Phish or Fair? Take Our Phishing Quiz and Test Your Phish IQ
Monday July 16, 2007 at 3:48 pm CST
Posted by Shane Keats
How well can you spot phishing sites? Many of the readers of this blog are pretty savvy when it comes to security issues. So, we’ve created a deceptively easy but devilishly hard 10-question phishing quiz. Are you up to the challenge?
Our Phishing Quiz follows on the heels of our Spyware and Spam quizzes. More than 120,000 test results later, we can safely say that we have a lot of work left to do. The average score for the spyware quiz was 59%. For the spam quiz, 55%.
MailFrontier published the first phishing quiz back in 2004. Given the persistence and mutability of this plague, we thought it was time to revisit the issue. Whether it’s rockphishing, or Flash phish, or MySpace scams, phishing continues to evolve and ensnare both the ignorant–the people who don’t know better–and the arrogant–the people who should know better. And victims continue to lose real money. According to Gartner, per-victim losses soared to $1,244 in 2006 from $257 in 2004. That’s nearly a five-fold increase.
We encourage folks to share the quiz with friends and family. Use your expertise and the opportunity presented by the quiz to benefit from some of our hard-earned collective knowledge about phishing. Who knows? Together, we might even save a few people from getting hooked.
July 16th, 2007 at 4:53 pm
Only two of the sites in the quiz show the URL of the phishing site. The rest of the quiz asks the user to guess which site is real based on the site contents (spelling, logos, etc). We should be teaching users how to read URLs properly rather than encouraging them make security decisions based on data that’s under the attacker’s control. It won’t take long for the phishing group to hire people with good English and web design skills and then all the “education” from this quiz will be worhtless.
The best way to avoid phishing is to verify that the domain in the URL is a domain you trust and make sure that the site has a SSL certificate signed by trusted CA. It is best to always type the URL yourself, or use a previousely stored bookmark.