Welcome to our cyber security game, Virus Runner. Below are the levels designed to test your knowledge on different types of phishing. Each level presents a series of phishing scenarios for you to identify if it is a scam. Then you will be provided with the correct and incorrect feedback for each scenario.

Level One: Phishing

Did you know phishing is an online scam where cyber scammers pretend to be trustworthy sources, like your bank or friends, to trick you into sharing sensitive information? They create realistic-looking messages or emails, often with a sense of urgency, to lure you into giving away your passwords, bank details, or personal data. To protect yourself, always verify the sender's identity, avoid clicking on suspicious links or downloading attachments, and never share personal info with strangers online!

Scenario 1: Online Payment Email

Scenario description: You have received an email from CyberAmazeON. It contains information asking for a large payment. The email also is demanding you provide payment within 24 hours through this link: https://totallylegitCyberAMAzeONnotascam.com.

Prompt: Is this a scam?

Correct answer: Yes, this is a scam.

Feedback: The email is a scam because it is asking for payment immediately through a suspicious link. Be wary of messages from unknown senders that create a sense of urgency and ask for payment. When in doubt, you can check your account directly with the company through their official website or phone number.

Incorrect answer: No, this is not a scam.

Feedback: Oh no, this was an email scam (also known as a phish). If you receive an invoice for an item that you haven't paid for, do not click the link! Instead check directly with your bank to see if you were charged. Also, if you do not remember paying for the item at this company, check with the company directly through their official website or phone number.

Scenario 2: Asking for Credit Card Information Email

Scenario description: You have received an email from an unknown sender. It contains information asking if he can borrow your parent's credit card information.

Prompt: Is this a scam?

Correct answer: Yes, this is a scam.

Feedback: Never share personal information or payment information with strangers!

Incorrect answer: No, this is not a scam.

Feedback: Oh no, this was an email scam (also known as a phish). Never share personal information or payment information with strangers!

Scenario 3: Redeem Discount Code Email

Scenario description: You have received an email from Pizza House. The email is asking you to redeem this Pizza House discount code “QSJWAAP546” on their official website.

Prompt: Is this a scam?

Correct answer: No, this is not a scam.

Feedback: Normally email scam messages would also try to include an embedded link along with the code, however the message contained only a redemption code. Also, when in doubt, make sure to confirm the website's link is real with Pizza House or with any company's customer support before redeeming the code.

Incorrect answer: Yes, this is a scam.

Feedback: A redemption code was the only piece of information offered to you. Hackers would often try to include a clickable link alongside the code to trick users into visiting websites.

Scenario 4: Suspicious Login Email

Scenario description: You have received an email from Google. The email is asking you to verify your account as there has been a suspicious login on your email account from an unrecognized device, and does not include any additional links or actions.

Prompt: Is this a scam?

Correct answer: No, this is not a scam.

Feedback: This is not a phishing message, as the sender wasn't trying to obtain information from you. Often organizations will require users to confirm new logins from unrecognized devices.

Incorrect answer: Yes, this is a scam.

Feedback: The sender wasn't trying to take your information from this email. Often organizations will require users to confirm new logins from unrecognized devices.

Scenario 5: Package Delivery Details Email

Scenario description: You are expecting a package to be delivered and have received an email from CyberAmazeON. It contains information about your order number of #OXPS21314 and your expected delivery. The email also stated that the expected package is about to be delivered and is timed to arrive at 3:07pm.

Prompt: Is this a scam?

Correct answer: No, this is not a scam.

Feedback: This is not a phishing (email scam) message. The sender did not try to obtain any information from you or redirect you to another website.

Incorrect answer: Yes, this is a scam.

Feedback: This email is passing on information to you with your order number and time delivered. Email scams will try to trick you into clicking links, such as checking your order status and redirecting you to another website.

Level Two: Smishing

Did you know that smishing is like phishing, only it happens through text messages. Scammers send fake messages that look real, pretending to be your bank or other trusted sources, to trick you into sharing personal info or clicking on malicious links. Be careful and never click on suspicious links or share sensitive data through text. If you're unsure, contact the company directly using a trusted phone number to verify the message's authenticity. Keep your guard up, stay safe and protect your info.

Scenario 1: Package Delivery Details Text Message

Scenario description: You receive a text message from CyberAmazeON but have not ordered any packages lately. The message says “Hello agent, your CyberAmazeON package with tracking code GB-6412-GH83 is expecting you to set delivery preferences: c7dvr.info/FGdGtk12vil3M”

Prompt: Is this a scam?

Correct answer: Yes, this is a scam.

Feedback: This is a smishing (text message) scam. These scams often contain links that redirect you to a website to fill out your personal information.

Incorrect answer: No, this is not a scam.

Feedback: Oh no, this was a texting scam (also known as a smish). This is a smishing (text message) scam. These scams often contain links that redirect you to a website to fill out your personal information.

Scenario 2: Gift Card Winner Text Message

Scenario description: You receive a text message that says “Congrats Agent! Your code L49-K8X7 printed on your last receipt is among 7 we randomly picked for $1000 Walmart gift card promotion k3xvc.info/pl1Llr3N5GN3M”

Prompt: Is this a scam?

Correct answer: Yes, this is a scam.

Feedback: This is a smishing (text message) scam, which often contain links that will redirect you to a website asking you to enter personal or banking information.

Incorrect answer: No, this is not a scam.

Feedback: Oh no, this was a texting scam (also known as a smish). These messages often contain links that will redirect you to a website asking you to enter personal or banking information.

Scenario 3: Package Delivery Confirmation Text Message

Scenario description: You have recently ordered a package from this company and are expecting delivery. You receive a text message that says “Hello from CyberVerse UNIQLO - Your expected package [JY1111000080500] was delivered to your mailbox or front door.”

Prompt: Is this a scam?

Correct answer: No, this is not a scam.

Feedback: This is not a scam. This message only provided you an alert about your expected package.

Incorrect answer: Yes, this is a scam.

Feedback: This is not a scam. This message only provided you an alert about your expected package.

Scenario 4: Social Media Authentication Text Message

Scenario description: You are signing into your Instagram account. You login and you now receive a text message. The message says “Please use 583983 as your security code to log in. We will never contact you for this code. Do not send show or send this code to anyone else.”

Prompt: Is this a scam?

Correct answer: No, this is not a scam.

Feedback: This is not a smishing (text message) scam. The message sent to you is a security code to sign into your Instagram account. Most smishing messages will display suspicious links alongside a security code when trying to scam you.

Incorrect answer: Yes, this is a scam.

Feedback: This is not a smishing (text message) scam. The message sent to you is a security code to sign into your Instagram account.  Most smishing messages will display suspicious links alongside a security code when trying to scam you.

Scenario 5: Browsing Social Media Comments

Scenario description: You are on social media, and you browse through the comments of a video you’re interested in. A user provides a link to get free product in the comment section.

Prompt: Is this a scam?

Correct answer: Yes, this is a scam.

Feedback: Never click on links on social media comments if you are unsure of where you will be redirected! The links might take you to a fake website, or contain malicious software designed to infect your device.

Incorrect answer: No, this is not a scam.

Feedback: Never click on links on social media comments if you are unsure of where you will be redirected! The links might take you to a fake website, or contain malicious software designed to infect your device.

Level Three: Vishing

Did you know that vishing is like phishing, only vishing happens over the phone? Scammers pretend to be trustworthy people like bank reps or officials and create a sense of urgency to trick you into giving away personal info. Remember to be careful with unplanned phone calls, hang up, and verify the caller's identity by contacting the organization directly using a reliable number when in doubt. Don't share personal info with anyone you don't trust on the phone.

Scenario 1: Government Verification Call

Scenario description: Your grandpa receives a phone call but is having a hard time hearing the caller. He passes the phone to you and the caller on the phone asks for your grandpa’s social insurance number and financial information to check for government verification.

Prompt: Is this a scam?

Correct answer: Yes, this is a scam.

Feedback: This is a scam! The caller is asking for personal information and is posing as a government employee.  Never share your personal information or financial information over the phone without confirming it is someone you know or trust.

Incorrect answer: No, this is not a scam.

Feedback: The caller is asking for personal information and is posing as a government employee. Never share your personal information or financial information over the phone without confirming it is someone you know or trust.

Scenario 2: Bill Payment Request Call

Scenario description: You receive a phone call, and the caller is asking you to pay your phone bill through the phone. He asks for your personal information first to confirm your identity and then is asking you to pay by providing your parent’s banking information.

Prompt: Is this a scam?

Correct answer: Yes, this is a scam.

Feedback: This is a vishing scam (voice mail). Hackers will often pose as service providers and ask for payment information. Never provide banking information over the phone.

Incorrect answer: No, this is not a scam.

Feedback: This is a vishing (voice mail) scam. Hackers will often pose as service providers and ask for payment information. Never provide banking information over the phone.

Scenario 3: Voicemail from Doctor’s Office

Scenario description: There is a voicemail left on your phone. The message says “Hello Agent, this is the receptionist from your new family doctor. You owe a balance of $50 dollars on your next visit for transferring all records from your previous doctor.

Prompt: Is this a scam?

Correct answer: No, this is not a scam.

Feedback: This is not a vishing (voice mail) scam. The voice message left by your new family doctor is asking for payment on your next visit. You can always ask your parents or call your new doctor to ask or check what the billing is for before spending money.

Incorrect answer: Yes, this is a scam.

Feedback: This is not a vishing (voice mail) scam. The voice message left by your new family doctor is asking for payment on your next visit. You can always ask your parents or call your new doctor to ask or check what the billing is for before spending money.

Scenario 4: Voicemail from Booked Flight

Scenario description: You have a flight tomorrow to New York. There is a voicemail left on your phone. The message says “Hello, your booked flight with East Jet for New York has changed. The flight time has changed from 8:00AM to 1:00PM due to some maintenance work, more information has been sent to your email.

Prompt: Is this a scam?

Correct answer: No, this is not a scam.

Feedback: This is not a vishing (voice mail) scam. This is an automated voice call giving you updates about the changes to your flight! The call did not ask you for your information or redirect you to a suspicious website.

Incorrect answer: Yes, this is a scam.

Feedback: This is not a vishing (voice mail) scam. This is an automated voice call giving you updates about the changes to your flight! The call did not ask you for your information or redirect you to a suspicious website.

Scenario 5: Internet Service Provider Call

Scenario description: You receive a call from your internet provider. The caller is asking that there is an overdue payment of $301.50 for your internet bill. He wants you to pay through the phone with your parent’s credit card or else he will cancel your service. The caller asks for all your parents credit card information.

Prompt: Is this a scam?

Correct answer: Yes, this is a scam.

Feedback: This is a vishing (voice mail) scam. Your service provider is unlikely to request payment information over the phone. If you are unsure if this is a legitimate request, hang up and call back your internet provider directly to confirm the bill.

Incorrect answer: No, this is not a scam.

Feedback: This is a vishing (voice mail) scam. Your service provider is unlikely to request payment information over the phone. If you are unsure if this is a legitimate request, hang up and call back your internet provider directly to confirm the bill.

Welcome to our cyber security game, Spot the Scam. Below are the scenarios designed to test your knowledge on safe online practices. Each scenario will provide you an example of a message. The objective of the game is to determine if the message is a scam by identifying the specific phase that indicates it is a scam message. Then you will be provided with feedback for each scenario.

Scenario 1: Online Gaming Chat Room

Scenario Description: You received a message from someone who you gamed with online, offering you a gaming keyboard as a token of appreciation for your teamwork.

Prompt: "Hey, thanks for having my back during that game. Since you’ve been a good teammate, do you want this gaming keyboard I no longer need? I’ll send it to you - send me your home address!"

Suspicious phrase: Send me your home address!

Feedback: Don’t share personal information with strangers. Even though this person is promising to give you a keyboard, this could be a trick to get your personal information. Remember we can never be sure who’s on the other side of the computer. To be safe, verify their identity by having your parents connect with theirs before sharing any personal information.

Scenario 2: Content Creator Brand Deal

Scenario Description: You are contacted by someone claiming to represent a talent agency, offering a lucrative brand deal based on your social media presence.

Prompt: “Hey! My name is Chloe from BM Talent Agency, and we saw your social media profile. We think you will be a perfect content creator for a brand deal with Nike. If you’re interested, click this link to apply."

Suspicious phrase: click this link to apply.

Feedback: This is an attempt to get you to click on the link which could be malicious.

Scenario 3: Concert Raffle Participation

Scenario Description: You received a message from an unknown sender to participate in a concert raffle.

Prompt: “Congratulations! You have been selected to participate in a raffle by Taylor Nation to win 2 tickets to the Taylor Swift Eras Tour. To confirm your participation, send your full name and email address."

Suspicious phrase: send your full name and email address.

Feedback: You should think twice before responding to an unknown number, especially one claiming that you have been selected to participate in a raffle for concert tickets.

Scenario 4: Social Media Friend Request

Scenario Description: You received a friend request from an unknown person on social media.

Prompt: Social media friend request: A profile showing user7836353 trying to follow you on Instagram with no profile picture and no bio. Instagram is even indicating it is a new account with no mutual followers. 

Suspicious phrases: profile showing user 7836353; new account with no mutual followers.

Feedback: If an account wants to follow you and was recently created and their username uses a lot of numbers or symbols, it’s likely a bot or a cyber criminal.

Scenario 5: Claim a Gift Card

Scenario Description: You received a text message from an unknown sender to claim a gift card.

Prompt: “Hey, click this link to claim a $1000 Apple gift card.”

Suspicious phrases: click this link.

Feedback: Cyber criminals will try to get you to click a malicious link to steal your information. Remember to be alert and ensure the link does not lead to a fake website, and that you know the sender.

Scenario 6: Grand Prize Winner

Scenario Description: You received a message on social media to let you know that you are a grand prize winner.

Prompt: Social Media Message from sarah63537: “Congrats! You’re our lucky grand prize winner. You’ve won a pair of Jordans, to collect your prize fill out this form with your address at giveaway.com.”

Suspicious phrases: fill out this form with your address at giveaway.com.

Feedback: This is a scam. Cyber criminals will try to get you to click a link that could be malicious or ask you to input your personal information to steal personal information such as your address or bank account information.

Scenario 7: Job Advertisement

Scenario Description: You received a job advertisement message from a potential recruiter, asking you to apply for their team.

Prompt: “Are you passionate about protecting the environment? Come join the Bottle company which attempts to reduce plastic waste. If you want to join our team, please include your name, address, social insurance number, banking information to apply. We’ll get back to you once we reviewed your application.”

Suspicious phrases: include social insurance number, banking information to apply.

Feedback: This is a scam. When applying for a job, a company may ask for your personal information after you passed the interview stage, however, this is at the initial application stage. Never send your banking information and social insurance number for a job.

Scenario 8: Celebrity Text Message

Scenario Description: You received a message from an unknown number who claims to be a well-known celebrity, asking you for funds.

Prompt: “Hey, it’s Drake! I need your help. This is urgent. I need you to transfer $2,000 so I can continue running through the six with the fam but my bank accounts are frozen. Send the funds to the following email aubrey$6dg@gmail.com”

Suspicious phrases: Drake; Urgent; Send the funds to the following email Aubrey$6dg@gmail.com.

Feedback: This is a scam. You should think twice before responding to an unknown number, especially one claiming to be a celebrity like Drake. Cyber criminals emphasize the urgency as a way to get you to send the funds without thinking.