· Halloween · Security
Phantom Phishing: free Halloween game to spot phishing emails
Phantoms haunt the inbox, dressed as your bank, your boss and your best friend. Unmask them before they steal your candy.
What is Phantom Phishing?
It's the Hollowmere Halloween party, and messages keep landing: your bank, your boss, your best friend, a parcel service. Investigate each one with a few checks (the full sender address, where the link really goes, where replies go, what it asks), then unmask the phantom or trust the message. Some are genuine, even the urgent ones.
Phantom Phishing is a free Halloween security game. At a haunted office party, messages arrive dressed as your bank, your boss, your best friend and a parcel service. You open each one like an investigator: reveal the full sender address, see where the link really goes, check where replies would land and read what the message asks of you.
Then you decide: unmask the phantom and name the clue that proves it, or trust the message. Some are genuine, even urgent ones, and each answer explains the trick: rn posing as m, a zero for an o, .co instead of .com, a real domain used as a costume at the front of a fake one.
At a glance
- Category
- Seasonal
- Difficulty
- Medium
- Play time
- 4–6 min
- Price
- Free, in your browser, sign-up optional
How to play
- Read the message
- The inbox only shows a name, and anyone can type any name.
- Investigate
- Run 3 checks per message, then 2: full sender address, real link target, reply-to address, what it asks.
- Unmask or trust
- Unmask a phantom and name the clue that proves it, or trust a genuine message.
- Score
- 100 for the right call, +50 for proof. A wrong call costs one of 3 lives.
Scoring
Each right call scores 100 points, plus 50 for proof: name the clue you found when you unmask a phantom, or run a check that comes back clean before you trust a genuine message.
A wrong call costs one of your 3 lives. Twelve messages in four chapters; your best score is kept in this browser.
What it trains
- Checking senders
- Opening the full address behind a display name and spotting look-alikes like rn for m or 0 for o.
- Reading links
- Finding the real domain a link goes to, right before the first single slash.
- Calm judgment
- Telling pressure plus money or passwords apart from messages that are just urgent.
Strategy and tips
- Names are free
- Anyone can type "Your Bank" as a display name. Open the full address.
- Read the domain right to left
- The real domain sits just before the first single slash: online.emberbank.com is the bank, emberbank.com.pay-now.net is not.
- Spell it slowly
- rn looks like m, 0 like o, 1 like l. Compare with an address you already know.
- Check where replies go
- A perfect From line with a different Reply-to sends your answer to someone else.
- Urgent isn't always fake
- Urgency plus money, codes or passwords is the alarm. Urgency alone may just be your boss.
Why play Phantom Phishing?
Most phishing works because we react before we look. Practising a few calm checks on harmless made-up messages builds the reflex that protects real accounts, and the Halloween costumes make the tricks easy to remember.
Frequently asked questions
Is Phantom Phishing free?
Yes. It is free and runs in your browser, with no download. Signing up is optional.
Are the companies and addresses real?
No. Every person, company and address is made up, so you can practise safely.
Isn't the right sender address enough?
No. Accounts get hacked and From lines can be faked, so the game also teaches the link target, the reply-to address and what the message asks.
What should I do with a real suspicious message?
Don't click. Open the company's app or website yourself, or call the person on a number you already have.