Phish or IT, the daily phishing game

A phishing game for anyone with a work inbox. Sixteen emails land in one morning, faster and faster, the same for everyone that day. The phish look like HR, and your own company's mail looks like a scam.

Report the phish, open the real mail. You work at example.com.

Monday morning. Sixteen emails. Three strikes and IT locks you out.

Take your timeHalf speed. Points don't count.

How to play the phishing game

Sixteen emails land in your inbox over one morning, closer together as it goes on. The oldest one you haven’t dealt with is open on screen.

Press Report phishing if it’s a phish, or Open if it’s real mail. On a keyboard, R reports and O opens. Fall behind and the unread mail piles up.

Spot the phish

You work at example.com. Every phish in the game has one thing on it that isn’t your company’s:

Where to look	On a phish
The sender’s address	Doesn’t end in example.com
A link	Goes somewhere that doesn’t end in example.com
The attachment	A file that runs, like .html, .zip or .exe

Real mail can be as loud as it likes. A deadline, a threat or a subject in capitals doesn’t make an email a phish.

Good to know

Three wrong calls and IT locks your account, which ends the morning.
Mail you never get to stays unread and scores nothing.
Take your time runs the morning at half speed.

How Phish or IT scores

Right calls in a row pay more.

What you do	Points
Right call	10
Fifth to ninth right call in a row	20
Tenth right call in a row and on	30
Wrong call	Nothing, a strike, and your run drops back a level

The top score is 350, for sixteen right calls in a row.

Daily and solo rounds

Every player gets the same morning on a given day. Play solo deals a new one.

The joke: your company fails its own training

Phishing training doesn’t stop people from clicking.

Health system staff, followed for eight months	Result
Staff in the study	More than 19,500
Had just done the annual training	No significant difference in whether they clicked
Had clicked at least one test phish by the end	More than half

The phish look like HR

The phish copy the emails office workers click most in phishing tests, like a shared document, a new dress code, a benefits update or overdue training.

All four made a top ten in 2025. Two quarters in a row, the most-clicked one was a shared file called “IT Help Desk Info”, with the company’s name in front.

The company in this game is made up, and so are its people and every address.

The real mail looks like a scam

Most of the real mail your company sends in this game would fail its own phishing course. All four of these are genuine:

A training reminder threatens you and hides behind a short link.
Payroll moves to a new portal and gives you until Friday.
The CEO’s survey is addressed to Dear Team Member and closes in 24 hours, behind a short link.
IT asks you to verify a password reset you never asked for.

So what gives a phish away

In the game, a phish always has a sender, a link or a file that isn’t your company’s. Outside it, a phish also gives itself away by what it asks for: your sign-in on a page that isn’t on example.com, new bank details, gift cards or the code on your phone.

The loud signs are the deadline, the threat, the short link and Dear Employee. In this game, they turn up more often on real mail than on phish. Our phishing email examples show one phish of each kind, with every red flag marked.

Questions about the phishing game

Is there a free phishing email simulator?

Yes, Phish or IT is free and needs no sign-up. It never sends an email, and it doesn't track who clicks. Each morning sixteen made-up emails land for you to open or report, and our phishing email examples page marks every red flag.

Is there a phishing quiz for employees?

Phish or IT works as one, against the clock. A right call scores 10, and a run of right calls doubles it, then triples it. Everyone gets the same emails on the same day, so a team can compare scores without sharing answers.

Why does real company email look like phishing?

Companies send it the way scammers do, with a deadline, a threat, Dear Employee and a link to an outside vendor. UK security guidance says a company should make sure staff can tell its real mail from a phish. Your inbox suggests nobody read it.

Is there a cyber security game?

Phish or IT is one, built on the phishing email. Every morning mixes phish with real company mail, and some phish come from a forged company address or a coworker's hijacked account. The hard part is the real mail, which would fail your company's own phishing course.

Sources

The 21 sources behind this page