a busy working day are two very different things.

A brief pause can help whenever you receive an unexpected request. Does the message correspond to what you are currently working on? Where does the link actually lead? If someone asks for sensitive information or an unusual action, verify the request through a known contact or another communication channel. A familiar sender name or logo does not prove that a message is trustworthy.

Got you!

You clicked on something simply because it caught your attention. That is exactly what phishing attacks rely on.

Start the phishing quiz

What to expect from the phishing quiz

At Citadelo, we have created a short phishing quiz based on everyday workplace situations. You will encounter emails, mobile messages and login pages. Some are fraudulent, while others are entirely legitimate. Your task is to decide which ones you can trust.

Marking every example as a scam will not guarantee a good result. The quiz also counts false alarms as mistakes, so it tests not only caution but also your ability to distinguish an attack from legitimate communication. It takes approximately five minutes and does not require registration. If you enter your email address at the end, we will send you a certificate with your result and a practical guide to recognising phishing campaigns.

The quiz can also provide a simple way to start a discussion about employee preparedness within your organisation. Training provides the necessary foundation, but a realistic simulation shows how people and security processes respond in practice. The quiz does not replace a simulated phishing campaign, but it offers a straightforward first step.

Can you correctly assess all ten scenarios?

The quiz takes approximately five minutes and can be completed without registration.