Can You Spot the Phish? Fake Document Quiz
A fictional document-signing email hides four phishing flags. Count them before the reveal, then learn the direct route to check a real request safely.
An email says a document is waiting for your signature. Count the flags before you scroll, then check the reveal.
A document request feels routine. Someone sends a file, you review it, you sign, you move on. That routine is what this bait counts on. The message asks you to act quickly, through its own button, instead of a check you control.
This quiz is a safe way to practice. The email below is fictional. ShareVault Docs is a made-up document service, invented for this quiz. There is no real company behind it. The flags in it are real.
If you want more practice first, try the Spot the Phish quiz or the QR code quiz. This time the bait is a document waiting for a signature.
The email: read it before you scroll
The message arrives in your inbox like this:
FICTIONAL EMAIL — ShareVault Docs is a made-up service.
From: ShareVault Docs, at an address that does not match that name
Subject: Document waiting for your signature
A document is waiting for you. Sign within two hours or the agreement is cancelled.
REVIEW & SIGN
ShareVault Docs, the document, and the two-hour deadline are all fiction, invented to show the pattern. None of it is a message from a real company.
Pause here. How many flags can you find? There are four. Hold your number before you read on.
The 4 flags, revealed
Flag 1: It arrived unexpected
The first flag is the arrival itself. You were not waiting for a document to sign. The message turns up on its own and asks you to act on it.
Phishing messages are often unexpected. Do not click links in unexpected messages. That test comes first, before the wording or the button. This fictional email fails it at the inbox. Leave the button alone while you check the claim another way.
Flag 2: The sender address does not match
The second flag is in the sender line. The message claims to be from ShareVault Docs, but the actual sender address says something else. The name and the address do not match.
Check the sender's actual address against the service the message claims to be from. If the sender's address is not that service's domain, that mismatch should be a loud warning. A display name is easy to write. The address behind it is the part to read.
Flag 3: Urgency does the pushing
The third flag is pressure. The fictional message says to sign within two hours or the agreement is cancelled. That deadline is part of the fiction, invented for this quiz. It is not a claim about any real service or any real agreement.
The pattern behind it is real. Phishing messages use an urgent request — something will be cancelled, or a penalty will follow, and you have to act now. The urgency is there to get you to act on the message without thinking about it too much. Treat a deadline inside an unexpected message as a reason to slow down, not a reason to sign faster.
Flag 4: The button leads to a fake sign-in
The fourth flag is where the button leads. It takes you to a sign-in page asking for your email password. A page like that can be a fake version of a real site, designed to fool you into entering your username and password so the information you type can be stolen.
Skip the button. If the request could be real, go to the service yourself through a route you know is real — a saved favourite, a web search, or the address typed in by yourself — or contact the sender through a phone number, email, or website you know is real. Going direct keeps you off the page the message chose for you.
For the same habits in a different format, see the smish quiz — the bait there arrives by text.
What to do when a document request arrives
Do not click the button in an unexpected document message. Stop inside the message and decide whether the request could be real.
If it could be real, go direct. Open the service yourself through a route you know is real and check there whether a document is actually waiting for you. If nothing is waiting there, the email was the problem.
If you have already clicked, stop before you type anything. Do not enter your email password, or any other personal information, on a page a message sent you to.
Do this today. The next time a document request lands in your inbox, run the same four checks before you touch the button: Was I expecting this? Does the sender address match the service it claims to be from? Is it rushing me with a deadline? Is it asking me to sign in through its own link? If any answer points the wrong way, leave the message and go direct instead.
How many flags did you catch? Four was the full count: an unexpected arrival, a sender address mismatch, urgency with a deadline, and a button leading to a fake sign-in. The next real message will not label itself fictional. The flags will still be there.
Sources: CISA — Cybersecurity Awareness Month / Recognize and Report Phishing ↗ · FTC — Protect yourself from phishing scams ↗ · Microsoft Support — Protect yourself from online scams and attacks ↗