Would You Trust the Request?
Explore how urgency, authority, fear, curiosity, and familiarity can make a suspicious request feel normal.
Use Fake Data Only
Never enter a real username, password, MFA code, account number, or private detail into a demonstration. The login below uses fixed read-only practice values and sends nothing.
1Safe simulation
Credential-Harvesting Simulation
A fake page does not need to authenticate a victim; it only needs to capture what is entered.CloudBox Account Verification
Your files will be locked in 10 minutes. Sign in now to prevent suspension.
CloudBox is fictional. No form is submitted.
Practice Capture View
Waiting for the fixed practice values...
Look beyond design: The address, unexpected urgency, strange request, and verification path matter more than polished graphics.
Defender Pattern
PauseInterrupt urgency and emotion.
InspectCheck sender, domain, wording, and request.
VerifyUse a separate trusted channel.
Protect & ReportDo not share secrets; report suspicious activity.
References
- Cybersecurity and Infrastructure Security Agency. (n.d.). Recognize and report phishing. https://www.cisa.gov/secure-our-world/recognize-and-report-phishing
- MITRE. (n.d.). Phishing: T1566. https://attack.mitre.org/techniques/T1566/
- National Institute of Standards and Technology. (2024). Digital identity guidelines (NIST SP 800-63). https://pages.nist.gov/800-63-4/
Respond Like a Defender
Select the safest next action.
“Your manager” urgently asks for gift-card codes.
“Support” asks for your MFA code.
A text says your account closes in ten minutes.
A friend’s new account asks for emergency money and says not to call.
A login page shows a padlock. What still needs verification?