· Skillz · Cybersecurity
Phish or Legit: free phishing quiz, swipe to spot scams
Swipe left for phishing, right for a real message. Fake banks, parcel fees and CEO fraud: train your scam radar.
What is Phish or Legit?
Emails, texts and DMs, one card at a time. Swipe left if it's phishing, right if it's real, before the clock runs out. After each card, the red flags you should have spotted.
Phish or Legit is a fast phishing quiz in the style of a dating app: each message is a card, swipe left for phishing and right for legit. Emails, texts and DMs mix real notifications (a receipt, a dentist reminder, a card alert) with the scams that fill inboxes: lookalike domains, fake parcel fees, mailbox-full warnings, CEO wire requests.
Each card has a short clock, so you learn to judge fast, like in real life. After every answer, the game shows the red flags you should have spotted, or why the message was fine.
At a glance
- Category
- Skillz
- Difficulty
- Easy
- Play time
- 3–5 min
- Price
- Free, in your browser, sign-up optional
How to play
- Read
- A message lands: an email, a text or a DM.
- Swipe
- Left for phishing, right for legit. Buttons and the arrow keys work too.
- Streak
- Right answers in a row score more. A wrong call costs a life.
- Learn
- Each card ends with its red flags, or why the message was fine.
Strategy and tips
- Domain first
- Read the real domain just before .com: streambox-billing.co is not streambox.com.
- Pressure is a tell
- Deadlines, threats and suspended accounts are there to rush you.
- Never type a password from a link
- Real services tell you to open their app, not to log in from an email.
- Odd attachments
- A voicemail or invoice as .html or .exe is a trap.
- Real can look boring
- Legit messages are often plain: no link, nothing to pay, nothing to enter.
Why play Phish or Legit?
Phishing is the most common way accounts and money get stolen. Swiping dozens of examples builds the quick, calm judgement that protects you when a convincing message lands on a busy day.
Frequently asked questions
Is Phish or Legit free?
Yes. It is free and runs in your browser, with no download. Signing up is optional.
Are the messages real?
No. Every brand, domain and number is made up, but the tricks are the ones scammers really use.
Can I play without swiping?
Yes: use the Phish and Legit buttons, or the left and right arrow keys.
How is it different from Scam Jam?
Scam Jam asks you to tap each red flag. Phish or Legit is a fast yes/no call on the whole message, like you make in your inbox.