Annual phishing training teaches slogans; attackers write emails that sound like Friday afternoon. Five real-shaped messages, two of them genuine. For each: name the building the address really comes from, then report, verify or trust it. The tells come afterwards, not before.
Each message scores up to 3: the action (best 2, defensible 1, wrong 0) and naming the building the address really comes from (1). Maximum 15. A pass needs 12 or more, no lost password or gift cards, and at most one genuine email reported. Over-flagging is scored because a security queue full of genuine mail hides the real attacks.
All senders, domains, links and incidents are fictional composites built from realistic attack patterns — no real company is depicted · runs fully offline · drafted with AI assistance and fully rewritten, fact-checked and owned by a human.