Spot the fakes before the timer runs out!
What it does. Phish or Legit? shows a timed stream of realistic-looking emails, texts, and pop-ups. Students have to call each one phishing or legitimate before the clock runs out, then get immediate feedback and a rundown of the red flags they caught or missed.
Why the timer matters. Real phishing is designed to catch people moving fast, in the middle of checking a phone between classes, not carefully reading every word. Practicing under a bit of time pressure builds the same quick pattern recognition, urgency language, mismatched links, too-good-to-be-true offers, that keeps people safe when it counts.
It's a safe simulation. Every message in this tool is invented for the exercise. Nothing is a real email, no links go anywhere unexpected, and no information is collected. It's a space to get fooled a few times and learn from it before a real phishing attempt shows up in an actual inbox.