Free phishing test: can you spot the fake email?
Scammers in Nigeria use fake bank texts, fake alerts, fake bosses and fake invoices. This free phishing test shows you 12 made-up emails. Pick real or fake. We show you the red flags after each one. It takes about 3 minutes.
Short answer: yes, this phishing test is free. Read 12 made-up emails, choose real or fake, and learn the red flags in about 3 minutes. No sign-up, and no personal data kept.
Try it: spot the fake
Twelve made-up emails. Some are real, some are fake. Read each one, look at the sender and the link, then choose. Nothing here is real. We only count plays anonymously (no name, no email, no cookies).
Six fakes to watch for at work and at home
The fake "account blocked" SMS
A text says your bank account is blocked and asks you to call a number or tap a link. The page then asks for your BVN, card number or PIN. Banks do not ask for these over SMS.
The fake credit alert
A customer shows you an SMS that says money came in and asks you to release goods or cash. Apps exist that make fake alerts. Check your bank app balance first. The SMS alone proves nothing.
The "pay your traffic fine" link
In 2026 reports described texts about an unpaid traffic offence that linked to fake government pages. The page took card details, then asked for the OTP. Never type an OTP into a page you reached from a text.
The "boss" asking for a quick transfer
A message from the "MD" on WhatsApp or email asks you to pay a vendor now and keep it quiet. Rush and secrecy are the warning signs. Call the boss on a number you already have.
The invoice with new bank details
A real supplier "changes" their account number by email. Phone them on a number you saved before. Do not use the number in the email.
The fake customer care DM
You complain about a bank on social media. A look-alike support account messages you first and asks for an OTP. Real banks do not ask for OTPs or PINs in a DM.
Sources: Dubawa on fake credit alerts, The Condia on fake FRSC pages. Examples here are described in general words. No real person or company is named.
The 4 habits that stop most scams
- Stop. Rush is a trick. Take 60 seconds.
- Look. Check the real sender address and where the link goes.
- Check. Call the person or bank on a number you already have. Check your balance in the bank app.
- Tell. Report it to your IT person or manager, even if you clicked.
Want your team to learn this? See cybersecurity awareness training in Nigeria, read about NDPA staff training, or read how to spot a fake email: 12 tricks.
Frequently asked questions
Is this phishing test really free?
Yes. It is free, takes about 3 minutes, needs no sign-up and keeps no personal data (we only count plays anonymously, with no name, email or cookies, and nothing if your browser says Do Not Track). All the emails are made up and use fictional brands.
What is a phishing test?
A phishing test shows you messages and asks if they are real or fake. This one has 12 made-up emails. After each answer you see the red flags, so you learn what to look for next time.
How do I know if an email or SMS is fake?
Look at the address after the @ and not just the name. Check where the link really goes. Be careful with rush, fear, secrecy, and any ask for money, a password, a BVN, a PIN or an OTP. When unsure, do not click. Call the person or bank on a number you already have.
Will a bank ever ask for my BVN, PIN or OTP by SMS or DM?
No. Treat every request for a BVN, PIN or OTP that you did not start as a scam. Open your bank app yourself or call the number on your card.
Can I run a phishing test for my whole team?
Yes. We can run a free fictional phishing test for up to 25 of your staff and send you a plain report. Ask for it on the free phishing risk test page. Staff training that follows is available on a free trial.
Does staff training help with NDPA?
Staff training supports the NDPA requirement for appropriate technical and organizational measures. A law firm commentary on the NDPC guidance notice says GAID Article 30(1) calls for a schedule of staff training, so check the exact text with the NDPC or your adviser. Training does not replace the rest of an NDPA program.