Recognizing Phishing and Scams Course: Phishing emails, links, QR codes and fake websites

1. Question 1 of 17

   In the web address https://portal.maplecu.example/login, which part shows who really owns the site?

   • Aportal
   • Bmaplecu.example
   • Chttps://portal
   • Dlogin
   Show answer

   Answer: B. maplecu.example

   The owner is the name just before the first single slash, with its ending. "portal" is only a part of that site.

2. Question 2 of 17

   Which web address really belongs to maplecu.example?

   • Ahttps://help.example/maplecu
   • Bhttps://maplecu-example.help/reset
   • Chttps://maplecu.example.reset-help.example/
   • Dhttps://help.maplecu.example/reset
   Show answer

   Answer: D. https://help.maplecu.example/reset

   Only the first ends in maplecu.example right before the first single slash. The others belong to other domains.

3. Question 3 of 17

   What does the Cyber Centre suggest instead of clicking links in messages to reach a website?

   • ACopy the link into a new browser tab
   • BUse a bookmark or a search engine
   • CClick the link but only on a phone
   • DAsk the sender to send the link again
   Show answer

   Answer: B. Use a bookmark or a search engine

   Using bookmarks or a search engine takes you to the real site instead of where the message wants you to go.

4. Question 4 of 17

   What is "pharming"?

   • ASending people to fake look-alike websites
   • BBuying fake followers to make an account look popular
   • CSaving cookies so a website loads faster
   • DSharing a file through a cloud storage folder
   Show answer

   Answer: A. Sending people to fake look-alike websites

   The Cyber Centre describes pharming as redirecting users to fake websites that look identical to legitimate ones.

5. Question 5 of 17

   A shopping site shows a padlock icon and its address starts with https. What does this prove?

   • AThat someone has checked the site's prices
   • BThat the government has approved and listed the site
   • CThat the business behind the site is real and trustworthy
   • DNot enough on its own; fake sites can have these too
   Show answer

   Answer: D. Not enough on its own; fake sites can have these too

   The Cyber Centre says not to rely on padlock icons or how a site looks to decide whether it is legitimate.

6. Question 6 of 17

   Which is a warning sign of a fake online store, according to the CAFC?

   • AA clear returns policy
   • BPrices close to those in local stores
   • CNo customer phone number or email on the site
   • DSeveral payment choices at checkout
   Show answer

   Answer: C. No customer phone number or email on the site

   The CAFC lists missing contact details, huge discounts and a different name on your card statement as red flags.

7. Question 7 of 17

   At checkout, a seller asks you to skip the website's checkout and pay by e-transfer for a "bigger discount". What does the Cyber Centre say?

   • AIt is safe as long as the total is under $100
   • BIt is a normal way for small online sellers to avoid paying card fees
   • CMoving payment outside the official checkout is a red flag
   • DIt is safer than paying by credit card
   Show answer

   Answer: C. Moving payment outside the official checkout is a red flag

   The Cyber Centre warns about requests to move payments outside the official checkout process, such as paying by e-transfer.

8. Question 8 of 17

   Which payment method does the Cyber Centre suggest for online shopping because it may offer fraud protection or a chargeback?

   • AA gift card bought at a store
   • BA cryptocurrency transfer
   • CA credit card from a major financial institution
   • DCash sent by mail
   Show answer

   Answer: C. A credit card from a major financial institution

   Credit cards from major financial institutions may offer fraud protection or chargeback options.

9. Question 9 of 17

   The Cyber Centre says not to open attachments from unknown senders, or attachments with which feature?

   • AFiles smaller than 1 MB
   • BShort file names with no spaces
   • CFiles sent on a weekday
   • DStrange file names or more than one file extension
   Show answer

   Answer: D. Strange file names or more than one file extension

   Strange names and multiple extensions can hide what a file really is.

10. Question 10 of 17

    What is "thread hijacking"?

    • ACutting the cable that links an office computer to the network
    • BUsing a taken-over email account to join a real conversation
    • CPosting fake comments under a news story
    • DCopying a company's logo onto a fake website
    Show answer

    Answer: B. Using a taken-over email account to join a real conversation

    The Cyber Centre says thread hijacking makes a request look trustworthy because it appears in an existing conversation.

11. Question 11 of 17

    After you click an email link, a request appears: "Allow DocuViewer to access your mailbox and files?" You have never used this app. What attack could this be?

    • ATailgating
    • BA watering hole attack
    • CConsent phishing
    • DTyposquatting
    Show answer

    Answer: C. Consent phishing

    In consent phishing, approving a fake app request lets the attacker reach your account without your password.

12. Question 12 of 17

    Read the email. Who really owns the link?

    From: Northbank Security <alerts@northbank-secure.example>

    Subject: Unusual sign-in blocked

    We blocked a sign-in to your account from Winnipeg. If this wasn't you, verify your identity now:

    https://northbank.example.verify-id.example/secure

    Accounts not verified within 12 hours will be locked.

    Northbank Security Team

    • Anorthbank.example
    • Bverify-id.example
    • Csecure
    • Dnorthbank-secure.example
    Show answer

    Answer: B. verify-id.example

    The name just before the first single slash is verify-id.example. "northbank.example" at the front is a disguise.

13. Question 13 of 17

    Read the email. What is the safest way to check whether there is a problem with your account?

    From: Northbank Security <alerts@northbank-secure.example>

    Subject: Unusual sign-in blocked

    We blocked a sign-in to your account from Winnipeg. If this wasn't you, verify your identity now:

    https://northbank.example.verify-id.example/secure

    Accounts not verified within 12 hours will be locked.

    Northbank Security Team

    • AClick the link, but close the page before you type your password
    • BCall the phone number in the email's signature
    • COpen the bank's site from a bookmark or by typing the address
    • DReply to the email and ask for proof
    Show answer

    Answer: C. Open the bank's site from a bookmark or by typing the address

    Reach the bank through a channel you choose yourself, not through anything in the message.

14. Question 14 of 17

    At a café, a QR code on your table says "Scan to order and pay". It looks like a sticker placed over another code. What does the Cyber Centre advise?

    • APeel it off and scan the code underneath
    • BScan it, but pay with a gift card
    • CScan it, since many cafés use QR menus
    • DAsk a staff member to check it before you scan
    Show answer

    Answer: D. Ask a staff member to check it before you scan

    A label that could be covering another QR code is a warning sign; ask staff to verify it first.

15. Question 15 of 17

    Which phone setting does the Cyber Centre suggest for QR codes?

    • AOpen QR code links automatically to save time at the till
    • BAsk for permission before opening a QR code action
    • CTurn off the screen lock while scanning
    • DLet QR apps read your text messages
    Show answer

    Answer: B. Ask for permission before opening a QR code action

    Setting your device to ask before it launches a QR action gives you a chance to check the address first.

16. Question 16 of 17

    Read the email. Why should Sam still be careful?

    Sam and Dana Ruiz, a client contact, have emailed for weeks about shipping rates. Today this reply arrives in the same thread, from Dana's real address, dana.ruiz@lakeshorelogistics.example:

    Re: Q3 shipping rates

    Hi Sam, as discussed, please review the updated rate sheet before our call. Open the shared file here and sign in with your work email to view it.

    Thanks, Dana

    • ADana usually signs her emails with her full name and title
    • BShared files can never contain anything harmful, so there is no risk
    • CRate sheets are always sent by fax
    • DDana's account may be hacked and used to reply in the thread
    Show answer

    Answer: D. Dana's account may be hacked and used to reply in the thread

    With thread hijacking, a real address and a real conversation do not prove the request is safe, especially one asking you to sign in.

17. Question 17 of 17

    Read the email. What should Sam do?

    Sam and Dana Ruiz, a client contact, have emailed for weeks about shipping rates. Today this reply arrives in the same thread, from Dana's real address, dana.ruiz@lakeshorelogistics.example:

    Re: Q3 shipping rates

    Hi Sam, as discussed, please review the updated rate sheet before our call. Open the shared file here and sign in with your work email to view it.

    Thanks, Dana

    • ACheck with Dana by phone, using a number he already has
    • BReply in the thread and ask if it is real
    • CSign in quickly, since the call with Dana is starting soon
    • DForward the email to the whole team so they can check it
    Show answer

    Answer: A. Check with Dana by phone, using a number he already has

    Confirm through a separate channel. A reply in the same thread could go to the attacker.

Keyboard: 1–4 to answer, Enter for the next question.