This page is part of an authorized phishing simulation conducted by [Company] IT Security. No real credentials were captured or stored — everything is safe. You are not in trouble, and this is not logged against you personally. This is simply a learning opportunity.
No data captured
Authorized Exercise
Education Only
Red flags
What gave it away
01
Urgency & fear tactics
Phrases like "Your account has been compromised — act immediately" are designed to bypass rational thinking. Legitimate services rarely pressure you with threats or countdown timers.
02
Spoofed or mismatched domain
The login page was not on the real company domain. Always check the full URL — attackers use lookalikes:
login-company.com vs company.com. HTTPS alone does not mean safe.03
Out-of-flow credential request
You were asked to re-verify your password outside your normal login flow. Legitimate platforms — SSO, Google Workspace, Microsoft 365 — never ask for credentials this way.
Next steps
What to do next time
If you receive a suspicious email: stop, don't click, don't enter credentials. The most impactful thing you can do is report it immediately — that's what actually protects your organization from real attacks.
Report suspicious emails
Forward to [security@yourcompany.com] or use the Report Phishing button in your email client. If you ever enter credentials on a page you're unsure about — report it immediately so IT can protect the account before any real damage is done.
Stay sharp
Sharpen your instincts
🔗
Always verify the URL
Before entering anything, read the full domain in the address bar. Hover over links before clicking to preview the real destination.
🔐
Enable MFA everywhere
Multi-factor authentication blocks over 99% of account takeover attempts — even when credentials are already stolen.
⏸️
Pause on urgency
Urgency is an attacker's most powerful weapon. When you feel rushed, that's the signal to slow down and verify through a trusted channel.
📞
Verify out-of-band
If an email asks for a sensitive action — wire transfer, password reset, data access — call the sender directly using a known number to confirm.