Phishing Test: What It Is and Is It Safe? (2026) - 2

Do it yourself · free Remove phishing test yourself 4 steps, 12 minutes, no software needed.

Phishing test: summary

Facts checked on 25 October 2026 against Microsoft's Attack simulation training page (updated July 2026), KnowBe4's Phishing Security Test page and the FTC's phishing page. Our check was desk research only: the subject is a phrase, so no plain request was made from our server. Google's Phishing Quiz page did not load its content for us and is not described.

What a phishing test is

A phishing test is a harmless imitation of a phishing attack. It is either a simulated message that an organisation sends to its own staff, or a quiz or checker that you open yourself, and its purpose is to measure and teach how well people spot fake messages.

The words cover three different things, and they behave very differently. The first is the simulated phishing email that a company's IT or security team sends to employees. The second is an online quiz where you look at example emails or pages and say which are fake.

The third is a real attack that uses the words 'phishing test' as bait, for example a message that says your account was selected for a security test and you must sign in. People for the phrase because they have one of these in front of them and want to know if it is safe.

We use the word test in the title because that is the phrase people type. The page is not a virus or an app named Phishing test. There is nothing called Phishing test to uninstall from a computer or a phone, and a site that offers a Phishing test remover is selling something you do not need.

This guide covers what each kind looks like, how to tell a company test from a real attack, what the test records you, what to do if you clicked or typed a password, and how to report a message. Where our own check has limits, we say so in the text.

Is a phishing test safe?

A phishing test sent by your own organisation is safe in the sense that it is built not to harm you, but you cannot know it is a test from the message alone. Treat every suspicious message as real until your IT team confirms it was theirs.

Tools made for this job say what they do. KnowBe4 describes its free Phishing Security Test as sending one email to each user, with text meant to lure the person into clicking a link.

A click leads to a landing page that tells the user they were in a simulated phishing test and gives rules for inspecting emails. Microsoft describes its Attack simulation training as delivering 'realistic but harmless' phishing messages to users inside an organisation.

The word harmless describes the tool, not the message in your inbox. If a message you got looks like a test, three explanations are possible:

your employer sent it

a real attacker sent it

someone copied the style of a test

A fake can ask for a password just as a test does, and the difference is only who receives what you type.

That is why the safe habit is the same in all three cases. Do not enter a password on a page you reached from a message. Do not open an unexpected attachment. Check with the sender by a route you already know, and report the message, as the sections below describe.

How to tell the phishing test e-mail is fake

a company using a phone number or website you already know, not the details in the message.

Use your mail program's report button, or forward phishing emails to [email protected] and texts to 7726.

Report any phishing attempt to the FTC at ReportFraud.ftc.gov.

Keep your computer's security software updated and run a scan after a click on a doubtful link.

Use a different password for each account and turn on two step sign in.

Type a real password into a page you reached from a message, even one that says it is a test.

Open an unexpected attachment or scan a QR code in a message you doubt.

Pay for a Phishing test remover; there is nothing by that name to remove.

to the sender to ask whether it is real.

Forward a suspected phishing email to colleagues instead of the security team.

Is phishing test dangerous? What the senders want

The three kinds of phishing test, side by side

The kind of test decides what happens : a company simulation records who clicked, a quiz records nothing your accounts, and a fake test is a real attack. The table lists what each does and what you should do.

How a company phishing test works

In a company test, the security team picks who gets a fake message, what it pretends to be and what happens after a click. The tool then counts opens, clicks, typed passwords and reports, and can give training to those who fell for it.

Microsoft's page for Attack simulation training, last updated in July 2026 and read by us on 25 October 2026, lays the parts out. A simulation is the whole campaign:

who gets the message and on what schedule

the payload (a link or an attachment)

the theme of the message

such as a delivered package

a problem with your account or a prize

the training that follows a right or wrong action

Microsoft lists the techniques as credential harvest, malware attachment, link in attachment, link to malware, drive by URL, OAuth consent grant and a how to guide. Link based ones can use a QR code instead of a URL.

The tool needs a licence: Microsoft says Attack simulation training requires Microsoft 365 E5 or Defender for Office 365 Plan 2, with a reduced trial for E3 customers. It records what each user did to the message, such as deleting it, reporting it, opening the payload or entering credentials, and who finished the training. Microsoft adds that results can be compared by department.

KnowBe4's free Phishing Security Test is simpler. It sends one email per user, uses a link test, and shows the landing page that explains it was a simulation. Its measure is the Phish-Prone Percentage, the of users who 'failed' the test. KnowBe4 says a PDF report arrives 24 hours after the test, and that to learn which people clicked, the customer goes through a KnowBe4 representative or reseller.

What neither page tells us is how your employer uses the results. That is a matter of the company's policy, and you can ask your IT or HR team. Nothing in the vendor pages we read says a click installs software on your device.

Domains the Microsoft simulator uses, and why a click may look odd

Microsoft publishes the web addresses that its simulator uses in the links of fake messages. They are made up names that look like services, not real brands, so a link to one of them in your mail can be a Microsoft test, though it can also be a coincidence of name.

We show six of the many names on Microsoft's list. The full list is on the Microsoft page cited in the sources. Microsoft also notes that Google Safe Browsing can block these simulation addresses, so an employee may see a browser warning on a test link. A warning does not prove the message was real and a missing warning does not prove it was safe.

The list only helps in one direction. A link that matches it is probably from a company test run with Microsoft's tool. A link that does not match proves nothing, because other tools use their own addresses and real attackers register new names every day. Never use the list to decide that a link is safe to enter a password into.

What we checked for this guide, and what we could not

This guide is a phrase, not an address. Our server made no request, and there is no website, file or URLhaus entry to test. What we did was read vendor and regulator pages and mark clearly what they say and what they leave open.

phishing test · desk check · 25 October 2026

Plain request from our server Not made. The subject is a phrase, so the worker marked the probe as not requested: not a plain DNS name.

Malware address lists No reported URLs for the subject in the data our server reads on 25 October 2026. This is not a clearance of any message that uses the name.

Vendor pages Read: Microsoft's Attack simulation training (updated July 2026), KnowBe4's Phishing Security Test page, the FTC's phishing page.

Google's Phishing Quiz Its page title is Jigsaw | Phishing Quiz, but our fetch returned only the title and a loading message, so we do not describe its questions, length or data use.

Which message you got We cannot see your message. Whether it is a company test or a real attack depends on who sent it, which only you and your IT team can find out.

A training exercise in most cases, a real attack in some A phishing test is designed to be harmless, but the name also fits a scam. Check the sender, never enter a real password on a page you reached from a message, and report it.

How to tell a test from a real attack

You cannot tell for sure from the message, so confirm with the sender by a route you already trust. The signs of a lure are the same in a test and in an attack, which is the point of the exercise.

1 Look at what the message asks The FTC lists the usual lures: a claim of suspicious activity or a problem with your account, a request to confirm personal or financial details, an invoice you do not recognise, a link to make a payment or update payment details, a generic greeting such as Dear customer, and an offer that is too good to be true. A message with any of these deserves a pause, test or not.

Look at what the message asks

The FTC lists the usual lures: a claim of suspicious activity or a problem with your account, a request to confirm personal or financial details, an invoice you do not recognise, a link to make a payment or update payment details, a generic greeting such as Dear customer, and an offer that is too good to be true. A message with any of these deserves a pause, test or not.

2 Ask whether you know the sender The FTC says to ask yourself whether you have an account with the company or know the sender. If you do not, it may be phishing. If you do, the company using a phone number or website you know is real, not the information in the message.

Ask whether you know the sender

The FTC says to ask yourself whether you have an account with the company or know the sender. If you do not, it may be phishing. If you do, the company using a phone number or website you know is real, not the information in the message.

3 Ask IT through your own channel At work, do not to the message. Open the company's helpdesk page, or phone the number on the intranet, and ask whether a test was planned. Many organisations also give a report button in the mail program, which sends the message to the security team without you opening it.

Ask IT through your own channel

At work, do not to the message. Open the company's helpdesk page, or phone the number on the intranet, and ask whether a test was planned. Many organisations also give a report button in the mail program, which sends the message to the security team without you opening it.

4 Check the link without opening it On a computer, hover over the link to read its address. On a phone, touch and hold it to preview. Compare the domain with the real company's. A word like login or secure before the company name does not make it theirs. Do not scan a QR code in a message you doubt.

Check the link without opening it

On a computer, hover over the link to read its address. On a phone, touch and hold it to preview. Compare the domain with the real company's. A word like login or secure before the company name does not make it theirs. Do not scan a QR code in a message you doubt.

5 Report instead of deleting If it was a test, your report counts in your favour: Microsoft's tool records who reports the message. If it was real, your report helps the team protect everyone else. Deleting alone helps nobody.

Report instead of deleting

If it was a test, your report counts in your favour: Microsoft's tool records who reports the message. If it was real, your report helps the team protect everyone else. Deleting alone helps nobody.

A fake message that calls itself a phishing test

We found no primary source that documents a scam campaign by this exact name, so we do not call any named message a scam. We describe the pattern as our reading: an attacker can use the idea of a test to make a lure sound routine.

A message such as 'your account was selected for a security awareness test, sign in to confirm' costs the sender nothing. It works because staff have been told that tests happen, and a person who clicks may think it is only a test and type a password without worry. The FTC's list of signs applies in full:

it uses your account or an urgent problem as a reason

it links to a page you did not open yourself

A genuine company test does not need your real password. In the vendor pages we read, the landing page that follows a click explains the exercise and gives advice.

A page that, after a click, asks you to sign in with your real credentials is a risk, because from the page alone you cannot tell whether it belongs to your employer's test or to a thief. Microsoft's own description of the credential harvest technique shows why: a themed sign in page that asks for username and password is exactly the shape of a real attack.

So the rule is simple. Never type a real password into a page you reached from a message, even if the message says it is a test. If you did, change that password from a different route and tell IT, as the section describes.

Low You clicked a link in a message that said it was a test If it was your employer's simulation, you may get a training notice. If it was real, the page could have loaded unwanted content, so run the steps below.

You clicked a link in a message that said it was a test

If it was your employer's simulation, you may get a training notice. If it was real, the page could have loaded unwanted content, so run the steps below.

Medium You typed your password on the page If it was a company test the page should not store it, but you cannot confirm that. Change the password and tell IT.

You typed your password on the page

If it was a company test the page should not store it, but you cannot confirm that. Change the password and tell IT.

High You opened an attachment or approved an app access request A real attack can run code or take access to your mailbox. Disconnect, scan, change passwords from another device and call IT.

You opened an attachment or approved an app access request

A real attack can run code or take access to your mailbox. Disconnect, scan, change passwords from another device and call IT.

If you clicked the link or replied

If you clicked a phishing test link or typed a password

A click on its own does little. A typed password or an opened attachment is what needs action, and the steps are the same whether the message was a test or an attack, because you cannot know which one it was.

1 You only clicked and closed the page Close the tab. Update your computer's security software and run a scan, which is the FTC's advice for anyone who clicked a link or opened an attachment, and remove anything it flags. Tell IT if the message came to a work account.

You only clicked and closed the page

Close the tab. Update your computer's security software and run a scan, which is the FTC's advice for anyone who clicked a link or opened an attachment, and remove anything it flags. Tell IT if the message came to a work account.

2 You typed a password Change that password now, from a device you trust and by going to the real site yourself, not through the message. Change it everywhere you reused it. Turn on two step sign in for the account. Then tell IT or the account provider.

Change that password now, from a device you trust and by going to the real site yourself, not through the message. Change it everywhere you reused it. Turn on two step sign in for the account. Then tell IT or the account provider.

3 You gave card, bank or ID numbers The FTC says that if you think a scammer has your Social Security, credit card or bank account number, you should go to IdentityTheft.gov for steps based on what you lost. Outside the United States, call your bank on the number printed on your card.

You gave card, bank or ID numbers

The FTC says that if you think a scammer has your Social Security, credit card or bank account number, you should go to IdentityTheft.gov for steps based on what you lost. Outside the United States, call your bank on the number printed on your card.

4 You opened an attachment or approved an app Disconnect from the network, run a full scan, and on a work device stop and call IT. If a page asked to grant an app access to your mail or files, remove that app in your account's connected apps page. We could not verify a vendor path that fits every account, so look for the app permissions page of your provider.

You opened an attachment or approved an app

Disconnect from the network, run a full scan, and on a work device stop and call IT. If a page asked to grant an app access to your mail or files, remove that app in your account's connected apps page. We could not verify a vendor path that fits every account, so look for the app permissions page of your provider.

5 Report it Forward the email to the Anti-Phishing Working Group at [email protected], forward a text message to 7726 (SPAM), and report any attempt to the FTC at ReportFraud.ftc.gov, as the FTC's page lists. At work, use the report button or the address your IT team gave.

Forward the email to the Anti-Phishing Working Group at [email protected], forward a text message to 7726 (SPAM), and report any attempt to the FTC at ReportFraud.ftc.gov, as the FTC's page lists. At work, use the report button or the address your IT team gave.

What a phishing test says you, and what it does not

Failing a phishing test does not mean you did something wrong with your device. It is a measure of how often people click a lure, and the vendors present it as the start of training, not a verdict.

KnowBe4's Phish-Prone Percentage is the of an organisation's users who failed the test, shown on a dashboard and, after a year of training and simulated phishing, compared with other organisations in the same industry.

Microsoft's page adds a predicted compromise rate for each payload, a forecast of how many people a given message will fool, based on aggregated and anonymised results from other simulations. It says that a perfect lure fools nearly everyone, and an obvious one fools nobody.

That detail matters for fairness. A message in a test is often designed to be convincing, and Microsoft itself says people differ in which messages they find hard. If your employer uses click counts for anything beyond training, that is the company's choice, and you can ask what the policy is. We found no vendor statement of how individual results are used by employers, and we do not invent one.

What the test cannot show is whether a real attacker would have succeeded against you. It shows a click on a day, in a mood, under a workload. The useful result for you is the habit:

A person who reports a message has done the right thing, whether it was a test or not.

Online phishing quizzes

An online phishing quiz is a training tool you choose to open. It shows example emails or pages and asks which are fake, and it is the safest way to practise because nothing arrives in your inbox.

One such quiz is Jigsaw's Phishing Quiz at phishingquiz.withgoogle.com. When we opened it, the page returned only its title and a loading message, so we cannot describe its questions or what it records, and we have not tested other quizzes. We do not rate any quiz from a title alone.

A few cautions apply to any quiz, in our reading. Do not type a real password, card number or personal details into a quiz.

Be wary of a site that offers a phishing test as a pop up, asks you to download a program, or asks for your email address before it starts. Such sites may be collecting addresses rather than teaching. A real awareness quiz needs none of that.

Quizzes teach the signs in the FTC's list:

an unexpected message

a link to pay or confirm

After two or three rounds you will spot them faster, and speed is what a real attack tries to take away.

If you run a phishing test for your organisation

If you are the one setting up a test, tell the right people, use a tool that explains itself to the recipient and treat clicks as a reason for training, not for blame. Both vendor pages we read describe training as part of the loop.

Microsoft's tool lets you assign training to users based on their action or lack of action, including training only campaigns and how to guides that do not test anyone. It also records who reports the message, which gives you a number for the behaviour you want. KnowBe4's free test is a single link test with a landing page that tells the user it was a simulation.

Two practical points from the Microsoft page. The simulation addresses can be blocked by Google Safe Browsing, so check them in the browsers your staff use before a campaign. And the same page notes that the simulator uses Safe Links to track clicks on the URL in the message, even when click tracking is off in the policy, which your privacy notice for staff should reflect.

If your own staff report that a real attack was in the same week as your test, handle it as real first. A simulation should never hide a genuine incident from the people who need to see it.

What to do after the phishing test e-mail

If you only received the message and clicked nothing, step 3 is all you need.

If you clicked the link or typed anything on the page it opened, do every step, starting with the password.

1 Step 1 : Change the password you typed on the fake page If you entered a password after clicking the link in the phishing test message, treat that account as known to the sender. Open the provider's real site by typing its address yourself, not through any link in the e-mail, and change the password there. Choose a new one you have never used before, and change it on every other account that shared the old one. Then use the option to sign out of all other sessions or devices, if the provider has one. This works the same in any browser on Windows 11 and Windows 10. Full procedure with screenshots: Turn on two-step verification / secure a hacked account

Step 1 : Change the password you typed on the fake page

If you entered a password after clicking the link in the phishing test message, treat that account as known to the sender.

Open the provider's real site by typing its address yourself, not through any link in the e-mail, and change the password there. Choose a new one you have never used before, and change it on every other account that shared the old one.

Then use the option to sign out of all other sessions or devices, if the provider has one. This works the same in any browser on Windows 11 and Windows 10.

Full procedure with screenshots: Turn on two-step verification / secure a hacked account

2 Step 2 : Turn on two-step verification Two-step verification asks for a code from your phone or an authenticator app whenever someone signs in from a new device. A stolen password alone is then not enough to open the mailbox. Turn it on in the security settings of the e-mail account first, then for the bank, shop and social accounts that send their reset links to that address. While you are there, check the recovery e-mail and phone number and the forwarding rules, which attackers sometimes change to keep access. The settings pages look the same on Windows 11 and Windows 10. Full procedure with screenshots: Turn on two-step verification / secure a hacked account

Step 2 : Turn on two-step verification

Two-step verification asks for a code from your phone or an authenticator app whenever someone signs in from a new device. A stolen password alone is then not enough to open the mailbox.

Turn it on in the security settings of the e-mail account first, then for the bank, shop and social accounts that send their reset links to that address.

While you are there, check the recovery e-mail and phone number and the forwarding rules, which attackers sometimes change to keep access. The settings pages look the same on Windows 11 and Windows 10.

Full procedure with screenshots: Turn on two-step verification / secure a hacked account

3 Step 3 : Report the e-mail and delete it Report the message instead of only deleting it. In Outlook choose Report > Report phishing , in Gmail the three-dot > Report phishing ; the provider then blocks the same message for other people. Do not and do not click anything else in it. On a work account, forward it to your IT team as an attachment first. Web mail and the mail apps on Windows 11 and Windows 10 offer the same options. Full procedure with screenshots: Report a phishing e-mail

Step 3 : Report the e-mail and delete it

Report the message instead of only deleting it. In Outlook choose Report > Report phishing , in Gmail the three-dot > Report phishing ; the provider then blocks the same message for other people.

Do not and do not click anything else in it. On a work account, forward it to your IT team as an attachment first. Web mail and the mail apps on Windows 11 and Windows 10 offer the same options.

Full procedure with screenshots: Report a phishing e-mail

4 Step 4 : Scan the PC if you opened a file from the message A page that only asked for a password installs nothing, so most readers can skip this step. If the phishing test e-mail or the page it opened made you download or open a file, delete it and run a full scan, then a Microsoft Defender Offline scan. In Windows 11 and Windows 10 open Windows Security > Virus & threat protection > Scan options , select Microsoft Defender Antivirus (offline scan) and click Scan now . The PC restarts and the scan takes 15 minutes, so save your work first. Full procedure with screenshots: Run a Microsoft Defender Offline scan

Step 4 : Scan the PC if you opened a file from the message

A page that only asked for a password installs nothing, so most readers can skip this step.

If the phishing test e-mail or the page it opened made you download or open a file, delete it and run a full scan, then a Microsoft Defender Offline scan.

In Windows 11 and Windows 10 open Windows Security > Virus & threat protection > Scan options , select Microsoft Defender Antivirus (offline scan) and click Scan now . The PC restarts and the scan takes 15 minutes, so save your work first.

Full procedure with screenshots: Run a Microsoft Defender Offline scan

Questions phishing test

What is a phishing test?

A phishing test is a fake phishing message, page or quiz made to measure and teach how well people spot real phishing. An employer or school sends the message to staff, or you open a quiz on your own.

Microsoft describes its version as realistic but harmless phishing messages delivered to users, and KnowBe4 describes a single email with a lure link that leads to a page saying it was a simulation. Nothing named Phishing test is installed on your device, so there is nothing to uninstall.

Is a phishing test email safe to click?

You cannot know from the message alone, so do not click. A genuine test from your employer is built to be harmless, but a real attacker can send an identical message, and a fake sign in page looks the same as a test page.

Ask IT through a channel you already trust, use the report button, and treat the message as real until someone confirms it. If you already clicked and typed nothing, close the page, run a scan and tell IT. If you typed a password, change it from another route.

How do I know if a phishing email is a test from my company?

Only your IT or security team can confirm it. The signs of a lure are the same in a test and in an attack:

a claim of an account problem

a request to confirm details

an invoice you do not know

a generic greeting or a too good offer

Do not to the message. Phone the helpdesk number you already know, or use the report button, which many organisations provide. Microsoft's tool records who reports a message, so reporting is the safe move either way.

What happens if I fail a phishing test?

In the vendor tools we read, a click leads to a landing page that explains it was a simulation, and the tool may assign training. KnowBe4 measures the of users who failed as the Phish-Prone Percentage; Microsoft records actions such as opening the payload or entering credentials and who finishes training.

What your employer does with individual results is the company's policy, and the vendor pages do not say. You can ask HR or IT. A failed test does not mean your device has a virus.

Can a phishing test steal my password?

A test is designed not to, but the same shape of page is exactly what a thief uses. Microsoft's credential harvest technique shows a themed page that asks for a username and password, and a real attack does the same.

From the page, you cannot tell whose it is. So never type a real password into a page you reached from a message. If you already did, change the password from a trusted device, change it wherever you reused it, turn on two step sign in and tell IT.

What do I do if I clicked a phishing link?

Close the page. The FTC advises you to update your computer's security software, run a scan and remove anything it flags.

If you think a scammer has your Social Security, credit card or bank account number, go to IdentityTheft.gov for steps based on what you lost. Change any password you typed, from another route. Then report it:

forward email to [email protected]

forward texts to 7726

report to ReportFraud.ftc.gov

At work, tell your security team first.

Where do I report a phishing email or text?

The FTC lists three places. Forward a phishing email to the Anti-Phishing Working Group at [email protected]. Forward a phishing text message to 7726, which spells SPAM.

Report any phishing attempt to the FTC at ReportFraud.ftc.gov. These are United States services; in other countries, use your national fraud or cyber reporting service or your mail provider's report button. At work, use the report button or the address your IT team gave, so the message reaches the people who can block it.

Is there a free phishing test I can take?

There are two meanings. KnowBe4 offers a free Phishing Security Test for organisations, which sends one link test email to each user and mails a PDF report 24 hours later.

For a person, an online quiz such as Jigsaw's Phishing Quiz exists; we could not read its content, so we do not describe it. Whatever you take, do not type a real password or card number into it, and avoid sites that ask you to install something or give your email address before you start.

Do I need a phishing test remover or virus scan?

No remover is needed, because a phishing test is a message or a quiz, not a program. A site or ad that sells a Phishing test remover is using the name to sell you something.

What helps is free: report the message, and if you clicked a link or opened an attachment, update your security software, run a scan and remove what it flags, as the FTC advises. If you typed a password, change it. If you installed something because of the message, remove it in your system's list of apps.

Will Fortect remove phishing test?

Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.

For phishing test, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.

Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.

Microsoft Learn: Get started using Attack simulation training (Defender for Office 365, updated July 2026) ( read October 25, 2026 )

KnowBe4: Phishing Security Test ( read October 25, 2026 )

FTC Consumer Advice: How to recognize and avoid phishing scams ( read October 25, 2026 )

Jigsaw: Phishing Quiz (page title read; content did not load) ( read October 25, 2026 )