SoSafe
AI Scams at Work Week 1 · Phishing
Case {{ caseNum }} of 5
{{ timeLabel }}
Weekly Security Challenge · Week 1

AI Scams at Work: Phishing

Five real workplace messages — every one a phishing attempt. Attackers craft emails, texts, chats and login pages that look completely legitimate. Inspect each surface, spot the tell, and choose the safe move. You have 60 seconds per case.

5 quick cases
60s per case
Earn a Red Flag Card
Inspect the message — check who it's really from and what you're being asked to do
Mail — Inbox
Action required: your password expires in 24 hours
IT
IT Service Desk
<security@microsoft-account-verify.com>
to me · 9:12 AM
High priority

Dear user,

We detected that your password will expire in 24 hours. To keep access to your account, reset it immediately using the secure link below.

Reset password now

Failure to act will result in your account being permanently locked.

IT Service Desk
Mail — Inbox
Invoice 4471 — payment overdue
AW
Anna Weber<a.weber@acme.com>
to me · 8:47 AM  ·  reply-to: billing@acme-billing.co

Hi,

Please find attached invoice 4471, now overdue. Kindly review and arrange payment today — full account details are inside the attached file.

HTML
Invoice_4471.html
48 KB

Best regards,
Anna
Sign in to your account
microsoft365.login-verify.co/auth/signin
Microsoft
Sign in
you@company.com
Password
Sign in
Can't access your account?
9:41
+1 (785) 402-1199
Unknown sender · Text Message
Today 9:38 AM
[IT-SECURITY] A new sign-in to your Microsoft account was detected. Verify now or your account will be locked in 2 hours: http://sosafe-it-verify.co/x9f2k
Text Message
DR
Daniel Roth
Regional ManagerExternal
Today
Hi — are you at your desk? 👋
Quick favour before the 2 pm board prep — can you export the current payroll sheet and send it over?
Let's keep this between us for now. Thanks 🙏
Daniel Roth · 1:41 PM
Type a message
{{ sceneKicker }}

{{ question }}

{{ srClue }}
{{ fbIcon }}
{{ fbTitle }}
{{ fbSub }}

{{ fbExplain }}

Red flag collected
{{ fbRedflag }}
Rule to remember
{{ fbRule }}
Challenge complete

You made {{ score }} of 5 secure decisions

{{ scoreSub }}

WEEKLY CARD UNLOCKED · No. 01
The Risky Ask

A polished, urgent message that pushes you toward a risky action — approve a payment, sign in, open a file — is a phishing hallmark. Check the ask before you act: verify the sender and route it through the proper process, no matter how real it looks.
The Rule Book
Timer paused · 5 rules to spot phishing
{{ r.n }}
{{ r.title }}
{{ r.rule }}
The golden rule: if a message creates urgency and pushes you to click, sign in, open or send, slow down and verify through a channel you already trust — no matter how real it looks.