Category: Security Awareness Topic: Phishing and Social Engineering

Instructions

Read each scenario carefully and select the single safest response.

Questions

Question 1

You receive an email stating that your account will be suspended within 30 minutes unless you verify your login details using a link in the message.

What should you do?

• A. Click the link and verify the account immediately.
• B. Reply to the email and ask the sender to confirm the request.
• C. Open the organization's official website separately and check your account.
• D. Open the link using private browsing mode.

Question 2

You receive an SMS stating that your package could not be delivered because a small payment is required. The message contains a link to make the payment.

What is the safest response?

• A. Make the payment because the amount is small.
• B. Open the link and provide only the required card information.
• C. Check the delivery status through the courier's official website or application.
• D. Reply to the SMS and request another payment method.

Question 3

You receive an SMS claiming that a suspicious transaction has been detected on your bank account. It asks you to click a link immediately to cancel the transaction.

What should you do?

• A. Click the link and cancel the transaction.
• B. Enter the OTP requested by the website.
• C. Check your account using the bank's official application or website.
• D. Reply to the SMS to confirm whether the alert is genuine.

Question 4

You receive a message saying that you have won a new smartphone. The message asks you to log in through a provided link to claim your prize.

What is the safest action?

• A. Log in immediately before the offer expires.
• B. Forward the message to friends to check whether they received it.
• C. Avoid the link and verify the offer through the organization's official website.
• D. Enter a fake password to test whether the website is legitimate.

Question 5

You receive an email that appears to come from your company's IT department. It asks you to send your password because your account needs to be "secured."

What should you do?

• A. Send the password because the request appears to be from IT.
• B. Send only part of the password.
• C. Verify the request through the company's official IT support channel.
• D. Reply to the email and ask why the password is required.

Answer Key and Explanations

1. C — Open the official website separately

Credential Phishing

Attackers often create a sense of urgency and use fake login pages to steal usernames and passwords. Do not use the link in the email. Access the service through its official website instead.

2. C — Check the official website or application

Smishing

Attackers may send fake delivery messages containing payment links to steal card or personal information. Verify the delivery directly through the courier's official service.

3. C — Check the official banking application or website

Bank Phishing

Attackers can use fake security alerts to create panic and trick users into revealing banking credentials or OTPs. Do not use the provided link; verify the transaction through the official banking service.

4. C — Avoid the link and verify the offer

Prize Phishing

Attackers may use fake prizes or rewards to convince users to visit fraudulent websites or provide personal information. Verify the offer using the organization's legitimate website.

5. C — Verify through the official IT support channel

Impersonation Phishing

Attackers may pretend to be trusted employees or IT staff to obtain sensitive information. Legitimate support teams should not require users to disclose their passwords.

Key Takeaway

Phishing attacks commonly rely on urgency, fear, rewards, and impersonation to influence users into taking unsafe actions.

Before clicking a link, sharing sensitive information, or making a payment:

Stop → Verify → Then Act

Contributor

Author: Priyanshi Sharma GitHub: @priyanshi17112007 Contribution: Phishing Awareness Quiz