🚩 Spot the Red Flag — Email Phishing Quiz!
How it works: Read each scenario and check the boxes for what you think are red flags. Then open Answer Key to compare.
Scenario 1: “Shared Document” on Google Drive
Subject: [Vassar Drive] Professor shared “Midterm Study Guide” with you
From: Google Drive <no-reply@googledrive-support.com>
Hi,
Dr. Williams shared a document with you: Midterm_Study_Guide.pdf
Open it here: view-document-now.info/vassar
If you can’t access the file, sign in again to confirm your account.
Check the red flags you notice:
Answer Key (Scenario 1)
Correct red flags:
- Sender domain looks official but isn’t a real Google domain.
- Link goes to a random domain (not an official Google Docs/Drive URL).
- “Sign in again” via link is a common credential-harvesting tactic.
- Vague greeting and context can indicate mass phishing.
Not a red flag by itself: Mentioning a professor’s name.
Scenario 2: Calendar Invite
Subject: Updated: Financial Aid Review Meeting
From: Financial Aid Office <financialaid@vassar-support.com>
You have been invited to a mandatory meeting regarding your financial aid status.
Date: Tomorrow at 9:00 AM
Location: Virtual (Zoom link attached)Please open the attached calendar file to confirm your attendance.
Attachment: Financial_Aid_Update.ics
Check the red flags you notice:
Answer Key (Scenario 2)
Correct red flags:
- Sender domain does not match official institutional email.
- Short-notice urgency (“tomorrow”) pressures quick action.
- Malicious .ics calendar files can contain phishing links.
- Financial aid themes create emotional stress and compliance.
Important: Calendar invites can include hidden phishing URLs. Attackers use meeting requests because they feel more “official” and bypass spam filters.
Safe practice: Verify meetings by contacting the department directly using official contact information — not by replying to the invite.
Scenario 3: “Free Gift” Giveaway
Subject: Congratulations! You’ve Been Selected for a Free AirPods Giveaway 🎉
From: Student Rewards <rewards@vassar-events.org>
Dear Student,
To celebrate Student Appreciation Week, we are giving away FREE Apple AirPods to selected students.
You were randomly chosen!
Claim your prize now: vassar-free-gifts.com/claim
Offer expires in 1 hour.
Check the red flags you notice:
Answer Key (Scenario 3)
Correct red flags:
- Sender domain does not match the official institution.
- External link not hosted on vassar.edu.
- Urgency (“1 hour”) pressures quick decisions.
- High-value free items are common phishing bait.
Important: Scammers frequently use “free gift” or “you’ve been selected” messages to collect login credentials or payment details.
Rule of thumb: If you didn’t enter a contest, you probably didn’t win one.
Scenario 4: “Approve This Login”
Context: Your phone receives repeated MFA prompts you didn’t initiate. Then you get a message:
IT Support: We’re fixing a login issue on your account. Please approve the next MFA prompt to confirm your identity.
Check the red flags you notice:
Answer Key (Scenario 4)
Correct red flags:
- If you didn’t try to log in, don’t approve MFA prompts.
- Attackers use “MFA fatigue” to get you to accept.
- Impersonating IT is a common social engineering tactic.
- Repeated prompts can be a sign of an active account takeover attempt.
Key rule: MFA only protects you if you approve prompts you initiated.
What To Do If You See Any of These
- If you noticed a theme, it was make to sure to CHECK the sender domain.
- Don’t click links or scan unknown QR codes.
- Verify independently: type the official site yourself (don’t use the email link).
- Report it using your campus reporting method or to your site’s reporting address.
- When in doubt: ask before acting.
