Google phishing quiz: what it is, is it safe and how to spot fake copies

What is the Google phishing quiz

The Google phishing quiz is a free online test made by Jigsaw, a unit of Google, and it lives at phishingquiz.withgoogle.com. It shows you example e-mails and notifications, you decide whether each is phishing, and it then explains the signs.

Press coverage of the quiz, from sites such as Tom's Guide and 9to5Google, describes eight messages. Some are phishing attacks and some are normal mail. After every answer the quiz points out what gave the message away, or what showed that it was genuine.

The same coverage says the examples were inspired by real phishing mail and that Jigsaw built the quiz from security training it ran with a large group of journalists, activists and political leaders. We repeat these points as reported and did not verify them ourselves.

We also have to be plain about our own check. When our tool read the quiz page on 17 October 2026, it returned a title, Jigsaw Phishing Quiz, and the word Loading, because the questions are drawn by the page after it opens.

We could not play it, so we cannot confirm the current number of questions, the wording or the privacy text. Open the page in your own browser to see them.

People search for this name with a security question:

• is it safe
• is it a scam
• is it a virus

The short answers are yes it is safe at the right address, no it is not a scam by itself, and no it is not a virus. The long answers, and the cases where a page with this name is dangerous, are below.

Address of the real quiz

phishingquiz.withgoogle.com

Made by

Jigsaw, a unit of Google, according to press coverage

Format

Eight example messages; you judge each as phishing or not, then read the reasons

Cost

Free, runs in the browser

Not the same as

A virus, a Google security alert, a prize draw or a program you install

Is the Google phishing quiz safe, a scam or a virus?

The real quiz is safe, it is not a scam and it is not a virus. It is a web page for learning. The danger sits in imitations and in messages that use the quiz as bait.

A virus is a program, and the quiz is a page you read and click through. We found no URLhaus entry about it in the data our server reads, and the facts we hold name no malicious address connected to it. That is a statement about our data on 17 October 2026 and not a promise for every day and every visitor.

Here is where the risk is. Scammers copy anything popular. A text that says Google is giving a reward to people who finish its phishing quiz, an ad for a certificate of completion, or an e-mail that says your quiz score is waiting behind a sign in page would all be fakes.

We found no report of such a campaign, so we do not say one is running. We say the trick is easy to build and that the test below tells you whether you are on the real page.

The test is the address. The real quiz sits on a withgoogle.com name, so the part before the first single slash must end in withgoogle.com, and the page must be reached by an address you typed or a link from Google's own pages. An address like withgoogle.com.something-else.example is not Google, because the end of the name is what counts.

What we checked for this guide, and what we could not

The subject of this guide is a name and not a web address, so there was no plain request to a suspect site. We read the quiz page, Google's help page on phishing, and press coverage. We did not play the quiz and we did not test any imitation.

What the quiz teaches: five checks for every message

The quiz trains five habits: read the sender, read the link, notice the pressure, distrust the attachment and refuse the request for secrets. They work on any message, including the ones that point you to a quiz.

Start with the sender. Google's help page tells you to check that the sender name and the e-mail address match. A message that shows a familiar name but comes from an unrelated address fails this check at once. Next, the link.

On a computer, hover over a link before you click and read the address that appears. Coverage of the quiz gives an example of a name that begins with mail-google but ends in a domain nobody has heard of: only the end of the name counts.

Pressure is the third sign. Messages that scream urgency, threaten to close an account, or promise something too good to be true are built to stop you thinking. Google's page says the same: be wary of urgent or too good to be true messages.

The fourth sign is an attachment you did not expect, especially with an odd name or type. The fifth is any request for a password, a one time code or money by message. Google states that Gmail will not ask for your password over e-mail.

The quiz adds one lesson that people often miss. Some of its messages are real. If you treat everything as fake you will mark genuine mail wrongly and still miss the clever fakes. The aim is to check, not to panic.

How to tell the real quiz from a copy

Type phishingquiz.withgoogle.com yourself, or search for Jigsaw phishing quiz and check the address before you click. Do not use a link from a message that you did not ask for.

Look at the address bar after the page opens. The name must end in withgoogle.com. Remember that anything can be written before that end, so read from the right. A page that sits on a long name with several hyphens, or one that puts google at the start and another name at the end, is not Google.

Next, watch what the page asks. The quiz as described is a game of judging example messages. It does not need a password to start, and it does not sell anything.

A page that wants a sign in, a code from your phone, a phone number, a card or a payment is not following the pattern of the real one, and you should close it. Our own read of the page found no sign in step, but because the questions did not load for our tool, we base this on press coverage.

Finally, ask who sent you there. If a stranger, a text or an unexpected e-mail did, treat the link as a lure, whatever it is called. Open a new window and go to the address yourself, or call the organisation the message claims to come from, as the FTC advises.

Why people search for this name, and what else it can mean

Most people who search for the Google phishing quiz want to take it, to pass it for work or school, or to check it is safe. A smaller group have received a message that mentions it.

Some employers and schools tell staff and students to practise spotting phishing, and a free Google test is an easy pick. If your employer sent you the link, ask the security or IT team to confirm it. If you only received a link by text or e-mail from someone you do not know, treat it as a lure.

The name can also be confused with other things. A phishing simulation run by your own company is a different thing: it sends test e-mails to staff to measure who clicks, and the training page you land on afterwards belongs to that company.

A real Google security alert is another thing again. If an e-mail claims to be one, Google's page says to check your activity at myaccount.google.com/notifications instead of using the link inside.

Last, there is no program called Google phishing quiz on your device. If a site or an app tells you it found one and sells a remover, it is selling fear. There is nothing to remove, and you should not pay.

A scam that borrows the quiz would follow the usual phishing path: a lure, a lookalike link, a request for something that you should not give, and then the theft. This is the pattern of the trick and not a report of a case we have seen.

The lure can arrive as a text, a social media post, a pop up ad or an e-mail. It says that Google is rewarding people who finish its phishing quiz, or that your company or school requires you to finish it by a deadline.

The link then goes to a page that looks like Google's but sits on another address. At the point where a real quiz would simply start, the fake asks you to sign in with your Google account to save your result, or to enter a card number to pay a small processing fee for the reward.

Whatever you type goes to the owner of the fake page. A password is enough for them to try your mail, your drive and, because many people reuse passwords, other accounts. A card number is used or sold. The FTC's consumer advice describes the same shape for phishing in general: scammers pretend to be a company you know, and they push you to act at once.

One more version is worth knowing. A page might ask you to allow notifications in the browser, or to install an extension or a file, to continue. A real quiz that runs in the browser needs none of those. If you gave the permission, see the clean up steps below.

• High

  Google password typed into a fake page

  The thief can try your mail and other accounts. Change the password at once.

• High

  Card number typed for a fee or reward

  The card can be charged or sold. Call the bank.

• Medium

  Notifications allowed or a file installed

  Spam can keep arriving. Remove the file or extension and block the site.

• Low

  You only opened the page

  Usually nothing is lost, but close it and do not return.

What to do if you typed a password into a fake quiz

Act within minutes: close the page, change the password from a device you trust, check your account activity and turn on 2-Step Verification. These steps follow Google's own help pages.

1. 1

   Close the page and go to Google yourself

   Close the tab. Type myaccount.google.com in a new window. Do not use any link from the message. Google's help page says that if a link asks for your password you should go directly to the website you want to use.

2. 2

   Change the password

   In your Google Account, change the password to a long one you have not used before. Google's page says to find and change unsafe saved passwords in your account. Change the same password on every other site where you used it, starting with your e-mail.

3. 3

   Check recent security activity

   Google says that for a security e-mail that seems fake you can go to myaccount.google.com/notifications to see your recent security activity. Look for sign ins from places or devices you do not know and sign them out.

4. 4

   Turn on 2-Step Verification

   Google recommends 2-Step Verification as an extra layer if a password is stolen. With it, a thief who has only the password cannot get in.

5. 5

   If a card was typed

   Call the bank on the number on the card, say the number went to a fake page, and ask for the card to be blocked and for the charges to be watched.

6. 6

   If you allowed notifications or installed something

   Open the browser's site settings and set notifications for the page to Block. Remove any extension or file you added after the page asked. Then run a scan with the security program you already trust. The page cannot be removed from your device because it was never installed: only what you allowed needs undoing.

7. 7

   Report it

   In Gmail on a computer, open the message, click More next to Reply, then click Report phishing, as Google's help page describes. In the United States you can also report phishing to the FTC at FTC.gov/complaint.