Why a phishing quiz?
Most cyberattacks on small businesses and practices start with a person, not a computer. Someone gets an email that looks right, at a busy moment, and clicks. Phishing works because it imitates the messages you get every day: password notices, invoices, shared files, voicemails, delivery updates and requests from the boss.
This quiz shows you ten realistic emails — some fake, some genuine — and asks you to decide. After each answer it highlights the warning signs (or explains why a real email checks out). It's quick enough to do over coffee, and works well as a team exercise at a staff meeting.
The warning signs to look for
| Red flag | What it looks like | What to do |
|---|---|---|
| Wrong or lookalike sender | The name says "Microsoft 365" or your boss, but the address is a free email account or a slightly misspelled domain | Read the full email address, not just the name |
| Mismatched link | Button text says one thing; the real address goes somewhere else | Hover or long-press before clicking; go to sites from your own bookmarks |
| Urgency or threats | "Expires in 2 hours", "account suspended", "pay by end of day" | Slow down — pressure is the point |
| Password request | A page that asks for your email password to view a file, voicemail or document | Never enter it; report the email |
| Money or bank changes | New bank details, gift cards, wire transfers, small "fees" | Verify by phone with a number you already have |
| Odd attachments | .htm, .html, .zip or files named "secure" or "updated" | Don't open; ask IT |
| Secrecy | "Keep this between us", "I can't take calls" | Check with the person directly |
Why genuine emails are part of the quiz
Good security isn't about being suspicious of everything — that just slows the office down and teaches people to ignore warnings. The genuine emails in the quiz show what a trustworthy message usually looks like: it comes from a sender you know, on their normal domain, about something you expected, and it doesn't ask for a password or money. Even then, the safest habit for anything involving logins or payments is to go to the site or call the person yourself, rather than using the link or number in the email.
Phishing themes aimed at practices and small offices
The emails in the quiz are modeled on themes that come up again and again:
- Account and password notices — fake "password expiring", "mailbox full" or "unusual sign-in" messages that lead to a lookalike sign-in page.
- Shared documents and e-signatures — "You have a document to review", often with a tempting title like a bonus, a policy change or a patient complaint.
- Vendor and payment fraud — a supplier, landlord or lab "changing bank details". This can be especially costly, because the money is often gone before anyone notices.
- Boss impersonation — a quick favor from the owner or lead doctor, usually gift cards or an urgent payment.
- Voicemail, fax and delivery notices — everyday office messages that people click without thinking.
What to do if someone clicks
- Report it right away to whoever handles IT. Minutes matter.
- If a password was entered, change it from a trusted device and check that multi-factor authentication is on.
- If money was sent, call your bank immediately and ask about recalling the payment, then involve your insurer.
- Keep the email. IT can use it to block the sender and check whether anyone else received it.
Our HIPAA breach response plan article explains what practices should do next if patient information may be involved.
Using the quiz with your team
- Have everyone take it individually, including providers and owners. Attackers often target the people with the most access.
- Discuss the ones people missed. The conversation is where the learning happens.
- Agree on your rules: how to report a suspicious email, and how payment or bank changes are verified.
- Make reporting easy and blame-free. A person who reports a click quickly is doing exactly the right thing.
- Repeat regularly with ongoing training and simulated phishing emails. Many cyber insurance applications ask about both — check yours with our cyber insurance readiness quiz.
For medical and dental practices, security awareness training is part of the HIPAA Security Rule's administrative safeguards (45 CFR 164.308(a)(5)). See where else you stand with our HIPAA security self-assessment.
Technology helps, too
Training is one layer. Technology catches what people miss and limits the damage when someone does click:
- Multi-factor authentication stops a stolen password from being enough on its own. See our multi-factor authentication guide.
- Advanced email filtering checks links and attachments before they reach inboxes.
- SPF, DKIM and DMARC stop criminals from sending email that appears to come from your own domain. Test yours with our email domain security checker.
- A password manager won't fill in your password on a fake site, which is a useful warning sign. Create a strong master passphrase with our passphrase generator.
Read our full phishing and business email compromise guide for more examples and a step-by-step response plan. Beefed Up IT provides security awareness training, email protection and Microsoft 365 security setup for small businesses and medical and dental practices as part of our managed IT services. Get in touch to set it up for your team.