to me
Every email here is a test.
Read each one the way you'd read your own inbox. Highlight anything that looks off, then decide whether it's legitimate or phishing. Afterwards, you'll see exactly what gave it away.
- Read the email. Hover over links and open the sender details, just as you would for real.
- Highlight anything suspicious by clicking it. Every genuine red flag you catch earns points.
- Decide whether it's legitimate or phishing, then read the marked-up answer.
Nothing is sent anywhere, and your results are cleared when you end your session or close this tab.
- Not paypal.com!
- They'd know your name
- Rushing you on purpose
Field guide
The tricks phishing emails rely on, what they look like, and how to check for them. Every red flag in the trainer links back to its entry here.
Habits that beat most phishing
Go direct
If an email says something is wrong with an account, ignore its links. Open the app, or type the website address yourself, and look there.
Hover, then decide
On a computer, hover over a link and read the address in the corner of your browser. On a phone, press and hold. If it doesn't match the sender, don't click.
A padlock isn't a promise
HTTPS and the padlock mean the connection is encrypted, not that the site is honest. Phishing sites use them too.
Never share a code
One-time codes are the last lock on your account. No genuine organisation will ever ask you to read one back to them.
If one lands in your inbox
Forward suspicious emails to report@phishing.gov.uk, the National Cyber Security Centre's reporting service, and forward scam texts to 7726. Then delete them.
If you've already entered a password, change it straight away, along with anywhere else you've used it. If you've shared bank or card details, call your bank using the number on the back of your card.
At university or work, tell your IT team too. They can warn everyone else.
Your progress
How you're doing this session, and which red flags you tend to miss. Everything here clears when you end the session or close the tab.
About The School of Phish
The project
The School of Phish is a phishing awareness trainer. It drops you into a realistic inbox and asks you to do what attackers hope you won't: slow down, inspect, and decide.
Every email is marked up afterwards like a piece of homework, so you learn not just whether you were right, but which details gave it away. The red flags you miss most often are tracked, so you know what to practise next.
The developer
Built by Sam Vincent, an IT professional and Computer Science (Cybersecurity) undergraduate at the University of Plymouth. With over six years of experience across IT support, logistics and regulated environments including the NHS and Ministry of Defence, Sam brings a practical, security-aware perspective to everything he builds.
As a dad of two, the motivation goes beyond the academic. Phishing remains one of the most common and damaging ways into people's accounts and organisations' networks, and building tools that help everyday people recognise and resist it is exactly the kind of work that matters.
How it's built
Vanilla HTML, CSS and JavaScript, with no frameworks, dependencies or build step. Emails are stored as structured data and rendered without injecting HTML; progress is kept only for the current browser session, so the app works on shared computers without mixing people's results. The project started life as coursework for COMP1004 Computing Practice.
About the emails
Every scenario is fictional. Real organisation names appear only to show how impersonation works. Links and addresses in the phishing examples are invented and go nowhere, and sender addresses shown for real organisations are illustrative, so always check an organisation's own website for how it contacts you.