Verify through a route the message does not control.
Review suspicious delivery, banking, invoice and gift-card requests. Practise independent verification rather than trusting a logo, display name or urgent wording.
Four original scenarios each count one correct answer. Your count out of four describes this edition only; it is not a security certification, percentile, or prediction that an account is safe.
What these four scenarios examine
The requests use familiar settings because imitation can look ordinary: a parcel, a bank notice, an invoice and a colleague’s display name. The decision is where to verify the request before providing information, opening a file or paying. The exercise does not ask you to diagnose a message by typography or award safety merely because a logo looks convincing.
Build an independent route
Imagine a text about a missed parcel. Instead of following its link, open the delivery app you already use or locate the company’s official contact independently. Check the actual order there. Calling a new number supplied by the same text is still using the text’s route. A repeated story from that number is not independent confirmation.
Read the error behind a missed item
Return to the selected option and explanation. Did the option treat appearance as identity, urgency as permission, or opening an attachment as a way to verify it? Those are different reasoning errors. Four correct choices show the expected decisions here; they do not establish that you will notice every convincing message in a busy day.
A small rehearsal
Without contacting a suspicious sender, identify the trusted app or saved contact you would use for a fictional claim. Say what you need to verify before taking action. If this is a work account, follow the organization’s established reporting route. Do not send a real password or open a real suspicious attachment to practise.
Scope and sources
The original scenarios apply public FTC guidance about phishing and independent contact. They are not copied FTC questions or an endorsement. Real organizations can have additional procedures, and this short practice cannot authenticate an actual message. Use the service’s own trusted support route when an event needs investigation.