Cyber security · Free tool

Can you spot the scam?

”Phishing

For each message, decide: is it legit, or a scam? You'll get instant feedback explaining the tell-tale signs, then a score and rating at the end. Go with your gut — that's the muscle you're training.

Legit or scam?
Email
From Microsoft 365 Security <no-reply@micros0ft-secure.com>
Subject [Action required] Unusual sign-in — verify within 2 hours
We detected an unusual sign-in to your account. Your access will be suspended in 2 hours unless you re-verify your password now. Confirm your identity to keep your mailbox active.
Button links to: micros0ft-secure.com/verify-login
LegitScam
—This one was: Scam — credential harvesting
A classic phishing page designed to steal your Microsoft password. Microsoft never asks you to "re-verify" a password through an emailed link, and the deadline is there purely to make you panic.
- Look-alike sender domain — micros0ft-secure.com uses a zero, not the letter "o".
- Manufactured urgency: a 2-hour deadline and threat of suspension.
- Link goes to a non-Microsoft domain that harvests your login.
- Legitimate providers never email you to "re-verify your password".
Legit or scam?
Email
From Sarah Chen (CEO) <sarah.chen.ceo@gmail.com>
Subject Quick favour — are you at your desk?
I’m stuck in back-to-back meetings and can’t call. I need you to grab five $100 Apple gift cards for a client thank-you. Buy them now and send me the codes — I’ll reimburse you. Please keep this between us until it’s done.
LegitScam
—This one was: Scam — gift-card fraud
Impersonating a senior leader to pressure a staff member into buying gift cards is one of the most common Business Email Compromise (BEC) scams. Gift-card codes are untraceable and non-refundable.
- The "CEO" is emailing from a free Gmail address, not the company domain.
- Secrecy — "keep this between us" — to stop you verifying with anyone.
- Urgency plus an unusual request (gift cards) you’d never normally get.
- Payment by a method that can’t be reversed or traced.
Legit or scam?
Email
From Accounts — Bright Timber Co <accounts@brighttimber-co.com>
Subject Updated remittance details for invoice #4471
Please note our bank has recently changed. Kindly update your records and pay the outstanding invoice #4471 to our new account: BSB 062-000, Acc 1234 5678. Apologies for the short notice — payment is due today.
Your supplier’s real domain is brighttimber.com.au
LegitScam
—This one was: Scam — invoice / bank-change fraud
A textbook BEC "payment redirection" attack. An attacker (often from a compromised or look-alike account) tells you the bank details have changed so your payment lands in their account instead of the supplier’s.
- Sudden change of bank account — the single biggest BEC red flag.
- Look-alike domain: brighttimber-co.com, not the real brighttimber.com.au.
- Pressure to pay "today" before you can check.
- Always verify a bank-detail change by phoning a known contact — never a number in the email.
Legit or scam?
MFA prompt
From Microsoft Authenticator
Subject Approve sign-in?
Someone is trying to sign in to your Microsoft account. Approve or deny this request. You have received 6 of these prompts in the last 10 minutes, even though you aren’t signing in.
LegitScam
—This one was: Attack — MFA fatigue (deny it)
Repeated approval prompts you didn’t trigger mean an attacker already has your password and is spamming your phone, hoping you tap "Approve" out of habit or annoyance. Deny every one and change your password.
- You’re getting MFA prompts you never started — the attacker has your password.
- A flood of requests is designed to wear you down into approving.
- Deny, then change your password and tell IT — your credentials are compromised.
- Never approve a login you didn’t personally initiate.
Legit or scam?
Email
From IT Helpdesk <helpdesk@peritusdigital.com.au>
Subject Scheduled maintenance this Saturday, 8–10pm
Our email servers will be briefly unavailable during planned maintenance this Saturday between 8pm and 10pm. No action is needed on your part. If you have any questions, reply to this email or call the helpdesk on our usual number.
LegitScam
—This one was: Legitimate — internal notice
A normal, low-pressure internal announcement. It asks for nothing sensitive, has no links to click, and points you to a contact channel you already know. When in doubt you can still confirm on a known number.
- Sender matches your real internal domain exactly.
- No urgency, no threats, and it explicitly says "no action needed".
- Asks for no password, payment or personal details, and has no login link.
- Offers a known way to verify — reply or call the usual helpdesk number.
Legit or scam?
SMS
From Unknown (+61 4XX XXX XXX)
AusPost: Your parcel is on hold due to an unpaid $1.85 delivery fee. Reschedule and pay within 24 hours to avoid it being returned: auspost-redelivery.info/track
LegitScam
—This one was: Scam — smishing (SMS phishing)
A "package on hold, pay a small fee" text is one of the most common smishing scams. The tiny fee makes it feel plausible, but the link leads to a fake page built to steal your card details.
- Australia Post doesn’t text payment links for a $1.85 "fee".
- Unofficial domain (.info), not the real auspost.com.au.
- A small amount plus a 24-hour deadline to rush you into paying.
- Check any delivery yourself in the official app or website — never via a texted link.
Legit or scam?
Email
From David Okoro <d.okoro@peritusdigital.co>
Subject Confidential — urgent payment before 4pm
I’m finalising a confidential acquisition and need a supplier deposit paid before 4pm today. It’s time-sensitive, so please don’t discuss it with the team. Reply and I’ll send you the account details. Can you action this within the hour?
Your company’s real domain is peritusdigital.com.au
LegitScam
—This one was: Scam — CEO fraud / BEC
CEO impersonation for an urgent, secret wire transfer is the highest-cost form of BEC. The confidentiality request exists purely to stop you verifying with anyone who would recognise it as fake.
- Look-alike domain: peritusdigital.co, not the real peritusdigital.com.au.
- Urgency + secrecy: "before 4pm" and "don’t discuss with the team".
- Actively discourages the verification that would expose it.
- Confirm any urgent payment in person or on a known number before acting.
Legit or scam?
Email
From Xero Billing <billing@post.xero.com>
Subject Your monthly subscription invoice is ready
Your subscription invoice for June is now available in your account. Nothing has changed since last month, and no payment action is needed if your card is up to date. Log in the usual way at xero.com to view or download it.
LegitScam
—This one was: Legitimate — expected supplier notice
A routine billing notice from a service you already use. It doesn’t change any bank details, doesn’t pressure you, and directs you to log in the usual way rather than through an embedded link. Still safest to navigate to the site yourself.
- You have an existing subscription relationship with this sender.
- No change to bank details and no request for payment out of the blue.
- No urgency or threats, and it says nothing has changed.
- Directs you to log in the normal way — always reach the site yourself, not via an email link.
Legit or scam?
Email
From Microsoft 365 Account Team <no-reply@microsoft-365-alerts.net>
Subject Your password expires in 24 hours — update now to avoid lockout
Your Microsoft 365 password is set to expire in 24 hours. To prevent loss of access to your email and files, please update your password immediately by clicking the link below. If you do not act, your account will be suspended.
Button links to: microsoft-365-alerts.net/update-password
LegitScam
—This one was: Scam — password-expiry credential phish
Password-expiry emails are a favourite phishing tactic because they create a credible, time-sensitive reason to click. Microsoft sends genuine password-change prompts through your organisation’s own IT systems — never from a third-party domain like microsoft-365-alerts.net.
- Sender domain is microsoft-365-alerts.net — not a Microsoft domain.
- 24-hour deadline creates panic designed to stop you thinking clearly.
- Link goes to the same fake domain, not login.microsoftonline.com.
- Legitimate password-expiry prompts appear inside Windows or via your organisation’s own IT systems, not random email links.
Legit or scam?
Email
From OneDrive Sharing <no-reply@onedrive-share.co>
Subject James Nguyen shared a file with you: "Q3 Financial Report.xlsx"
James Nguyen (james.nguyen@yourcompany.com.au) has shared a file with you on OneDrive. Click below to view the document: "Q3 Financial Report.xlsx". This link will expire in 48 hours.
Open link goes to: onedrive-share.co/view/q3-financial-report
LegitScam
—This one was: Scam — shared-document credential phish
Fake shared-document emails are extremely effective because they mimic a normal workflow. Clicking leads to a fake Microsoft login page that harvests your credentials. Real OneDrive share notifications come from no-reply@microsoft.com and link to onedrive.live.com or sharepoint.com.
- Sender domain onedrive-share.co is not a Microsoft domain.
- Link goes to onedrive-share.co, not sharepoint.com or onedrive.live.com.
- Real OneDrive share emails come from no-reply@microsoft.com with links to sharepoint.com.
- Verify unexpected file shares by contacting the sender directly on a known channel.
Legit or scam?
Email
From Australian Taxation Office <refunds@ato-govau.net>
Subject You have a pending tax refund of $1,842.00 — claim within 7 days
Our records show you are entitled to a tax refund of $1,842.00 for the 2024–25 financial year. To process your refund, you must verify your myGov account and provide your bank details via the secure link below. Refunds not claimed within 7 days will be cancelled.
Link goes to: ato-govau.net/refund-claim
LegitScam
—This one was: Scam — ATO / myGov impersonation
The ATO never sends refunds via email links asking for bank details. Genuine tax refunds are processed automatically into the bank account registered in your myGov profile — you are never emailed to "claim" one. The domain ato-govau.net has no affiliation with the Australian Government.
- The ATO does not email links asking you to enter bank details to receive a refund.
- Domain ato-govau.net is not the real ato.gov.au.
- 7-day deadline to create urgency — a hallmark of scams.
- Check any ATO correspondence by logging directly into myGov at my.gov.au, not via any email link.
Legit or scam?
Email
From Emily Parker <eparker.finance@gmail.com>
Subject Update my bank account for this month’s pay please
Hi, I’ve recently switched banks and need to update my pay details before the next payroll run. My new BSB is 733-127 and account number is 2254 8819. Can you update this before Friday? I’m travelling this week so hard to reach by phone. Thanks, Emily.
The real Emily Parker emails from eparker@yourcompany.com.au
LegitScam
—This one was: Scam — payroll-diversion BEC
Payroll-diversion fraud is a growing BEC threat. An attacker posing as an employee asks payroll to change their bank details so the next pay cheque lands in the attacker’s account. The "travelling and hard to reach" line is designed to block the phone-verification step that would expose it.
- Request comes from a Gmail address, not the employee’s work email.
- "Hard to reach by phone" deliberately prevents the verification call.
- Urgency — "before Friday" — to rush the change through before anyone checks.
- Always verify bank-detail changes by calling the employee on a known number before updating payroll.
Legit or scam?
Printed notice (photo forwarded by email)
From Colleague via email — "Found this on my car"
Subject FW: Parking infringement notice — urgent
A colleague has forwarded you a photo of a notice left on their car in your office car park. It reads: "PARKING INFRINGEMENT — You are required to pay a $68 parking fee within 48 hours to avoid a $340 fine. Scan the QR code below to pay." The QR code is printed prominently on the notice.
Scanning the QR code opens: parking-fines-payment.info/pay
LegitScam
—This one was: Scam — QR-code phishing (quishing)
QR-code phishing (quishing) is increasingly used because QR codes hide the destination URL until you’ve already scanned them. This fake infringement notice sends victims to a payment page designed to steal card details. Legitimate council parking fines in Australia arrive by post with an official reference number — not QR codes left on windscreens.
- QR code hides the real URL — scanned link goes to a non-government domain.
- Official parking fines arrive by post with a council reference — not a QR code on a windscreen.
- 48-hour deadline with a 5x penalty creates panic.
- Never pay a fine via a QR code. Look up the issuing authority yourself on its official website.
Legit or scam?
Email
From Microsoft Security Alert <security-alert@microsoftsupport-au.com>
Subject URGENT: Suspicious activity detected — call us immediately
We have detected suspicious login activity on your Microsoft account from an unknown location. Your account access has been temporarily restricted. To restore your access, you must call our security helpdesk immediately on 1800 XXX XXX (available 24/7). Do not attempt to log in until you have spoken with an agent.
LegitScam
—This one was: Scam — callback phishing (vishing)
This is a callback phishing attack. Instead of a malicious link, the goal is to get you on the phone with a fake "Microsoft agent" who will then talk you into installing remote-access software or handing over your credentials. Microsoft does not proactively call or email you asking you to ring a helpdesk number.
- Sender domain microsoftsupport-au.com is not Microsoft.
- Microsoft never emails you asking you to call a helpdesk number to unblock your account.
- "Do not attempt to log in" is designed to stop you discovering your account is actually fine.
- If worried about account access, go directly to account.microsoft.com yourself.
Legit or scam?
Email
From IT Support <it-support@peritusdigtal.com.au>
Subject Action required — remote security patch (today only)
Our systems have flagged your workstation as missing a critical security update. To apply the patch remotely, please download and run AnyDesk, then send us the 9-digit session code shown on screen. This is time-sensitive — unpatched machines will be blocked from the network at 5pm today.
Your company’s real IT support domain is peritusdigital.com.au
LegitScam
—This one was: Scam — fake IT helpdesk / remote-access fraud
Legitimate IT teams apply patches silently in the background — they do not email you asking you to install remote-access software and hand over a session code. Giving an attacker that code grants them full control of your screen and everything on it.
- Typo in the sender domain: peritusdigtal.com.au (missing an "i").
- Real IT teams push patches automatically — they never ask you to install remote-access tools.
- "Blocked from the network at 5pm" is manufactured urgency to skip verification.
- Call your IT team on a known number to verify any remote-access request before complying.
Legit or scam?
Email
From Sarah Williams — Talent Acquisition <sarah.williams@talentpro-au.net>
Subject Exciting opportunity — Senior IT Manager role, $130–150k + super
Hi, I came across your profile and think you’d be a strong fit for a Senior IT Manager role with one of our Hunter Valley clients. I’ve attached a full position description for your review. The role closes Friday, so please have a look and let me know if you’d like to chat this week.
Email has an attachment: "IT Manager PD April 2025.pdf.exe"
LegitScam
—This one was: Scam — job-offer lure with malicious attachment
The attachment is the payload. The double extension .pdf.exe is a classic trick — Windows hides known extensions by default, so it looks like a PDF but is actually an executable that installs malware when opened. Unsolicited job offers with attachments from unknown recruiters are a common malware delivery method.
- Attachment is .pdf.exe — a double extension used to disguise malware as a document.
- Unsolicited outreach with an immediate attachment from an unknown recruiter.
- "Role closes Friday" is urgency designed to make you open the file without thinking.
- Never open attachments from unexpected contacts. Verify recruiters exist on LinkedIn before engaging.
Legit or scam?
Email
From Norton Billing <billing@norton-renewals-au.com>
Subject Your Norton 360 subscription has been auto-renewed — $299.95 charged
Thank you for your continued subscription. Your annual Norton 360 plan has been automatically renewed and $299.95 has been charged to your card ending in 4821. If you did not authorise this charge or wish to cancel, you must call our billing team on 1800 XXX XXX within 24 hours for a full refund.
LegitScam
—This one was: Scam — fake subscription renewal (refund bait)
This is a refund-bait scam. The large, surprising "charge" provokes you into calling the number, where a fake agent will ask for your bank details "to process the refund" — and steal them instead. Norton and most software companies do not email you a helpline number to call for refunds.
- Sender domain norton-renewals-au.com is not norton.com.
- Large unexpected charge plus a phone number to call — classic refund-bait structure.
- 24-hour deadline to call or "lose" the refund drives urgency.
- Check any software subscription in your actual account portal. Do not call numbers in unexpected billing emails.
Legit or scam?
SMS
From Unknown (+61 4XX XXX XXX)
CBA Alert: Your NetBank card has been temporarily locked due to unusual activity. To restore access, verify your identity: commbank-secure-id.com/verify. Ref: #CB2841
LegitScam
—This one was: Scam — smishing (fake bank card-lock alert)
A fake bank "card locked" text is one of the most common smishing scams in Australia. Commonwealth Bank texts about genuine account issues will not send you to a third-party domain and will never ask you to log in via a texted link. The fake login page harvests your NetBank credentials.
- Commonwealth Bank texts always link to commbank.com.au — not commbank-secure-id.com.
- Comes from a mobile number, not the bank’s official SMS sender ID ("CommBank").
- Reference number gives a false sense of legitimacy.
- If worried about your card, call the number on the back of it or log in directly via the CommBank app.
Legit or scam?
SMS
From Toll Group SMS (unknown number)
TOLL: Your shipment (TN8834421AU) could not be delivered. A $3.50 customs clearance fee must be paid within 48 hours or the parcel will be returned. Pay now: toll-parcel-fee.net/pay
LegitScam
—This one was: Scam — smishing (fake courier redelivery fee)
Courier-fee smishing follows the same playbook as the AusPost variant: a small, plausible fee sent by SMS with a link to a fake page that steals your card details. Toll Group does not charge "customs clearance fees" via SMS links — any genuine customs charge would be handled through the shipper or Australian Border Force.
- Domain toll-parcel-fee.net is not the real tollgroup.com.
- Toll does not send payment links for customs fees via SMS from unknown numbers.
- 48-hour deadline and threat of return to create urgency.
- Track any parcel directly through the carrier’s official app or website, not via a texted link.
Legit or scam?
Email
From myGov Account Services <noreply@mygov-au-secure.com>
Subject Your myGov account has been suspended — action required within 48 hours
We have detected multiple failed login attempts on your myGov account. As a security precaution, your access has been temporarily suspended. To restore your account and prevent permanent deactivation, please click the link below and verify your identity within 48 hours.
Verification link goes to: mygov-au-secure.com/verify-account
LegitScam
—This one was: Scam — myGov impersonation phishing
The real myGov is accessed at my.gov.au — not mygov-au-secure.com. The government never emails you with a link to "restore" your myGov account after a suspension. This page would harvest your myGov credentials and potentially your ATO, Centrelink or Medicare details.
- Sender domain mygov-au-secure.com is not the real my.gov.au.
- 48-hour deadline with threat of "permanent deactivation" to create panic.
- The government does not email links to restore suspended myGov accounts.
- Access myGov only by going directly to my.gov.au in your browser — never via an email link.
Legit or scam?
Email
From DocuSign Notifications <dse_NA3@docusign-portal.net>
Subject Please review and sign: "Supplier Agreement — Peritus Digital"
A new document has been sent to you for your signature. Document: Supplier Agreement — Peritus Digital. Sent by: accounts@brighttimber.com.au. Please review and sign the document by clicking the button below. This request will expire in 72 hours.
Sign button links to: docusign-portal.net/d/view?token=a8f3kq
LegitScam
—This one was: Scam — DocuSign credential-harvesting phish
DocuSign is heavily mimicked by attackers. Legitimate DocuSign notifications always come from @docusign.net and all signing links go to app.docusign.com. This one routes through docusign-portal.net, which is a fake login page designed to steal credentials.
- Sender domain docusign-portal.net is not DocuSign’s real domain (docusign.net).
- Sign link goes to docusign-portal.net, not app.docusign.com.
- Real DocuSign emails come from @docusign.net and links go to app.docusign.com.
- If unsure, contact the document sender directly to confirm they sent a DocuSign request.
Legit or scam?
Email
From Accounts Receivable — Officeworks Business <ar@officeworksbusiness.com.au>
Subject Your account statement for June 2025 — no payment action required
Please find attached your monthly account statement for June 2025. Your account is up to date and no payment is due at this time. If you have any questions, please contact your account manager via the details at the top of the statement, or call 1300 XXX XXX.
Attachment: Statement_June2025_AcctXXXX.pdf (193 KB)
LegitScam
—This one was: Legitimate — expected monthly account statement
A routine monthly statement from an existing supplier relationship. It requests no action, changes no bank details, and offers a known phone number for verification. The domain matches the sender you expect and the attachment is a named PDF — not an executable.
- Sender domain matches the expected supplier — officeworksbusiness.com.au.
- No request for payment, no change of bank details, no urgency.
- Offers a direct phone number to verify queries.
- Attachment is a clearly named PDF with a reasonable file size — not an executable.
Legit or scam?
Email
From Microsoft Teams <noreply@email.teams.microsoft.com>
Subject Invitation: Quarterly security review — Thu 14 Aug, 10:00am
Mark Thompson has invited you to a Teams meeting. Topic: Quarterly security review. Date: Thursday 14 August, 10:00am–11:00am AEST. Join using your usual Teams app or calendar. No password, no software download required — just accept the calendar invitation.
Join link goes to: teams.microsoft.com/l/meetup-join/…
LegitScam
—This one was: Legitimate — genuine Teams calendar invitation
This is a standard Teams meeting invitation from Microsoft’s real email domain. The join link goes to teams.microsoft.com, no credentials are requested, and the meeting was expected. The sender matches Microsoft’s genuine Teams notification address.
- Sender email.teams.microsoft.com is Microsoft’s legitimate Teams notification domain.
- Join link goes to teams.microsoft.com — not a look-alike domain.
- No request for credentials, payment or personal information.
- The meeting is expected and contextually makes sense.
Legit or scam?
Email
From Microsoft Teams <no-reply@ms-teams-notifications.com>
Subject You have 3 unread messages from your IT Manager
You have 3 unread messages waiting in Microsoft Teams from your IT Manager. Your Teams session has expired and you must re-authenticate to view your messages. Click below to sign in and see what’s waiting for you.
Sign in button links to: ms-teams-notifications.com/auth
LegitScam
—This one was: Scam — fake Teams notification credential phish
Teams sends notification emails from microsoft.com domains, and re-authentication always happens within the Teams app itself — not via an emailed link to a third-party site. The vague "3 unread messages from your IT Manager" is designed to create curiosity and urgency.
- Sender domain ms-teams-notifications.com is not a Microsoft domain.
- Teams never asks you to re-authenticate via an emailed link to a third-party site.
- Vague "messages from your IT Manager" uses curiosity to override caution.
- If you think you have unread Teams messages, open the Teams app directly.
Legit or scam?
SMS
From Linkt (unknown number)
LINKT: You have an outstanding e-TAG balance of $14.20 on your account. Failure to pay within 48 hours may result in additional fees and suspension of your account. Pay now: linkt-account-au.net/pay
LegitScam
—This one was: Scam — smishing (fake Linkt / e-TAG balance)
Linkt communicates via the official Linkt app and email to your registered address — not via SMS links to third-party payment pages. The domain linkt-account-au.net has no affiliation with Transurban or Linkt, and clicking would lead to a card-skimming page.
- Domain linkt-account-au.net is not the real linkt.com.au.
- Linkt does not send payment links via SMS from unknown mobile numbers.
- 48-hour deadline and threat of account suspension to create urgency.
- Log in to Linkt directly at linkt.com.au or via the app to check your genuine balance.
Legit or scam?
Email
From James Okafor <j.okafor@brighttimber.com.au>
Subject RE: RE: Invoice #4471 — payment update
Following up on our earlier thread about invoice #4471. Just a quick note — we’ve updated our banking details effective this month. Please use the new account for this payment: BSB 013-255, Acc 8872 3301. Cheers, James.
This email appears mid-thread in an existing invoice chain you recognise. The sender domain is the real brighttimber.com.au, but the email headers show it was sent via a mail relay in Eastern Europe.
LegitScam
—This one was: Scam — thread-hijack BEC (email chain compromise)
Thread-hijack BEC is particularly dangerous because the attacker has compromised a real inbox and is inserting into a genuine email chain with the correct domain. The only tell-tale signs are an unexpected bank-detail change mid-thread and — for the technically minded — anomalous mail headers. Always call a known contact to verify any change, regardless of how the email looks.
- Mid-thread bank-detail change is the single biggest BEC red flag, even from a "legitimate" sender.
- The sender’s mailbox may have been compromised — a real domain is no guarantee of authenticity.
- Call James on a number you already have to confirm the change before making the payment.
- No legitimate supplier will be offended by a verification call — it’s standard practice.
Legit or scam?
Email
From ASIC Business Registry <renewals@asic-registry-au.com>
Subject URGENT: Your company registration expires in 7 days — renew now
Your company registration with the Australian Securities and Investments Commission (ASIC) is due to expire in 7 days. Failure to renew on time may result in your company being deregistered and your ABN cancelled. Click below to renew your registration and avoid deregistration.
Renewal link goes to: asic-registry-au.com/renew
LegitScam
—This one was: Scam — fake ASIC company-registration renewal
ASIC sends genuine renewal notices from @asic.gov.au and all official correspondence links to asic.gov.au. The domain asic-registry-au.com is a fake designed to charge fraudulent "renewal fees" and potentially steal your business credentials. Company renewal notices arrive well in advance, not with a 7-day emergency.
- Sender domain asic-registry-au.com is not the real asic.gov.au.
- ASIC sends renewal notices from @asic.gov.au with links to asic.gov.au — not third-party domains.
- 7-day deadline with deregistration threat to create panic.
- Log into ASIC Connect directly at connectonline.asic.gov.au to check your real renewal date.
Legit or scam?
Email
From Microsoft Licensing <licensing@microsoft-365-renewal.com>
Subject Your Microsoft 365 Business licence expires in 3 days — action required
Your Microsoft 365 Business Standard subscription for 15 users is due to expire in 3 days. If your licence lapses, your team will lose access to Outlook, Teams, Word, Excel and SharePoint. To avoid disruption, renew your subscription immediately via the link below.
Renew link goes to: microsoft-365-renewal.com/checkout
LegitScam
—This one was: Scam — fake Microsoft licence-renewal phish
Microsoft licence renewals happen through your Microsoft 365 Admin Centre or via your reseller — never via a third-party domain like microsoft-365-renewal.com. This page is designed to collect payment card details and potentially Microsoft admin credentials.
- Sender domain microsoft-365-renewal.com is not a Microsoft domain.
- Microsoft sends licence notices from microsoft.com and links to admin.microsoft.com.
- 3-day deadline with threat of losing access to all Microsoft apps creates panic.
- Log into your Microsoft 365 Admin Centre directly at admin.microsoft.com to check your real licence status.
Legit or scam?
Email
From Meta Business Suite <noreply@meta-business-support.net>
Subject Your Facebook Business Page has been restricted — appeal within 24 hours
We have detected activity on your Facebook Business Page that violates our Community Standards. Your page has been temporarily restricted and will be permanently disabled within 24 hours unless you submit an appeal. Click below to review the violation and appeal the decision.
Appeal link goes to: meta-business-support.net/appeal
LegitScam
—This one was: Scam — fake Meta / Facebook page-restriction phish
Facebook page-restriction phishing is extremely common and preys on business owners who depend on their page for customers. Real Meta communications come from @facebookmail.com or @metamail.com and link to facebook.com or business.facebook.com — never to meta-business-support.net.
- Sender domain meta-business-support.net is not a Meta domain.
- Real Meta notices link to facebook.com or business.facebook.com, not third-party sites.
- 24-hour deadline and threat of permanent disabling drives urgency.
- Check your page status by logging directly into Facebook Business Manager.
Legit or scam?
Email
From HR Systems Administrator <hr-systems@yourcompany-hronline.net>
Subject Action required: Re-authenticate your HR portal access by Friday
We are upgrading our HR and payroll portal to a new system. All employees must re-authenticate their access before Friday 5pm to avoid loss of access to payslips, leave requests and personal records. Click the link below to verify your credentials and transfer your account to the new system.
Your company HR portal is actually at hr.yourcompany.com.au
LegitScam
—This one was: Scam — fake internal HR-system upgrade credential phish
Fake "system upgrade" emails that demand re-authentication are a common phishing vector. They exploit the fact that employees expect system migrations and are accustomed to IT asking them to log in. The tell is the non-company domain and the threat of losing access to payslips.
- Sender domain yourcompany-hronline.net is not your company domain.
- Genuine system migrations are communicated by IT through official channels, not emailed credential-collection links.
- Threat of losing payslip access is designed to make you act without thinking.
- Verify any "system upgrade" by calling IT or checking your company intranet before clicking.
Legit or scam?
Email
From Australian Federal Police — Cybercrime Division <cybercrime@afp-gov-au.org>
Subject NOTICE: Your IP address has been linked to illegal online activity
This is an official notice from the Australian Federal Police Cybercrime Division. Your IP address has been flagged in connection with the distribution of prohibited material. You are required to contact our Cybercrime helpdesk within 48 hours on 1300 XXX XXX to avoid formal charges being laid. Failure to respond will result in immediate escalation.
LegitScam
—This one was: Scam — government-impersonation legal-threat scam
The AFP does not send cold emails threatening prosecution and asking you to call a helpdesk. This is a fear-and-urgency scam designed to trick victims into calling, at which point the "agent" will demand payment of a fake fine or extract personal information. The domain afp-gov-au.org is not the real afp.gov.au.
- Domain afp-gov-au.org is not the real Australian Federal Police domain (afp.gov.au).
- Law enforcement does not threaten prosecution via cold email and ask you to call a helpline.
- 48-hour ultimatum with threat of criminal charges is pure intimidation.
- If you have a genuine legal concern, contact the AFP only via afp.gov.au or 131 237.
Legit or scam?
Email
From Dropbox <no-reply@dropbox-share.net>
Subject Rachel Thompson shared "2025 Budget Final.xlsx" with you
Rachel Thompson has shared a file with you using Dropbox. File: 2025 Budget Final.xlsx. Click "Open" to view this file. You may need to sign in with your Dropbox or work email to access it.
Open link goes to: dropbox-share.net/file/view?id=xk92m
LegitScam
—This one was: Scam — fake Dropbox file-share credential phish
Like the OneDrive variant, fake cloud-share notifications are effective because they mimic routine workflows. The link goes to a credential-harvesting page designed to look like a Dropbox or Microsoft login. Real Dropbox notifications come from @dropbox.com and link to dropbox.com — not dropbox-share.net.
- Sender domain dropbox-share.net is not dropbox.com.
- Dropbox share links always go to dropbox.com — not third-party domains.
- If you expect a file from Rachel, ask her to resend or share via your company’s known file-sharing system.
- Verify unexpected file shares by contacting the sender through a known channel first.
Legit or scam?
Email
From Invoice Processing <accounts@premiersupply-au.com>
Subject Invoice #INV-28841 — payment overdue 14 days
Please be advised that Invoice #INV-28841 for $2,870.00 (professional services, March 2025) remains unpaid and is now 14 days overdue. Continued non-payment may result in referral to our collections partner. Please arrange payment to: BSB 923-100, Acc 4419 2211. Contact us at accounts@premiersupply-au.com with any queries.
You have no record of ordering services from Premier Supply or any supplier at this domain.
LegitScam
—This one was: Scam — fake invoice / phantom invoice fraud
Phantom invoice fraud targets businesses by sending convincing invoices for services never rendered, hoping the accounts team pays without checking. The threat of "collections" is designed to override careful verification. Always cross-reference any invoice against a purchase order before paying.
- No record of ever ordering from this supplier — the invoice is for services never received.
- Threat of debt collection is designed to make you pay quickly without questioning.
- No purchase order number, no account manager name, no prior relationship.
- Every invoice payment should be matched to a purchase order. If there is no PO, escalate before paying.
Legit or scam?
Email
From Google Account Security <no-reply@google-security-alert.com>
Subject New sign-in on Windows from Sydney, NSW — was this you?
We noticed a new sign-in to your Google account from a Windows device in Sydney, NSW. If this was you, no action is needed. If you don’t recognise this activity, your account may be compromised — click below to secure it immediately.
Secure account link goes to: google-security-alert.com/secure
LegitScam
—This one was: Scam — fake Google account-security phish
Google security alerts come from @accounts.google.com and link to myaccount.google.com — not google-security-alert.com. The Sydney location makes this feel locally relevant and plausible, but the link goes to a credential-harvesting page designed to capture your Google password.
- Sender domain google-security-alert.com is not accounts.google.com.
- Real Google security alerts link to myaccount.google.com, not third-party domains.
- The local "Sydney, NSW" location is added to make the email feel personally relevant.
- Check your Google account activity directly at myaccount.google.com/security.
Legit or scam?
SMS
From Unknown (+61 4XX XXX XXX)
Congratulations! You’ve been selected to receive a $500 Woolworths gift card as part of our customer appreciation program. Claim your reward before it expires: woolworths-rewards-au.com/claim
LegitScam
—This one was: Scam — smishing (fake prize / reward claim)
Fake prize notifications sent by SMS are a classic social-engineering tactic. The large reward and expiry pressure are designed to make you click without thinking. The domain woolworths-rewards-au.com has no affiliation with Woolworths Group and is built to harvest card or personal details during the fake "claim" process.
- Domain woolworths-rewards-au.com is not woolworths.com.au.
- Woolworths does not contact you about rewards via SMS from an unknown mobile number.
- Unsolicited prize notifications with an expiry are a hallmark of phishing and scam campaigns.
- If you think you have genuine Woolworths Everyday Rewards points, check via the official app.
Legit or scam?
Email
From Salary Packaging Australia <updates@salarypkg-au.net>
Subject Action required: Update your salary-packaging account details
Your salary-packaging account requires updated bank details for your upcoming reimbursement of $1,240.00. Please log in to the secure portal below to update your account BSB and account number before Thursday to ensure timely processing of your reimbursement.
Link goes to: salarypkg-au.net/update-account
LegitScam
—This one was: Scam — fake salary-packaging account update
Salary-packaging and novated-lease companies are impersonated to trick employees into redirecting their own reimbursements to attacker-controlled bank accounts. The real provider would contact you through your registered account portal or by phone — not via emailed links to third-party domains.
- Domain salarypkg-au.net is not your real salary-packaging provider’s domain.
- Asking you to enter new BSB/account details via an emailed link — classic payment-diversion setup.
- Thursday deadline creates time pressure to stop you checking.
- Log into your real salary-packaging portal directly, or call your provider on a number from their official website.
Legit or scam?
Email
From ANZ Internet Banking <noreply@anz.com.au>
Subject Your August e-statement is now available
Your ANZ Internet Banking statement for August is now ready to view. Log in to ANZ Internet Banking at anz.com.au to view and download your statement. If you have any questions, call us on 13 13 14.
LegitScam
—This one was: Legitimate — genuine bank e-statement notification
This is a routine monthly e-statement notification from ANZ’s genuine domain. It does not ask you to click a login link embedded in the email — it tells you to go to anz.com.au yourself. There is no urgency, no request for credentials, and the phone number given is ANZ’s well-known published number.
- Sender domain anz.com.au is ANZ’s legitimate domain.
- Directs you to log in yourself at anz.com.au, not via an embedded link.
- No urgency, no threats, no request for credentials or payment details.
- Published, verifiable contact number (13 13 14) rather than a made-up helpline.
Legit or scam?
Email
From Adobe <message@adobe.com>
Subject Important: Update available for Adobe Acrobat (security fix)
A security update for Adobe Acrobat is now available. We strongly recommend updating as soon as possible to protect against recently discovered vulnerabilities. To update: open Adobe Acrobat, go to Help > Check for Updates, and follow the prompts. You do not need to click any link in this email to update.
LegitScam
—This one was: Legitimate — genuine Adobe security update notice
This is a genuine security advisory from Adobe’s real domain. Crucially, it explicitly tells you NOT to click a link — instead directing you to update through the application itself. A phishing email would embed a link and urge you to click it. Adobe’s real update notifications point to the app’s built-in update mechanism.
- Sender domain message@adobe.com is Adobe’s legitimate transactional email domain.
- Tells you to update through the app (Help > Check for Updates), not via an email link.
- Explicitly states "you do not need to click any link in this email".
- No urgency tactics, no credential collection, no payment request.
Legit or scam?
Email
From Amazon Web Services Billing <aws-billing@amazon-aws-billing.com>
Subject Your AWS bill has exceeded $3,400 — immediate action required
Your AWS account has incurred unexpected charges of $3,408.72 this billing cycle, significantly above your usual spend. This may indicate unauthorised use of your account. To dispute these charges or secure your account, click the link below immediately.
Secure account link goes to: amazon-aws-billing.com/account-review
LegitScam
—This one was: Scam — fake AWS billing alert credential phish
AWS billing alerts and security notices come from @amazonaws.com or @amazon.com — never from amazon-aws-billing.com. A large, unexpected bill is a powerful lure because it triggers both financial anxiety and account-security concerns simultaneously. The link harvests your AWS console credentials.
- Sender domain amazon-aws-billing.com is not an Amazon or AWS domain.
- Real AWS billing alerts come from @amazonaws.com and link to console.aws.amazon.com.
- Large unexpected charge creates financial panic designed to override careful thinking.
- Check your actual AWS bills at console.aws.amazon.com/billing — go there directly, never via an email link.
Legit or scam?
Email
From Noreply — NBN Co <noreply@nbn-account-services.net>
Subject Your NBN service will be suspended in 24 hours — outstanding balance
Our records show an outstanding balance on your NBN account. Due to non-payment, your internet service will be suspended in 24 hours. To avoid disconnection, you must pay the outstanding amount of $87.50 immediately using the secure payment link below.
Payment link goes to: nbn-account-services.net/pay
LegitScam
—This one was: Scam — fake NBN disconnection threat
NBN Co is a wholesale provider — it never bills consumers directly. Your internet bill comes from your retail service provider (RSP), not NBN Co. The domain nbn-account-services.net has no affiliation with NBN Co, and the disconnection threat is designed to panic you into paying without checking.
- NBN Co never bills consumers directly — your bill comes from your RSP (e.g. Telstra, Optus, TPG).
- Domain nbn-account-services.net is not the real nbnco.com.au.
- 24-hour disconnection threat creates panic designed to skip verification.
- If you have a genuine overdue bill, your RSP will contact you — log into your RSP account directly to check.

0 of 40 answered

Use — Guide

How to use this tool

Read each of the 8 randomly selected message scenarios carefully — they include emails, SMS and MFA prompts drawn from a pool of 24 realistic real-world scams.
Select “Legit” or “Scam” for each scenario; you’ll get instant feedback revealing the red flags (or safe signals) immediately after you answer.
Work through all 8 scenarios — your first instinct is locked in once you answer, so take a moment before choosing.
Press “See my score” once all 8 are answered to receive your score out of 100 and a rating.
Read the four habits panel — these are the practical actions that stop most phishing and BEC attacks in real life.
Share the quiz link with colleagues, or contact Peritus Digital to run a formal phishing-simulation and awareness-training programme for your whole team.

FAQ — Questions

Frequently asked questions

01What does this quiz teach?

The quiz presents 8 randomly selected phishing and Business Email Compromise (BEC) scenarios drawn from a pool of 40+ — including credential-harvesting emails, CEO fraud, invoice-redirection scams, smishing and MFA-fatigue attacks. After each answer you see the red flags explained, building the instinct to slow down and verify before acting on suspicious messages.

02Are my answers or score stored anywhere?

No. The quiz runs entirely in your browser — your answers, score and identity are never sent to Peritus Digital or any third party unless you choose to submit the optional contact form at the end.

03Can I use this to train my whole team?

The quiz is a good starting point, but a single quiz builds awareness rather than lasting habit. Peritus Digital runs structured phishing-simulation programmes — realistic test emails sent to your real staff, with targeted follow-up training for anyone who clicks. Contact us to discuss a programme sized for your team.

04What is Business Email Compromise (BEC) and why does it matter?

BEC is a category of scam where attackers impersonate a trusted person — a manager, supplier or colleague — to trick staff into transferring money, changing bank details or handing over credentials. It accounts for the majority of financial losses from cybercrime for Australian small and medium businesses, and most cases start with a single convincing email.

More — Keep exploring

Related free tools

Want hands-on help, not just a check? Explore ourCyber Security service.

Can you spot the scam?

—

Four habits that stop most scams

How to use this tool

Frequently asked questions

Related free tools

One person clicking is all it takes — train your team to spot the scam.

My security report