Free sample activity · Employees & training teams
Phishing Red Flags Practice
These fictional examples are discussion questions, not live phishing messages or simulations. They do not establish security readiness. Follow your organization's approved reporting and incident-response instructions in real situations.
6 questions · No account · No timer · Immediate feedback
Before you begin
How to use this activity
Allow five to ten minutes. No links or attachments need to be opened to complete the activity. Explain which part of each message needs verification and what known reporting route you would use.
This is a short knowledge check. For BrainFusion gameplay, explore Quiz Quest or the shared game library.
Put it into practice
Choose an answer, read the explanation, then move to the next question. Your answers stay in this page and are not saved.
An unexpected message says payroll will stop unless you use its new link immediately. What is the best first response?
Urgency and a request to act through an unexpected link are warning signs. Verify through a route you already know rather than the contact details supplied in the message.
The fictional policy says never share login verification codes. A caller claiming to be support asks you to read one aloud. What should you do?
Follow the stated rule and do not share the code. Independently contact support instead of treating the caller's claim as proof of identity.
An unfamiliar sender emails an invoice attachment you were not expecting. What is the best next step?
Unexpected attachments can be used to deliver harmful content. Verify the request through a known route before opening or spreading the attachment.
A message uses a company logo and polished writing. Which conclusion is justified?
A convincing appearance does not authenticate a message. Check the request and verify it independently rather than relying on logos or writing quality.
A message from an unknown sender asks for account details through a link. What should you do?
Do not provide account information through the unexpected request. Use the organization's reporting process so the message can be assessed.
You used a suspicious link and entered work credentials. The fictional policy says contact the help desk immediately. What follows that instruction?
Follow the stated reporting process promptly. Support can assess the situation and direct the response; hiding it or waiting delays that help.
Practice complete
Find your organization's approved suspicious-message reporting route and discuss how to contact support without using details from a suspicious message.
Review every answer and explanation below, or try the activity again.
This activity demonstrates questions and feedback. Explore Quiz Quest or the shared game library using the links above to try BrainFusion gameplay.
Keep the reasoning
All questions, answers & explanations
Use this review before or after practice. You can read and print it without JavaScript.
-
Urgency
An unexpected message says payroll will stop unless you use its new link immediately. What is the best first response?
Answer: Pause and verify through your known payroll or support route.
Urgency and a request to act through an unexpected link are warning signs. Verify through a route you already know rather than the contact details supplied in the message.
-
Verification codes
The fictional policy says never share login verification codes. A caller claiming to be support asks you to read one aloud. What should you do?
Answer: Decline and contact support through the approved route.
Follow the stated rule and do not share the code. Independently contact support instead of treating the caller's claim as proof of identity.
-
Unexpected attachment
An unfamiliar sender emails an invoice attachment you were not expecting. What is the best next step?
Answer: Verify the request through a known contact before opening it.
Unexpected attachments can be used to deliver harmful content. Verify the request through a known route before opening or spreading the attachment.
-
Professional appearance
A message uses a company logo and polished writing. Which conclusion is justified?
Answer: Appearance alone does not establish that the sender or request is genuine.
A convincing appearance does not authenticate a message. Check the request and verify it independently rather than relying on logos or writing quality.
-
Unknown sender
A message from an unknown sender asks for account details through a link. What should you do?
Answer: Avoid the link and use your approved reporting process.
Do not provide account information through the unexpected request. Use the organization's reporting process so the message can be assessed.
-
After a mistake
You used a suspicious link and entered work credentials. The fictional policy says contact the help desk immediately. What follows that instruction?
Answer: Report promptly through the approved help-desk route and follow its instructions.
Follow the stated reporting process promptly. Support can assess the situation and direct the response; hiding it or waiting delays that help.
Take it one step further
Find your organization's approved suspicious-message reporting route and discuss how to contact support without using details from a suspicious message.
Background reading
BrainFusion wrote the practice questions. These references explain background concepts; they do not endorse this activity.
Bring your own content
Make the next activity yours.
Create a BrainFusion learning game from a topic, enter your own questions, or import a question set. Review the content, choose a game format, and share it with learners in their browser.
The free plan includes a five-game limit and three one-time AI generation credits.
A few minutes of practice
Try another sample activity
Six questions, explanations, and an interactive knowledge check. No account needed.