A message called a 'phishing test' is usually a harmless drill from an employer, but scammers use the same words as bait, so check before you click.
If a message says it is a 'phishing test', it is probably a harmless drill. It could also be a scam using those words to get you to sign in. The message alone will not tell you which. The safe move is the same either way: do not type a password, and check with the sender first.
A phishing test is a fake phishing message or quiz made to measure and teach how well people spot scams. The same words cover three different things: a simulated email your employer's IT or security team sends, a quiz you open yourself, and a real attack that borrows the name.
Tools built for this are open about what they do. KnowBe4's free Phishing Security Test sends one email to each user, written to lure a click. A click leads to a page saying it was a simulation, with tips for inspecting emails. Microsoft's Attack simulation training sends what it calls 'realistic but harmless' messages inside an organization.
In a company test, the security team chooses who gets the fake message and what happens after a click. The tool then counts opens, clicks, typed passwords and reports. It can also send training to people who fell for it. Microsoft says its tool needs Microsoft 365 E5 or Defender for Office 365 Plan 2, with a reduced trial for E3 customers.
A real scam can ask for a password just as a test does. The only difference is who receives what you type. So treat any suspicious message as real until your IT team confirms it was theirs.
Report it either way. Use your mail program's report button, or forward phishing emails to reportphishing@apwg.org. Forward texts to 7726. Report any attempt to the FTC at ReportFraud.ftc.gov. At work, send a suspected email to the security team, not to colleagues. If you clicked a doubtful link, run a security scan.
There is no program called Phishing test, so nothing needs to be uninstalled. A site selling a 'Phishing test remover' is selling something you do not need. The source guide notes it found no write-ups on security sites about a specific scam under this name, so details are still limited.
Never enter a password on a page you reached from a message, and confirm a 'phishing test' with your IT team or sender using a number you already know.
North Dakota lawmakers are looking at HB 1447, a bill meant to help prevent crypto fraud, and AARP wants residents to speak up.
Read more: North Dakota weighs a bill to curb crypto scamsA user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websitesA fake call in Truro, Canada, sent a police tactical team to a woman's home. An RCMP officer now shares plain rules for spotting phone scams.
Read more: Canadian police share simple rules to beat phone scammers
