Phishing Quiz

People who handle email, workplace messages, or online account alerts can use this phishing quiz to practise recognizing pressure, impersonation, deceptive links, and unsafe requests. It suits anyone who wants a clearer picture of current detection habits, whether learning independently or reviewing everyday security decisions. An employee-focused quiz about phishing can also support focused awareness discussions without treating one score as a complete measure of behavior.

What This Assessment Measures

Scenarios assess whether a respondent can separate deceptive signals from ordinary communication and choose a safer next step. They cover links, files, payment requests, login pages, sender identity, multifactor prompts, QR codes, and urgency. The result reflects applied knowledge in these situations, not a fixed trait or guarantee of future performance.

The questions and answers about phishing emphasize three result areas:

• Phishing Knowledge (0-16) shows how consistently the respondent applies detection principles: Foundational awareness (0-6), Developing detection (7-12), or Strong awareness (13-16).
• Link and identity checks show whether destinations, domains, sender details, and security signals are inspected rather than trusted at face value.
• Urgency and response decisions show whether unusual requests are verified, credentials are protected, and suspicious activity is reported.

Methodology and Evidence Base

Each item presents a brief scenario with four response options. The safest or most accurate choice is scored, so the total reflects performance across these decisions rather than a clinical classification. It does not prove that a message is legitimate.

The approach is conceptually consistent with Phish Scale (Steves et al., 2020), which considers message cues and audience-context fit in detection difficulty; this questionnaire is not an adaptation of that scale. NIST guidance adds a practical lens for cues, premise alignment, and task difficulty. Here, those ideas organize realistic judgments, not a standardized version of either source.

Ribeiro, Guedes, and Cardoso linked phishing susceptibility with interacting influences, including detection self-efficacy in their study. That evidence supports reading this result as one indicator among factors shaping behavior. A quiz with answers about phishing can make reasoning visible and guide practice in checking destinations, protecting credentials, and reporting suspicious activity.

Because the questionnaire is brief and non-normed, scores should be interpreted in context. Workload, urgency, prior training, attention, and honest self-report can change performance; the result cannot guarantee protection or diagnose susceptibility.